Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-09-2024 10:12

General

  • Target

    eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe

  • Size

    1.8MB

  • MD5

    16eba1f939a7c8d10aa7a300cf48658a

  • SHA1

    d291806bdd49d3016994f05834ed4100b042aa95

  • SHA256

    eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e

  • SHA512

    a7c69ae67d0a53eb384f35f126f12a0e92937a900e5b7ce718746eeda0cfb4061f81ba34c68ac97de3f80ff6ef4a161cd8c6e629c69b76443d18bb0c9b89051b

  • SSDEEP

    49152:WxmJVsjaD3cB0mYz0QAhpwlgqN/YkuNgC48MQ7nt:WxaijaD36Y09QlgEIyLhQ7nt

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
    "C:\Users\Admin\AppData\Local\Temp\eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Users\Admin\AppData\Roaming\1000026000\8cdec30fe7.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\8cdec30fe7.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4596
      • C:\Users\Admin\AppData\Local\Temp\1000030001\c6eaddd9b1.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\c6eaddd9b1.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4440
      • C:\Users\Admin\AppData\Local\Temp\1000040001\c6eaddd9b1.exe
        "C:\Users\Admin\AppData\Local\Temp\1000040001\c6eaddd9b1.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4284
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
          4⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4452
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe138c46f8,0x7ffe138c4708,0x7ffe138c4718
            5⤵
              PID:4396
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
              5⤵
                PID:4864
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3644
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
                5⤵
                  PID:2216
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                  5⤵
                    PID:3520
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                    5⤵
                      PID:2864
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
                      5⤵
                        PID:4652
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
                        5⤵
                          PID:1344
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
                          5⤵
                            PID:1704
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
                            5⤵
                              PID:4780
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
                              5⤵
                                PID:3184
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
                                5⤵
                                  PID:820
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
                                  5⤵
                                    PID:3104
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
                                    5⤵
                                      PID:2484
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
                                      5⤵
                                        PID:2900
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                                        5⤵
                                          PID:2552
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
                                          5⤵
                                            PID:2352
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
                                            5⤵
                                              PID:4308
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                                              5⤵
                                                PID:1476
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
                                                5⤵
                                                  PID:3164
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
                                                  5⤵
                                                    PID:3900
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
                                                    5⤵
                                                      PID:2300
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
                                                      5⤵
                                                        PID:5152
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
                                                        5⤵
                                                          PID:5160
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
                                                          5⤵
                                                            PID:5192
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
                                                            5⤵
                                                              PID:5200
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
                                                              5⤵
                                                                PID:5208
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                                                                5⤵
                                                                  PID:5308
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
                                                                  5⤵
                                                                    PID:5316
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
                                                                    5⤵
                                                                      PID:5648
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
                                                                      5⤵
                                                                        PID:5828
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
                                                                        5⤵
                                                                          PID:5888
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7864 /prefetch:1
                                                                          5⤵
                                                                            PID:5996
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
                                                                            5⤵
                                                                              PID:5848
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
                                                                              5⤵
                                                                                PID:5856
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
                                                                                5⤵
                                                                                  PID:2528
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
                                                                                  5⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:6044
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1887485323152915968,4527701691639539847,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
                                                                                  5⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5448
                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                          1⤵
                                                                            PID:4904
                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                            1⤵
                                                                              PID:6072
                                                                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                              1⤵
                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                              • Checks BIOS information in registry
                                                                              • Executes dropped EXE
                                                                              • Identifies Wine through registry keys
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:3104
                                                                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                              1⤵
                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                              • Checks BIOS information in registry
                                                                              • Executes dropped EXE
                                                                              • Identifies Wine through registry keys
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5540

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                                                                              Filesize

                                                                              152B

                                                                              MD5

                                                                              f6e324fb1803f375ac0919f4b9652e43

                                                                              SHA1

                                                                              5baa8f7923521fbf900da5f0f3e303d3bfbe1519

                                                                              SHA256

                                                                              8a6f9dc704002126a5396650a86acaaae26d7295af0d7c94b4d6ffee12f74162

                                                                              SHA512

                                                                              9b46ae13fe8df585e562261bc3722c98f2cccbc3cc96da4c350902563b453cd7cbbb3a43b8f8110e9fe6df6394d1260d6adf108c28b9d13292026dda4adb3091

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                                                                              Filesize

                                                                              152B

                                                                              MD5

                                                                              d53cd5a8f2e6050521eba068f2220788

                                                                              SHA1

                                                                              d6fb770fdad2cf51191cfec9ab133832016e6fe1

                                                                              SHA256

                                                                              32950fbf8b12e47bf514c798b53b9422de71c1371b6884920d212c9f358fb598

                                                                              SHA512

                                                                              718f9cd53920b6af3a154248bb6337118d0c1d26415396af3e7247d355a75bb4f5ba6b77a1387d9e2ef84c9b0703b2323dce6dc80af7877c4340a888edca6ef9

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                                                                              Filesize

                                                                              152B

                                                                              MD5

                                                                              1ebee206945b9caa43096c1d136abaf6

                                                                              SHA1

                                                                              47bed20f02e4673e1238277ae9600800a3cbc03f

                                                                              SHA256

                                                                              ac38da21a38b29654a2e4817f59c428046ce0ee6a3b60292048aa863a7e78ab1

                                                                              SHA512

                                                                              097cc8c56598957ad1b75c7c0a6e5c9266cb6b0edca4ff6457bf3aa3fd0aa2dfa4fe6f60be2c994373e85d39132cb0ced048ffc074853852f2ddc5b60c41acfd

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

                                                                              Filesize

                                                                              20B

                                                                              MD5

                                                                              9e4e94633b73f4a7680240a0ffd6cd2c

                                                                              SHA1

                                                                              e68e02453ce22736169a56fdb59043d33668368f

                                                                              SHA256

                                                                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                                                                              SHA512

                                                                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              ab05ce270f39094583b3e96a5eda8fce

                                                                              SHA1

                                                                              269cb875fd4861ec594f3345a026435b330bbe8c

                                                                              SHA256

                                                                              c72e57722b36e3ba0a7ed39b9d744aaaa800f8ddb412c9cac278b6af7fc47ff0

                                                                              SHA512

                                                                              462b834325e3f757254c3922355c4a08e46349414391b48681f90ea5f36a4e1ae2b6059e092f9db6e14cb2ed6a70c0667c31025d5b82fe5873325bf1ec2b7c09

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                                                                              Filesize

                                                                              4KB

                                                                              MD5

                                                                              7712fe29a8b30d571b278a82443f3cb4

                                                                              SHA1

                                                                              e1081d1c5ea137453872675d81abb0d9cf47c0ce

                                                                              SHA256

                                                                              b06da4b5ce59057781971337635a25871cbbac606e85cb8fbf51e12b720b9fbe

                                                                              SHA512

                                                                              b14a535457a9108f9986bc62507a29f4ae2c2b6585a247d3d190b6ae978f256b7c5a57187018fa8a7f700bc21addd75c792e83de419e33a4c5765e9925d50b00

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                                                                              Filesize

                                                                              4KB

                                                                              MD5

                                                                              c3f7d83099c4536e5c9c2ed344996bda

                                                                              SHA1

                                                                              dd4f8042e89b3d6e05932287b00b42262a0dc39f

                                                                              SHA256

                                                                              9934bf26e08210f297d7f089b67119608c11bfb137f46f6c1cafa9e8501e5032

                                                                              SHA512

                                                                              63dd9bc9350b27c237645567cccba174b4dcfc91a287cab859e718383476e18264a94e7dd3156a8c50e9c8f305d508d10c8057e069e406b9b8b496e7d365b743

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                                                                              Filesize

                                                                              4KB

                                                                              MD5

                                                                              d39c6e940aadc8848aa757e356482cff

                                                                              SHA1

                                                                              9e35077a43d7baae557f3c1baae0df33dd1020a6

                                                                              SHA256

                                                                              51b767152ce26be2df2bc6bc58111af2255db81bf1c2e159326fd0e9e6c0b0d7

                                                                              SHA512

                                                                              cbfe8613f044f26f36b7b08191e1baaf18b2876516768940864c0bc93ebd670572cfdaa3d68a74c3935933c03adf5280c54ba5fef3acf28f4597d68ac25ab724

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe579839.TMP

                                                                              Filesize

                                                                              4KB

                                                                              MD5

                                                                              75550c24fd106f721fe3713929c23696

                                                                              SHA1

                                                                              a0b5c020035ec5f9c36277cd5d2b6943372f9241

                                                                              SHA256

                                                                              6baab38158b79507938b40728850d5d99a16f8d2e9e21293349298729fa69184

                                                                              SHA512

                                                                              42766b00b11200f143ab09cad5bcfca9806c302f22770f38105089a50e0b9a5879c739a0c9bc9e4c6409905e29bda3dc1ea68f450c3ae1252fd31a28ce49b7cf

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

                                                                              Filesize

                                                                              24KB

                                                                              MD5

                                                                              a8c803fd0f1e76ab90144f88f140bd8d

                                                                              SHA1

                                                                              c7a6d705f539e855031d6778dfb40c8d0ab04ad2

                                                                              SHA256

                                                                              5c16efb7aa2ac22c726681189c5f274b9ecd48ec163aaf67018518683fd63977

                                                                              SHA512

                                                                              e4cbdeae663dc983d7dd6cee030621dd14e9ee3645eae9864b77ec9698bf72024f21a6d9db1f9a83a72ffca6770fe3183363210cecc2dc5b1370cb225a06b42a

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57c15c.TMP

                                                                              Filesize

                                                                              24KB

                                                                              MD5

                                                                              f42191f1ac1442f61e08d6d3028accf4

                                                                              SHA1

                                                                              c2710bc9c08b412ec9b835f754e77446984e4f2c

                                                                              SHA256

                                                                              c9edb39e5ef2eedd18be77d947008de2228e39cf1b4de51459c83d26240d8a4c

                                                                              SHA512

                                                                              eda2d966b3b567c06940cfb9d3f85ba31970f2c7e8f33615a27e4376260a030ffd4393699a225b65b6278adaf735ed1036eb2864f08cf92f2a79213052b7c068

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

                                                                              Filesize

                                                                              16B

                                                                              MD5

                                                                              46295cac801e5d4857d09837238a6394

                                                                              SHA1

                                                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                              SHA256

                                                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                              SHA512

                                                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

                                                                              Filesize

                                                                              8KB

                                                                              MD5

                                                                              cf89d16bb9107c631daabf0c0ee58efb

                                                                              SHA1

                                                                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                                              SHA256

                                                                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                                              SHA512

                                                                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                              Filesize

                                                                              264KB

                                                                              MD5

                                                                              f50f89a0a91564d0b8a211f8921aa7de

                                                                              SHA1

                                                                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                              SHA256

                                                                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                              SHA512

                                                                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

                                                                              Filesize

                                                                              8KB

                                                                              MD5

                                                                              0962291d6d367570bee5454721c17e11

                                                                              SHA1

                                                                              59d10a893ef321a706a9255176761366115bedcb

                                                                              SHA256

                                                                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                                              SHA512

                                                                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

                                                                              Filesize

                                                                              8KB

                                                                              MD5

                                                                              41876349cb12d6db992f1309f22df3f0

                                                                              SHA1

                                                                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                                              SHA256

                                                                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                                              SHA512

                                                                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

                                                                              Filesize

                                                                              41B

                                                                              MD5

                                                                              5af87dfd673ba2115e2fcf5cfdb727ab

                                                                              SHA1

                                                                              d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                              SHA256

                                                                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                              SHA512

                                                                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

                                                                              Filesize

                                                                              16B

                                                                              MD5

                                                                              206702161f94c5cd39fadd03f4014d98

                                                                              SHA1

                                                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                              SHA256

                                                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                              SHA512

                                                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\c873d9ad-54ca-4c22-b88f-583a9496a28f.tmp

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              528637ce2d0bd852dada0be921115993

                                                                              SHA1

                                                                              608c48e97412773697420402515f03f168c52a1d

                                                                              SHA256

                                                                              d104796a083a27f68483d1df3d8efb643df6cfaa595d79719f139eee9e52ac23

                                                                              SHA512

                                                                              b7ea2084a40d4e400ce8d509d17e6fd4eb94ebbf349639f217788110902b8bf09d7cdd00545655b1868141c1e57dcaa84ce5b7c66fe4db3a85aa9a8e1bc43352

                                                                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                                              Filesize

                                                                              1.8MB

                                                                              MD5

                                                                              16eba1f939a7c8d10aa7a300cf48658a

                                                                              SHA1

                                                                              d291806bdd49d3016994f05834ed4100b042aa95

                                                                              SHA256

                                                                              eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e

                                                                              SHA512

                                                                              a7c69ae67d0a53eb384f35f126f12a0e92937a900e5b7ce718746eeda0cfb4061f81ba34c68ac97de3f80ff6ef4a161cd8c6e629c69b76443d18bb0c9b89051b

                                                                            • C:\Users\Admin\AppData\Local\Temp\1000040001\c6eaddd9b1.exe

                                                                              Filesize

                                                                              896KB

                                                                              MD5

                                                                              38164e376726862f321ff8405edbb017

                                                                              SHA1

                                                                              9369f0d472e9356375a90c770960283023f46746

                                                                              SHA256

                                                                              656c621b640e591916a685e4fc7f3171bd756ff85aa98872557cf6b22b09db79

                                                                              SHA512

                                                                              a2af12b16f5faa4d63c7b5b5399b03708172c998d3f83c088cb62feea1695c66aed1559f779bce1e6a223c5ea26e9c0e19690fd90cfadc03d2f8382e766fccd2

                                                                            • C:\Users\Admin\AppData\Roaming\1000026000\8cdec30fe7.exe

                                                                              Filesize

                                                                              1.7MB

                                                                              MD5

                                                                              96191b63d5798d518923727a443b583a

                                                                              SHA1

                                                                              9d4ecfcca685c739f621d55628c74823cc31ff46

                                                                              SHA256

                                                                              23413b888fbcb25c4b8fdd07b60c95402ea09d4b7d591e786c906c64690be46e

                                                                              SHA512

                                                                              e0ef6083166ea2752c10a43ef7ad3b73223124b1c38586f8032148d02f8883f40c5a111df1bcb7775d8e4b1b1994ac284b098e1f8da6ddbab82bc10712517875

                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9VHDNWDCEI0K089IHBIT.temp

                                                                              Filesize

                                                                              3KB

                                                                              MD5

                                                                              d409c8fb80bb63f42e0da83743cf5724

                                                                              SHA1

                                                                              b66221302b5fd46e8a0a10b80de1f8dcbf2e49fc

                                                                              SHA256

                                                                              d86ccadc5d2f3023abc9fac785bdcc570135fb6e55baff5a36f167bbafe6320a

                                                                              SHA512

                                                                              33800b48df27502cfa291ac05056ca9217e4cfe62bd8d9563da1ac8221973072a47eec97e6d77882d45cc67e303d17d4bf841bca3f054d4c52e10214b6c1cbbe

                                                                            • \??\pipe\LOCAL\crashpad_4452_XPVEWMBVWIJMSMTE

                                                                              MD5

                                                                              d41d8cd98f00b204e9800998ecf8427e

                                                                              SHA1

                                                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                              SHA256

                                                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                              SHA512

                                                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                            • memory/2052-350-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-297-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-58-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-412-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-414-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-393-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-129-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-211-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-236-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-383-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-370-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-272-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-21-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-19-0x0000000000D71000-0x0000000000D9F000-memory.dmp

                                                                              Filesize

                                                                              184KB

                                                                            • memory/2052-20-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-413-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-18-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-425-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-422-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-369-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-419-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/2052-415-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3104-372-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/3104-373-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/4440-60-0x0000000000190000-0x0000000000809000-memory.dmp

                                                                              Filesize

                                                                              6.5MB

                                                                            • memory/4440-55-0x0000000000190000-0x0000000000809000-memory.dmp

                                                                              Filesize

                                                                              6.5MB

                                                                            • memory/4596-36-0x00000000002E0000-0x0000000000959000-memory.dmp

                                                                              Filesize

                                                                              6.5MB

                                                                            • memory/4596-46-0x00000000002E1000-0x00000000002F5000-memory.dmp

                                                                              Filesize

                                                                              80KB

                                                                            • memory/4596-47-0x00000000002E0000-0x0000000000959000-memory.dmp

                                                                              Filesize

                                                                              6.5MB

                                                                            • memory/4596-57-0x00000000002E0000-0x0000000000959000-memory.dmp

                                                                              Filesize

                                                                              6.5MB

                                                                            • memory/4864-3-0x00000000005F0000-0x0000000000AB2000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/4864-1-0x0000000077654000-0x0000000077656000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/4864-2-0x00000000005F1000-0x000000000061F000-memory.dmp

                                                                              Filesize

                                                                              184KB

                                                                            • memory/4864-0-0x00000000005F0000-0x0000000000AB2000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/4864-4-0x00000000005F0000-0x0000000000AB2000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/4864-17-0x00000000005F0000-0x0000000000AB2000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/5540-417-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB

                                                                            • memory/5540-418-0x0000000000D70000-0x0000000001232000-memory.dmp

                                                                              Filesize

                                                                              4.8MB