amadey | 984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
Size 1.8MB
Sample240901-bzhhmaxfld
SHA256 984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032
MD5 98ba9c78dec3f0c8100bf1ed10395d72
SHA1 6a72b2701f52a50301a51ffea7a5815261918ed1
SHA512 2c04fe6f2daaeee238364e28436445a8abc0a360d08fb048c53d51e04769e59168c7a167885c53e655760790c81f696f8df167c861a21d3f6dd2a7bf21b5fbe5
SSDEEP 49152:sy1O7CA3/NWW/p/nVMoxmMlyY9LciHYfY9Zdy:ICA3oiqWfyY9w58u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4b017daea4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	90f5538d17.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4b017daea4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	90f5538d17.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4b017daea4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	90f5538d17.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Executes dropped EXE 7 IoCs

pid	Process
3948	explorti.exe
4152	4b017daea4.exe
4908	explorti.exe
3760	90f5538d17.exe
4460	40b7f27157.exe
1608	explorti.exe
944	explorti.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	4b017daea4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	90f5538d17.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	explorti.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aab6-68.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
3308	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
3948	explorti.exe
4152	4b017daea4.exe
4908	explorti.exe
3760	90f5538d17.exe
1608	explorti.exe
944	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b017daea4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90f5538d17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40b7f27157.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
3308	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
3308	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
3948	explorti.exe
3948	explorti.exe
4152	4b017daea4.exe
4152	4b017daea4.exe
4908	explorti.exe
4908	explorti.exe
3760	90f5538d17.exe
3760	90f5538d17.exe
4708	msedge.exe
4708	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3496	msedge.exe
3496	msedge.exe
2024	identity_helper.exe
2024	identity_helper.exe
1608	explorti.exe
1608	explorti.exe
944	explorti.exe
944	explorti.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4460	40b7f27157.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3308	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
3744	msedge.exe
3744	msedge.exe
4460	40b7f27157.exe
3744	msedge.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe
4460	40b7f27157.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3948	3308	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe	82
PID 3308 wrote to memory of 3948	3308	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe	82
PID 3308 wrote to memory of 3948	3308	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe	82
PID 3948 wrote to memory of 4152	3948	explorti.exe	83
PID 3948 wrote to memory of 4152	3948	explorti.exe	83
PID 3948 wrote to memory of 4152	3948	explorti.exe	83
PID 3948 wrote to memory of 3760	3948	explorti.exe	85
PID 3948 wrote to memory of 3760	3948	explorti.exe	85
PID 3948 wrote to memory of 3760	3948	explorti.exe	85
PID 3948 wrote to memory of 4460	3948	explorti.exe	86
PID 3948 wrote to memory of 4460	3948	explorti.exe	86
PID 3948 wrote to memory of 4460	3948	explorti.exe	86
PID 4460 wrote to memory of 3744	4460	40b7f27157.exe	87
PID 4460 wrote to memory of 3744	4460	40b7f27157.exe	87
PID 3744 wrote to memory of 3504	3744	msedge.exe	88
PID 3744 wrote to memory of 3504	3744	msedge.exe	88
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 1064	3744	msedge.exe	89
PID 3744 wrote to memory of 4708	3744	msedge.exe	90
PID 3744 wrote to memory of 4708	3744	msedge.exe	90
PID 3744 wrote to memory of 2704	3744	msedge.exe	92
PID 3744 wrote to memory of 2704	3744	msedge.exe	92
PID 3744 wrote to memory of 2704	3744	msedge.exe	92
PID 3744 wrote to memory of 2704	3744	msedge.exe	92
PID 3744 wrote to memory of 2704	3744	msedge.exe	92
PID 3744 wrote to memory of 2704	3744	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe
"C:\Users\Admin\AppData\Local\Temp\984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Users\Admin\AppData\Roaming\1000051000\4b017daea4.exe
    "C:\Users\Admin\AppData\Roaming\1000051000\4b017daea4.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4152
- - C:\Users\Admin\AppData\Roaming\1000052000\90f5538d17.exe
    "C:\Users\Admin\AppData\Roaming\1000052000\90f5538d17.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3760
- - C:\Users\Admin\AppData\Local\Temp\1000053001\40b7f27157.exe
    "C:\Users\Admin\AppData\Local\Temp\1000053001\40b7f27157.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed62d3cb8,0x7ffed62d3cc8,0x7ffed62d3cd8
        5⤵
        
        PID:3504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
        5⤵
        
        PID:1064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
        5⤵
        
        PID:2704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:1
        5⤵
        
        PID:1368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
        5⤵
        
        PID:4752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
        5⤵
        
        PID:3916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
        5⤵
        
        PID:3344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
        5⤵
        
        PID:2148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
        5⤵
        
        PID:4948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
        5⤵
        
        PID:3984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
        5⤵
        
        PID:4032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7272 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6960 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,91371904873418639,525200475400880051,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4632 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4516

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1608

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 d42a8dd6605056b365204662c010a4e45b1dd327a86c8eeb5f79a9fc523724f6
MD5 f3059aa45c58b8f60afc31a3c7791af9
SHA1 62508cec1693bc2a703261b14ecc6489c5e42d41
SHA512 d87390e380f7754e9d581d525be883fcd3903db92229688c0093d26f769e1148e3ca9e45d6a4230241e068f713dd25c461460c48fab2aed650e039f20e47f26c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 687529890c26e8e3ca9eee1582a1882c33c898653101ba8927964b64cd975668
MD5 ec6c915b937f14a1d102766f6e1d2262
SHA1 685c926b32b3dd820e484c7444a29215547d73d8
SHA512 d249a0cfd25595f01246b088627a7b3b1e15faca1bb18bbbb3fd95d71708ff39d5128f05dd3bddd6f01666af1dde98ab2cf8d13dce9881804947a8d26badb245
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 55c9cde0634b8ff672183af4f55cf28379099793d75f6cc6324c981fc939101f
MD5 9f0c60abebbbcd06e7833d772d069646
SHA1 17355735c0e77c71aa618c88e4a4fcf70ecae83d
SHA512 863de43a357d62c7f078a56c18555b7f7dceb9a7d2f292e1b0eb79d41b715ab38db58ee8ac5eef3781cf94acb5bea6600badf5898ac39b69f7f489ad350ff1a1
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 dc76b77e80e0417f4130a3da9f4381b9556e94e1b856f5f4e1e47e88492ddd0f
MD5 0d77c83362bf7b6f90acc73f160e9254
SHA1 28e24fa0846f2f2bff21b2297aa02babb4a5f4b3
SHA512 dd87f62099acaf18985f1b292a77cf844c8081a96bd235f1c84f05b6f7cbb2e6a407bc1590c4609f4dc398676782e7d21b0d48321ff30ecf5670a3a01e10d4d1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 eae6d88172f73b6b1940b108c732834c83b50ffe2faa220241b01c84997003cf
MD5 44d77a361a621b52cf5d46da602c245b
SHA1 4432ee265ce73dc2400030d61811fbafa370c494
SHA512 fd6aa0be3916946de4097f611e501f6ca2b6d49a77c383eb10e19735e996c6e7a99d8315a69728ae158de5444919d7b218d1e58cb014baefb7f94798dc56164a
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 fb72789117a548a5ac638eb8c2cbf78c9ff47aa9f163143b2a2186630279a4c6
MD5 afb0106cdbfd24df14a43055c063bf14
SHA1 e42e1211f8abf85f23de557ebcc557f7fadf6e1d
SHA512 b6f1b4eec1575dd5df60fee25b86be766443a5465c319e3e4ebe4421a7bf89de58d4cbf765a31c6ba7ac117c13456761c9b94ee3282b25ed9cd47714855157b9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 0002f3e14697a4ac0317b0321fafc9d150cf43af27cd656f04bd567263ffb76b
MD5 1b8a3db376242ea321b19e44aa92e020
SHA1 939c83f288eaae7d256ac5ff48fd4150776ca854
SHA512 16d8372097e0b4ebce536d09d3f43c2313306af7655a36f8e32727f9f41b2ef1b8cdefeeefdb8220827385e12683a70bdffd6569ab3c805dee243a216c42f3bb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 fbc5bcfb7f3a357d915e111e0a3560df3d0317d2f10106e7554002b3701e47fb
MD5 81b0d8af5dbb93367f363b2347697a34
SHA1 b54150b0bb35ba3ab94b4eb73a93e82534206bf3
SHA512 2b0803c3c39a88939779ef839d0bd6bb5ccbf77070bc49aee7e02addabb6753dc7d2e80340c402ea5ee653f52ca86134455e2b478717319809a5af4dead35a91
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 3KB
SHA256 f277cd5611817ecbe2c27793e72d4005b26a67523c4de9bd219bf4ad97220da3
MD5 d18d3e417809bcda04b98e337d98bdcc
SHA1 cf5cbdcb69a67270288defeff730386014b1ff98
SHA512 9c646ac3d4dfce07f8a967a34861132eb2be1ac9a21a8668912777a87a90d0287c0db00a198ef36d4365f705d629f621dafc0c6f6ae340d652c10b2a72297412
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 ca26bdf8398fcf6d5d22ab8435c926d560c699ae0694fba89b418162ce87fd2f
MD5 ddf16f6645e0f629ccb8a45fb6a71b76
SHA1 a5fcbba67052fb7c9cb84d22649443b3462d8d35
SHA512 799a17a1eaedc00d2586c884cd52c86a4037dd56e888f899b1e698237880d2bea723529a44100a1203bebbbfbadc7de6f753a7030131c12c0e92c1a4c21db97c
SSDEEP 96:nIv+tbFsykMNSOI0MoiVmdvuk1jI5UBPVuAiX3wI3:nIv8RkwI0M4ukhISa93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 abd0fe95cc47cae62fdb1003b4e264e6a2730a51d64c9904f098a14e14954d2d
MD5 8b2e7435684819c6b4de3e76da87f1f9
SHA1 e226fada40c74f185ae6501ec5f22db7fa3c0bf3
SHA512 f1a17368d5a063418efdeb7cad1519a0467f593c8a888d53e56d59dd6dcf3ff685d061a471d4a7ef320523f958896357f2b28c3aa4fe16c1079709e53730d5ff
SSDEEP 96:nIv+tbFsykMNSOI0MoiVmdvuk1jIjUBPVpAiX3wI3:nIv8RkwI0M4ukhIcj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57e0fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57e0fa.TMP
Size 3KB
SHA256 9e5d980bca25dc53a2e08df30d85de8e1d7df281736921fe80652e7e7b8fd485
MD5 2a4e7b6614f6c792b93680d9d8cd549b
SHA1 4ee8c1c99da6d8be570c2ed2ce662868f5e0c584
SHA512 1b188e2266b438782d3093a5a5148318cfb2060ed84c146031dfc6493802fff06c56defa3d094c04c2fb902df053dcc3b1c58dc3224bac9fd9f66ffe11c8e365
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 26KB
SHA256 edf2b75e2254f76d31ed2b03c4b7429704f32d83eca9556ed0afab9170348af9
MD5 b96c8c3ff6479fa85ba339a5e064c511
SHA1 8d645df95930c2ef3d5dc5f05375f9c2af21f23d
SHA512 52a751b4170dd94274701dead3c59706b30f331726ad37e40b10fc2637a220501ded63119e15de5d1a5dc0918e5a6f93f2fe9963942df8b270d3dadd1c5b03fc
SSDEEP 768:nGN892FWReQ28F1+UoAYDCx9Tuqh0VfUC9xbog/OV3vLl/00q9rUpk:nGN892FWReQ2u1jaKvLpVqWpk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe580971.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe580971.TMP
Size 25KB
SHA256 6b07e2cf983ced8ea7c445f1b44a997540397866fcf245e5a30bafe8315278f9
MD5 a5b31976683c3750831b9282ab5a7311
SHA1 875b942b79c284e73faf5bcb61d55213a34ef695
SHA512 473c56c2466e67980e75b4f4d341d57c58f86818ede4bde0410e9c6ee25cdb1f941fc7cbfd141671efb1f1e90d694235b3864d26c94942dcde66d2c961269d83
SSDEEP 768:uN892FWRDQ08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3JLl/00qRrUpuP:uN892FWRDQ0u1jaKJLpVqapuP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
Size 203B
SHA256 e5908a4c32410562acebe88e3370e482c5070c2585be49dab573ca0347091b7e
MD5 2a8e88ee1a80b96556f139c30ed3e881
SHA1 94085e569c89dfb5390e2b693c43e9d66c80edd5
SHA512 ca0718c2cdb4c3c9167114d13764e41295e2dbfe69761b47a79440f8c1f5cf2f825ed8ebecae63b99222660b11f151fbdb279784eea20fb3e15c32636ac85743
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe59040d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe59040d.TMP
Size 201B
SHA256 a386c036fb51a9959f57fa1a7252ad1953c03126b0565a0333d0df041bb2161e
MD5 09663a9ffd0607f26059c2d534bf92b3
SHA1 2bfe581ba712fc40a6eee54dfc3675fe37503ec6
SHA512 e0304363569cd136080eb7a53b187f25e6fbcabab89b732e752a6ab5e3a9143887f646307998b59f6ef2282cedd83772dd001424a1e87d2881eb2c2a90bf7e0b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 9KB
SHA256 6ebb4882df752ed0c2e52958f4363c54c287d5637c76b04513fa41d84b0bb2ce
MD5 380d2a9f08151cb85f53446b57e0e3e8
SHA1 e71ca4dae2d0b927f80047aebf73463b52d9d0d7
SHA512 e6889867ed5ceb7c7ac7aca45eee8b7f44d283df4a55f954d593c951ee536a77d6e524f8f24aa2283073dbebe1b1e09ff93f5defbefc54058267cb8893415659
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASwZeMRUSKHEb5N8CLSf7mK7raJ:e9iIxuERzA83h09RZxASwdxKkb5N3Sfu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe58360f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RFe58360f.TMP
Size 9KB
SHA256 16e5100c205cf787bb230db7fe3520a4b39b499439db41f2e52b42d92d350731
MD5 0d5ab39106382c069deaaca2fef1dd09
SHA1 a8eb17e2039b531c979b4ac70e556e65570390ea
SHA512 225b7308944aea9f8f60bb519f3c46cec7f87dccfd82527190537799a2a757f0b55f4e58c7442df8ffca1dd58f93911d2c63023a6ec676be337479a21caad37a
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAXZeMRUSKH9bcN8CLSf7mK7raQ0:e9iIxuERzA83h09RZxAXdxKdbcN3Sf7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032
MD5 98ba9c78dec3f0c8100bf1ed10395d72
SHA1 6a72b2701f52a50301a51ffea7a5815261918ed1
SHA512 2c04fe6f2daaeee238364e28436445a8abc0a360d08fb048c53d51e04769e59168c7a167885c53e655760790c81f696f8df167c861a21d3f6dd2a7bf21b5fbe5
SSDEEP 49152:sy1O7CA3/NWW/p/nVMoxmMlyY9LciHYfY9Zdy:ICA3oiqWfyY9w58u
MD5 SHA1 SHA512 SSDEEP

Submit Download

40b7f27157.exe

Path C:\Users\Admin\AppData\Local\Temp\1000053001\40b7f27157.exe
Size 896KB
SHA256 e49bdc65dcdc1010f3b8984f5ba4f471b2ee71938c7395b6f56ca9d76e6718b9
MD5 dc07df13058ec69d92fadd3fb1cff581
SHA1 36e7b78e1ff3616040d0a3b8a52bf3423f3ccb38
SHA512 ab4643a114c5db9e7859a12a18f0a7d1112740b2311d62a0b4b4ddcdb4e90a2e283deec6fd80573037fe809f1fc6feef56098f659da2784c9abe2c11a2fa3c55
SSDEEP 12288:HqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTE:HqDEvCTbMWu7rQYlBQcBiT6rprG8asE
MD5 SHA1 SHA512 SSDEEP

Submit Download

4b017daea4.exe

Path C:\Users\Admin\AppData\Roaming\1000051000\4b017daea4.exe
Size 1.7MB
SHA256 2954dec8276af3d7c60154c2afb2ae360d696c6a90eb779fd9e380848c6fd8cc
MD5 4847d6885adc7ea78fdf9918c384cecb
SHA1 9eb0ce983f5a81300f18331b4899e03692fea6ef
SHA512 e9b4d83425344b7137477105ee474c114f098d6c6e41d7bdfb47fb5902e32ba5c91ae9b9a3629dbad0ce4151bbf9d880c80dbfd5002d77da9ad88e8aa67f41fe
SSDEEP 49152:EDX1MwDuFp+U5Sbi1cvMkg0X8C9d5PBXiClNM8GDb:EDXcFpcbi1idrHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk
Size 1KB
SHA256 f8120cab8b7a5e0e6c7d39c387b5f1aa3254ef19b547afdcee0bffa5abe95ef1
MD5 f6a9940637049f3c136fe38c1d8450ee
SHA1 02a4e31d7a124bd18756c53ae197083245036056
SHA512 76f8039c1bc6552c68d4cccdc09f36e1667d89cac705dc8d051dc1e96e153bfcee4b3e703503c60989a4665374c3078f29406489ed3fe62ee3efe3d1f2ad9539
MD5 SHA1 SHA512

Submit Download

memory/944-429-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/1608-374-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/1608-372-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3308-1-0x0000000077446000-0x0000000077448000-memory.dmp

Download

memory/3308-2-0x0000000000291000-0x00000000002BF000-memory.dmp

Download

memory/3308-3-0x0000000000290000-0x0000000000754000-memory.dmp

Download

memory/3308-5-0x0000000000290000-0x0000000000754000-memory.dmp

Download

memory/3308-18-0x0000000000290000-0x0000000000754000-memory.dmp

Download

memory/3308-0-0x0000000000290000-0x0000000000754000-memory.dmp

Download

memory/3760-61-0x0000000000330000-0x00000000009B5000-memory.dmp

Download

memory/3760-56-0x0000000000330000-0x00000000009B5000-memory.dmp

Download

memory/3948-55-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-16-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-63-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-21-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-20-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-359-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-360-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-370-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-322-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-204-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-386-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-19-0x0000000000711000-0x000000000073F000-memory.dmp

Download

memory/3948-433-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-432-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-414-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-62-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-249-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-424-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-425-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-426-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/3948-427-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/4152-60-0x0000000000AE0000-0x0000000001165000-memory.dmp

Download

memory/4152-36-0x0000000000AE0000-0x0000000001165000-memory.dmp

Download

memory/4908-47-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download

memory/4908-58-0x0000000000710000-0x0000000000BD4000-memory.dmp

Download