amadey | 25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
Size

1.9MB
MD5

9fce1d6aee0e20bfcccefe185bad317a
SHA1

ee4cbfff8a2829cfe8487a238f945b1411affc76
SHA256

25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae
SHA512

22c5f6e322f5b47501843b2e0e26de51aadbdbe012dfca005c73b1a003300ae1b2b0489298c8514c928bf9cd59fa146b2f944404ae619ebde231836d7acfd62f
SSDEEP

49152:zci1PCJ3UmR2HqYaHVi2yN+fcHhTTAVcikbC:zci4LGba0oEhfAmikbC

Score

10^/10

amadey stealc 0657d1 leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	eabdcd6558.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a9af4f96e8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eabdcd6558.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a9af4f96e8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eabdcd6558.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a9af4f96e8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
700	explorti.exe
2184	eabdcd6558.exe
2656	a9af4f96e8.exe
5032	beb93eda06.exe
4320	explorti.exe
1204	explorti.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine	eabdcd6558.exe
Key opened	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine	a9af4f96e8.exe
Key opened	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
Key opened	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine	explorti.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa82-66.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1508	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
700	explorti.exe
2184	eabdcd6558.exe
2656	a9af4f96e8.exe
4320	explorti.exe
1204	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eabdcd6558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9af4f96e8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beb93eda06.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1508	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
1508	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
700	explorti.exe
700	explorti.exe
2184	eabdcd6558.exe
2184	eabdcd6558.exe
2656	a9af4f96e8.exe
2656	a9af4f96e8.exe
2468	msedge.exe
2468	msedge.exe
2884	msedge.exe
2884	msedge.exe
5088	msedge.exe
5088	msedge.exe
4320	explorti.exe
4320	explorti.exe
1204	explorti.exe
1204	explorti.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5032	beb93eda06.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5032	beb93eda06.exe
5032	beb93eda06.exe
2884	msedge.exe
2884	msedge.exe
5032	beb93eda06.exe
2884	msedge.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe
5032	beb93eda06.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 700	1508	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe	82
PID 1508 wrote to memory of 700	1508	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe	82
PID 1508 wrote to memory of 700	1508	25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe	82
PID 700 wrote to memory of 2184	700	explorti.exe	83
PID 700 wrote to memory of 2184	700	explorti.exe	83
PID 700 wrote to memory of 2184	700	explorti.exe	83
PID 700 wrote to memory of 2656	700	explorti.exe	84
PID 700 wrote to memory of 2656	700	explorti.exe	84
PID 700 wrote to memory of 2656	700	explorti.exe	84
PID 700 wrote to memory of 5032	700	explorti.exe	85
PID 700 wrote to memory of 5032	700	explorti.exe	85
PID 700 wrote to memory of 5032	700	explorti.exe	85
PID 5032 wrote to memory of 2884	5032	beb93eda06.exe	86
PID 5032 wrote to memory of 2884	5032	beb93eda06.exe	86
PID 2884 wrote to memory of 2148	2884	msedge.exe	87
PID 2884 wrote to memory of 2148	2884	msedge.exe	87
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 876	2884	msedge.exe	88
PID 2884 wrote to memory of 2468	2884	msedge.exe	89
PID 2884 wrote to memory of 2468	2884	msedge.exe	89
PID 2884 wrote to memory of 3688	2884	msedge.exe	90
PID 2884 wrote to memory of 3688	2884	msedge.exe	90
PID 2884 wrote to memory of 3688	2884	msedge.exe	90
PID 2884 wrote to memory of 3688	2884	msedge.exe	90
PID 2884 wrote to memory of 3688	2884	msedge.exe	90
PID 2884 wrote to memory of 3688	2884	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe
"C:\Users\Admin\AppData\Local\Temp\25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Users\Admin\AppData\Roaming\1000051000\eabdcd6558.exe
    "C:\Users\Admin\AppData\Roaming\1000051000\eabdcd6558.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2184
- - C:\Users\Admin\AppData\Roaming\1000052000\a9af4f96e8.exe
    "C:\Users\Admin\AppData\Roaming\1000052000\a9af4f96e8.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\1000053001\beb93eda06.exe
    "C:\Users\Admin\AppData\Local\Temp\1000053001\beb93eda06.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd99023cb8,0x7ffd99023cc8,0x7ffd99023cd8
        5⤵
        
        PID:2148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
        5⤵
        
        PID:876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
        5⤵
        
        PID:3688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:4704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:4708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
        5⤵
        
        PID:1168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
        5⤵
        
        PID:32
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
        5⤵
        
        PID:684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1
        5⤵
        
        PID:4088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
        5⤵
        
        PID:3392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
        5⤵
        
        PID:568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7276 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7548 /prefetch:8
        5⤵
        
        PID:1364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7859880345766645418,11934714201344344913,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3800 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4320

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
97e8abe158543c9b3fced9b9797e152c

SHA1
600df558531918797ddd860bb80b4de9384821f0

SHA256
90c539c8eb6733c0a792142d8e4d4d3622552f13c71e2c3ebe3e6c816bbd9580

SHA512
41306772565bbbb03e0dd063b319c377dbd4c44a3ca4c9b65cf00d72844e69eb8de3ebc9fec2570e32d57b5d24d69c130e3ca2a0235d80339552a21f108c4b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
09ddf7411cb3de86ded2d970662408e1

SHA1
dff76533636e69306949dcf6db74b62258aaad3b

SHA256
5a829ca3f5b38976b2a16e63e9aaffaa67d4333e2fed539c392b2eac57f8c1c9

SHA512
4aa6bcbccb804090fa18be8957663585028a20d5f1fa43553ae78ac5c9217ec916f6801e96701c8043e03529285db9936c3340a5c029a1406227c08f4f70fa9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
64b5b8ddf622d69193e3a8d62d07b13f

SHA1
1691a18e5a51b164e404ba11c47ef01773b66301

SHA256
979dac89ea694bba650badb9456eb67b3d1601fb2164a0b633fe61b411366410

SHA512
fcc94be0e305e653354a54b9cc79f506937b330d3eb7a09a335183d78fe229269012368bc516164c02ba33da9575b5b2f3da9f57aeb12d3f39296ce6f5677522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\4aab9e11-0a27-4e20-ac45-4b38b16cb1f2.tmp

Filesize
4KB

MD5
bfc2fddf23f27c5084ae6ad895c0d0d8

SHA1
cd4277e7ab28de5f37461259403f2b7103579e89

SHA256
0d38376564521beaf908c163601e282550f29ae3d97c8a3dad901d04e37d6eaa

SHA512
a475db82e91723cb04ab4c93fdc3d95da9f7f7338d56664bf6a4428e435f227bf9dc5e25829a66bab19ab3845818f983736c2c54906c496c1b12446780ac7cda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
7384886fc8e5875126b146788a543231

SHA1
ab477746d6cff68f5402b2909bc24c0bff3076eb

SHA256
20b0db4f51bec1526fd91333b4cfce3eef71d1cda002a340776a6fc4e7077042

SHA512
6929b977aa0e12846c200a0e090e6809cc5865f4b2367c8e58963c872529b165b966e620e1668f04237f67178c1f9fae30f045e031573f1325091bcd4c224863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
fe59ac229554365474d27fa6a94d8610

SHA1
bf4720c97041b7c4e105c1eba40b404a50190823

SHA256
29dfec817235c5fdfb9096f8b4ddf6dde6b224925dff6f9a1d9aa245b4d22881

SHA512
72cf6a44ea75e5b6ea10bfe4fe86b3d98afdfb6d0364ba02a80c9ce93b8e3ef99290fb197d06ca857f9531999dad4e3799300a8265f9f7a6df82a508667a4833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
95531bb1dc9b7c20a374809b9c7af315

SHA1
c9db95143a935d601216b77af5838c2122fd859d

SHA256
f6ab90832bdfb6f479e37062fce724d9589a32144b598d8022940b04e0e37314

SHA512
0b282a83a7cbbbf70970b22401a2e048f4d314ac549cc007354f8eabe8a1dce1b83249c3ea535ccbba1a4d8eab0727d49581e8f905aec9c032982f2037548f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

Filesize
1KB

MD5
0e40bdda5fea987e8146ae29192f67f3

SHA1
cf5be7afd36e7c1ba8b2653b0ec62f3fcbcef383

SHA256
bbb31247d8aee69a1a5bbdfcde5bd6e2de5afd8704e18212f41114b6de23eeb8

SHA512
3f176f7f12d250e400c3e7d5ffd1139a7c01baa13ed98efffdaf05d52c71f2f46d1149201d914328b3e45b2b3d247a7a7b0a32c770a546be981ada5585c0987a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

Filesize
1KB

MD5
ba32fa0d6433f9a96746ee5aca55e66c

SHA1
b923cc9fb67a62aa8fe53c1111355cc7fb0de05a

SHA256
59482bf1e892fca0f491fd990288c4d6e7cbf9968ca69fde2031e2643868f218

SHA512
96452eadce8fb401c7c71659ba7846aa921e31c98798c7cb2bb32c10af3554899c4718d58b9c2b8a91cbf8f0e19403b0eda868cce1dcb33ebdc059a294260116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
3KB

MD5
27fa9da979ccd4c312b551517a9de811

SHA1
2f6cc3d2fae9c416a9173a9e885e234c6a439142

SHA256
e3dd656c2521f7d65da21c628ece4a989fcbae6eb5ff3189f5f2dba878f1b360

SHA512
b26ebc4ca3435a9cac946d962b4c8040754d7202dfe580ba26f4568e852f76249952a858c3f00592dd432ed60b4a70f32ad80849aa49bc0dfb5d4f89ac53c635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
277afe824b44bce291d4341303541885

SHA1
027cfcf88b80798a9341dd58e3654a8456340a3b

SHA256
dc27ca620132049dd5c3a405f1c344cde5c5f3a5fa91cf84e2eb4d3a043ec1e2

SHA512
070ff0f3c20e7286536501030230a5e0410e922f210b7191c5e9215cf6b2d1e70089d93fd409b6aa57f7519aab7edd749a51716f4ee6ee93a7f9bf68b3540f8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57cd04.TMP

Filesize
3KB

MD5
a89509400362414b0fbe4097a2e45c45

SHA1
b189621e2f88b7e0a7268664414ad60b00586691

SHA256
b7840f720eb779898797fe5a6f6f9d207825768e984ffa065c5bd425b834656d

SHA512
aa4024425a54a9edcc389f166534aaea7a4508043c8fc208f513b6debc56595325e2ec4c67eea674c41cc16f6313044325cc37db06318b633ab59ebcf734ca3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

Filesize
26KB

MD5
f5b5052e9e267c2efee2db4bfc7ec8f6

SHA1
09c8921e744a2c013cb48819ae9e84284f8f3970

SHA256
346c1bbc14e2f5ea9dfb21805997dcaed0de2b8e6b9fcb830d09d25ed46f1d2d

SHA512
7de9efe652f1b6299cc95ecf8c3eec4085722bfb3c61acfaf5f50daa87051e1d62bb5072c6355b346c1f801d81098924cb347c303112c7157f526f9b756fddf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57f50e.TMP

Filesize
25KB

MD5
c3c2cd763884e0d6505e143ce3ea0604

SHA1
34af2fa013df4239efb643de65ae284e8b54457f

SHA256
d12c234e11c05b2276d5c7103f16d80be2ef3d5375f5cd990d70caf23600d842

SHA512
0e6777e320d83199e31368f0f3440f22f017d91b33f069ae13c269b58ec2a19ebad579758aab0ef8eed8b719f1596466f1490e888559f86ac07ca8ac66b43245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

Filesize
203B

MD5
891f931b458c7c0718c61c2e65cf8ed7

SHA1
a9ae0af6a8aba687c0f2fb2f430aff57e8e46b90

SHA256
6b93761c567cb8cd73ee1bd102de681aa4a23c7dc18895edf6fa5b8e7bce2d06

SHA512
ad5d290f2dd54a3995d07889cb778e3b43f0b9419fca556634755c90b1973afcaff785e986eff2ceb93bdea50a460ed1169b0cbc0ec68f51d2aa7eb028d2593d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

Filesize
203B

MD5
1ca8d6fe1630265390a35c3ffa1a253a

SHA1
a9f35b90bd0fcf98b68a5d4f64163584a697c53b

SHA256
3dd790250aba9dbab3dc4a91f9314947eb7b697a75e490499a8414246e90613b

SHA512
f87ed2b41ebbf92cd4c0b08f21bbc942e643f70e905de30d0679c9299f456d5c3cc34ae99b31c00b829459f0335fd0c05b65b745347ddb795bde748509cd9505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58f008.TMP

Filesize
203B

MD5
cc2c57d78de95e358641716445f10d02

SHA1
d1d903a771ae7aa139276d4441cd16b6e50e6b55

SHA256
d0fe48131dc920d37308a4d6093ab6ba2a474f986789cd9ab003c4d0f7d55f6e

SHA512
538a7590b717b75bc14cbeb2a9671504884f2d9b419bd3c08c5e396dbcb6d6eb35bae7a7fa92d22ba3d93c5d8e1829a1d214df1c97d8f97b1f433fa8298204db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State

Filesize
9KB

MD5
622af991cb75bf0d4ad48806738796f3

SHA1
63c9998049cec9ebee8e902900abde4e84438cd1

SHA256
9c27efb3b65db9793ccfb51c5b62c10089cad46e8871a06d87b36e5de02fe93f

SHA512
79a8660101888477a1ed0e76184c19fae343f9bf4c721461f252818afdeee4a3e1ae2ba598cca921983cac56f5e658e5ad7be0e8af4cbb242c59cd983664ade0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RFe582248.TMP

Filesize
9KB

MD5
1deedde261f742f57d390fe7575d694e

SHA1
174e3b12c7dd1b72b9aabf4699e086d5baaa099f

SHA256
e6f98063f1fc2f39b2fd8aed3a101e7af4d2e0e1f0b74819b93c1193a9a152b2

SHA512
fa3a09ca8da1f8b37c7a22e1d564453812da9b674f647284388126ea1507869a57c8a6a9fac27d10e01ce7b56699d97c65d95619ba1a109767d538ace68de0a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Filesize
1.9MB

MD5
9fce1d6aee0e20bfcccefe185bad317a

SHA1
ee4cbfff8a2829cfe8487a238f945b1411affc76

SHA256
25b91c84d40e4adda4abd276f9baef0c9a77d2ebc3039040e002188e602619ae

SHA512
22c5f6e322f5b47501843b2e0e26de51aadbdbe012dfca005c73b1a003300ae1b2b0489298c8514c928bf9cd59fa146b2f944404ae619ebde231836d7acfd62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000053001\beb93eda06.exe

Filesize
896KB

MD5
e5b40dd1825d9ef7abc2f847e38d2e0b

SHA1
33ab18e0c1c5ed5b75b3060f26a9e46e3b967f12

SHA256
91d2ec139a0b560b3afaf30724c91faf940dd36579f5116e0c4de5eb8ddf9a4d

SHA512
815c9f1a1a281c049d85faddc1d2a24ae4b2a802c0fd248180d0aa8b8ec48dd8e4ef3c0cabbdd69fbd381702842d66c2bebc1eef6f685506f60685d0726b85af

Download Submit
C:\Users\Admin\AppData\Roaming\1000051000\eabdcd6558.exe

Filesize
1.7MB

MD5
b0cf5e71ca872709d9445931c2aaad6a

SHA1
9793982f71ccab73d3dcc6ae13e76e537823f1c6

SHA256
feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe

SHA512
261f63dfcb6458f923cc0a0272a4bf068c83115ee2e838c79cc3055664959abd65413d3bd216b1a47706c39d7bff45d6b1ecf02d2926a65dde2845795d8e58b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

Filesize
1KB

MD5
c0fb8f9e1b7cf5e8af0ccd9d5b13150d

SHA1
b62280e560f439d9231f474c3f30eb6befc4cf61

SHA256
e9f28e1be3aab1d6475ed87e22ebb82516573820c94634b473ba846eafbc43d9

SHA512
b605571955fc2d348e7b8b3a4cbbdecbf3c96efee2128694683ea7fe207f474b66210ccad2f0904146c098570f1b3b1b9035fcafc7be8cdb1f2e6068bd8e2a3e

Download Submit
memory/700-19-0x00000000007E1000-0x000000000080F000-memory.dmp

Filesize
184KB

Download
memory/700-372-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-220-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-21-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-46-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-423-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-288-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-20-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-168-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-18-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-56-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-430-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-422-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-427-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-348-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-358-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-359-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-412-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-424-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-449-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/700-384-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/1204-426-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/1508-5-0x0000000000190000-0x000000000065F000-memory.dmp

Filesize
4.8MB

Download
memory/1508-3-0x0000000000190000-0x000000000065F000-memory.dmp

Filesize
4.8MB

Download
memory/1508-2-0x0000000000191000-0x00000000001BF000-memory.dmp

Filesize
184KB

Download
memory/1508-1-0x0000000077CA6000-0x0000000077CA8000-memory.dmp

Filesize
8KB

Download
memory/1508-0-0x0000000000190000-0x000000000065F000-memory.dmp

Filesize
4.8MB

Download
memory/1508-17-0x0000000000190000-0x000000000065F000-memory.dmp

Filesize
4.8MB

Download
memory/2184-59-0x00000000009A0000-0x000000000101D000-memory.dmp

Filesize
6.5MB

Download
memory/2184-47-0x00000000009A1000-0x00000000009B5000-memory.dmp

Filesize
80KB

Download
memory/2184-48-0x00000000009A0000-0x000000000101D000-memory.dmp

Filesize
6.5MB

Download
memory/2184-37-0x00000000009A0000-0x000000000101D000-memory.dmp

Filesize
6.5MB

Download
memory/2656-60-0x0000000000F50000-0x00000000015CD000-memory.dmp

Filesize
6.5MB

Download
memory/2656-57-0x0000000000F50000-0x00000000015CD000-memory.dmp

Filesize
6.5MB

Download
memory/4320-362-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download
memory/4320-361-0x00000000007E0000-0x0000000000CAF000-memory.dmp

Filesize
4.8MB

Download