Malware Analysis Report

2024-10-18 23:43

Sample ID 240901-qy2bnssbpk
Target file.exe
SHA256 d7e8125c7026f1a9e05ecd076203aef923870b2a222945cdf13b9a9165928748
Tags
amadey stealc 0657d1 leva discovery evasion stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d7e8125c7026f1a9e05ecd076203aef923870b2a222945cdf13b9a9165928748

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

amadey stealc 0657d1 leva discovery evasion stealer trojan

Amadey

Stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Identifies Wine through registry keys

Checks computer location settings

Executes dropped EXE

Checks BIOS information in registry

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Drops file in Windows directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-01 13:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-01 13:40

Reported

2024-09-01 13:43

Platform

win7-20240708-en

Max time kernel

149s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1484 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 1484 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 1484 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 1484 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 2768 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe
PID 2768 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe
PID 2768 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe
PID 2768 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe
PID 2768 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe
PID 2768 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe
PID 2768 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe
PID 2768 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe
PID 2768 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe
PID 2768 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe
PID 2768 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe
PID 2768 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe

"C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe"

C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe

"C:\Users\Admin\AppData\Roaming\1000052000\2183fa58f0.exe"

C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe

"C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe"

Network

Country Destination Domain Proto
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.100:80 185.215.113.100 tcp
RU 185.215.113.100:80 185.215.113.100 tcp

Files

memory/1484-0-0x00000000010F0000-0x00000000015BF000-memory.dmp

memory/1484-1-0x0000000077380000-0x0000000077382000-memory.dmp

memory/1484-2-0x00000000010F1000-0x000000000111F000-memory.dmp

memory/1484-3-0x00000000010F0000-0x00000000015BF000-memory.dmp

memory/1484-4-0x00000000010F0000-0x00000000015BF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

MD5 87c548fab3b4bf1b9fdaa21e4cc18f27
SHA1 cfa7c8c564668ef2827efd4d890f1ff19a8f0c78
SHA256 d7e8125c7026f1a9e05ecd076203aef923870b2a222945cdf13b9a9165928748
SHA512 764b3e7db14e07bcdad352e0d141f315f9370828475a5809f8e1df8e887c5168c2bdfea7988a50fcdab1916f8fb11814f65f8088f68c721d14589f6d0afde8a9

memory/2768-17-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/1484-15-0x0000000006EA0000-0x000000000736F000-memory.dmp

memory/1484-14-0x00000000010F0000-0x00000000015BF000-memory.dmp

memory/2768-18-0x0000000000021000-0x000000000004F000-memory.dmp

memory/2768-19-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-21-0x0000000000020000-0x00000000004EF000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000051000\a260c77832.exe

MD5 c318d3326ce1921ff20be775cbc99782
SHA1 94bb85d34e0fccf26fd58cfadfabe90606ec00f4
SHA256 3ab3541c8960a2f4ccc60e0e8efc339d0f99d9cb96b0ea46a5e0440b020347d9
SHA512 35556fabf9cd5c229fb2975a9075dd25b1ff913d152689a5e955b6214691779b6e8f58d53750bd9abb1ffddedc5b238a6284628c1b3a2286f59ef727aade7919

memory/2768-38-0x0000000006AC0000-0x0000000007136000-memory.dmp

memory/700-40-0x0000000000BC0000-0x0000000001236000-memory.dmp

memory/2768-39-0x0000000006AC0000-0x0000000007136000-memory.dmp

memory/2768-61-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-58-0x0000000006AC0000-0x0000000007136000-memory.dmp

memory/2768-57-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-60-0x0000000006AC0000-0x0000000007136000-memory.dmp

memory/2012-59-0x00000000011A0000-0x0000000001816000-memory.dmp

memory/700-63-0x0000000000BC0000-0x0000000001236000-memory.dmp

memory/2012-65-0x00000000011A0000-0x0000000001816000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000053001\2183fa58f0.exe

MD5 815d0325b08029dc535dc4c7c9daeaf7
SHA1 5f0d5f6624954c274bbce5edd211b28696897400
SHA256 80c206cdeb203530a85f6700016155be6e1380d913c589bad66ca7a7ff209b4f
SHA512 cb754b8f9d907be570ed3a5d218184970872c015b88e8ba78ae5425198fcf8ea6e8d01a4ecfbd8b3dbc1ac3eccfcc692297579cb5c9b67a560059038f62c8d0f

memory/2768-80-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-81-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-82-0x0000000006AC0000-0x0000000007136000-memory.dmp

memory/2768-83-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-84-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-85-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-86-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-87-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-88-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-89-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-90-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-91-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-92-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-93-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-94-0x0000000000020000-0x00000000004EF000-memory.dmp

memory/2768-95-0x0000000000020000-0x00000000004EF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-01 13:40

Reported

2024-09-01 13:43

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorti.job C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4072 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 4072 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 4072 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
PID 3220 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe
PID 3220 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe
PID 3220 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe
PID 3220 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe
PID 3220 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe
PID 3220 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe
PID 3220 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe
PID 3220 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe
PID 3220 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe
PID 2036 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2036 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 4832 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 4832 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1928 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 3740 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 3740 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4824 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe

"C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe"

C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe

"C:\Users\Admin\AppData\Roaming\1000052000\7a40f37c60.exe"

C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe

"C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cff146f8,0x7ff9cff14708,0x7ff9cff14718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6732 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6732 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1392,2098700358072712995,186708845583242866,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6160 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 19.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
RU 185.215.113.100:80 185.215.113.100 tcp
US 8.8.8.8:53 100.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 108.177.127.84:443 accounts.google.com tcp
NL 108.177.127.84:443 accounts.google.com udp
US 8.8.8.8:53 30.242.123.52.in-addr.arpa udp
US 8.8.8.8:53 84.127.177.108.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
GB 172.217.16.238:443 play.google.com tcp
GB 172.217.16.238:443 play.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.179.228:443 www.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 228.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
RU 185.215.113.100:80 185.215.113.100 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
NL 108.177.127.84:443 accounts.google.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

memory/4072-0-0x00000000001A0000-0x000000000066F000-memory.dmp

memory/4072-1-0x0000000077484000-0x0000000077486000-memory.dmp

memory/4072-2-0x00000000001A1000-0x00000000001CF000-memory.dmp

memory/4072-3-0x00000000001A0000-0x000000000066F000-memory.dmp

memory/4072-4-0x00000000001A0000-0x000000000066F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

MD5 87c548fab3b4bf1b9fdaa21e4cc18f27
SHA1 cfa7c8c564668ef2827efd4d890f1ff19a8f0c78
SHA256 d7e8125c7026f1a9e05ecd076203aef923870b2a222945cdf13b9a9165928748
SHA512 764b3e7db14e07bcdad352e0d141f315f9370828475a5809f8e1df8e887c5168c2bdfea7988a50fcdab1916f8fb11814f65f8088f68c721d14589f6d0afde8a9

memory/3220-17-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/4072-16-0x00000000001A0000-0x000000000066F000-memory.dmp

memory/3220-19-0x00000000007A1000-0x00000000007CF000-memory.dmp

memory/3220-20-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3220-21-0x00000000007A0000-0x0000000000C6F000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000051000\f6f86602ba.exe

MD5 c318d3326ce1921ff20be775cbc99782
SHA1 94bb85d34e0fccf26fd58cfadfabe90606ec00f4
SHA256 3ab3541c8960a2f4ccc60e0e8efc339d0f99d9cb96b0ea46a5e0440b020347d9
SHA512 35556fabf9cd5c229fb2975a9075dd25b1ff913d152689a5e955b6214691779b6e8f58d53750bd9abb1ffddedc5b238a6284628c1b3a2286f59ef727aade7919

memory/4436-37-0x0000000000130000-0x00000000007A6000-memory.dmp

memory/3220-53-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3984-54-0x00000000002E0000-0x0000000000956000-memory.dmp

memory/4436-55-0x0000000000130000-0x00000000007A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000053001\a0df713e0d.exe

MD5 815d0325b08029dc535dc4c7c9daeaf7
SHA1 5f0d5f6624954c274bbce5edd211b28696897400
SHA256 80c206cdeb203530a85f6700016155be6e1380d913c589bad66ca7a7ff209b4f
SHA512 cb754b8f9d907be570ed3a5d218184970872c015b88e8ba78ae5425198fcf8ea6e8d01a4ecfbd8b3dbc1ac3eccfcc692297579cb5c9b67a560059038f62c8d0f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 cc1206eec767267902cea5581c96ab81
SHA1 7dbfc29d40f6f0dcb678a80993be52e264f3c6a4
SHA256 21089dfd9875ce29aa85f9af3d0b04d8de90f23b3a70dd51188ccd24b2b0f40a
SHA512 74b06002c3829ff049008af6733a385e8ccab4bc30247768ed7f692228b97a4db85053965b0736eb7b59477457fd43bf2b905aa3c45186fcf9870276b1d3f383

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 2801a46fe50e7837c2fd4393fe563a8a
SHA1 3d1bb542da970206dbe2e972333ff1b76a0f7497
SHA256 a9813825ac87701d9aa86507dae2bb09821d83da4011aebeabfade681efd5734
SHA512 02220d91ee2ba898762a22db64980dfa4a70d326c949521e6cb73ecd51aa5757f8f4e3927b87aaf11fadd0ef6d2b9eed87587f46f6cd3b36681b8ae53ed3517f

memory/3220-86-0x00000000007A0000-0x0000000000C6F000-memory.dmp

\??\pipe\LOCAL\crashpad_4824_HCMREROATNNRLVSH

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 b0d38f3a702f0dd5bab08675bb7000f9
SHA1 d6791538216b0e53b2a01f4e412aae5bf225f42c
SHA256 9c1c0cbebfe12305c37c05cb953ae290c3de3a81446160c6404a0567f9fe742c
SHA512 ebcbfb5ba092484cfde53d456cf2b6ab144a7b5553b271af379956f6eb7ed720e4122f3cf0b100671c2f37db4ca715109dce2918cd8c63ee160d51b96e91fe1d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\96c26794-613f-4a33-a6da-73c95c9e5ffa.tmp

MD5 120e89e3f4aa1c006c2d4f9214f6f771
SHA1 af241e85b8ff5552285ae529fc76d2955e420d9c
SHA256 cb05a5fd61260fd8bb7ea0535030725c1b9e305e76c645a76bee5cf276ff031a
SHA512 ea3221e989751f21a9a604f7a701992ac36fa00050f8daaf181e49ad49c4ec1e02bc86bc964559a49d6dba83d3271944fcf3a6b511ef0d6af9647aaba018ec4f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

MD5 576283d354dec55e1aa8c25e840285f6
SHA1 ab60ceda37551ae14720b86dce6c1c40caa322aa
SHA256 4fdfb81bdc21912527eb33e7774e2d3d002a9174164873ba77384ad5939c8266
SHA512 35908331457e2d4d569d21911a100cc402371da2abfe3d66946d6b87d8d9ee49b5da888f7218b6c26b5ef6ee85b138c20037c81e74ea831e6efa820e567ff6b7

memory/3220-226-0x00000000007A0000-0x0000000000C6F000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MT6ZR8BG14T4ZXS2MPVP.temp

MD5 8b2dcea9f9fa12a983e1551f2b6b0908
SHA1 95b2d810f687bd79ba5f51ec624874d2ab046360
SHA256 4f28a073120a7c5b8336f433de0aabec9160b8d99bd26bf81ed00b42466c5e46
SHA512 19b03dea5956b6e991bf4ab9f12c9eb1b5314dbef30ec1665e991971fb37796c67ddbe5ff4cbef134e33e9d130381b333aa243f452937bd321e55036aacaed8a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/3220-252-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3984-264-0x00000000002E0000-0x0000000000956000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 2f1d2d101c3e9754b6e24248005f241c
SHA1 d21692eee10ee62d709beb91c944e3b316103440
SHA256 f75d88694719190055d1584f7977f75dac4252e337a5f361c8e2f982ba108e8d
SHA512 349ab3bd5c408e8fb6cb72bbccb30f1cd935913aa8e4b0ffd3eef1c87669fccfb673dfce7c025a81ca6e6bbe66e0f41335f7a78fbe1b8e6891ffdb6d8efb74fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

MD5 1fbd19577537ab00a09fc359c4ec6c9f
SHA1 fbe7b1fa961309af21f9822d874c629e64ed822b
SHA256 07a2cab166f631f41274f0f9bdd9f2a429ed3ab864b24c54a287ebcf5b67ae6c
SHA512 888480f63cc759a059228eb2f3666d899dc5b3eed614135a9226a888cf8cf7db8ace4bebe85d371d63fc1ea8ee9d28ab3c787ebcd35aa378f106e05e080fddad

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe580c9d.TMP

MD5 43d21344a153c57ab58966deff61fb4b
SHA1 852babf193cbd34b2d29c7544f2f27eecb6d9890
SHA256 ad62f9c8d4db4395695c91f4b67cc8f4ae4d8f144ca94559f669a3057136a332
SHA512 3bd4a1e49ca58deb8b6496921c17bc42b4da4c5d7eda3ea7f0f76f78bff7b779163bc0a6007037641e9af04a1e8cded555d84b7928e68e000695f57df7e18803

memory/3220-289-0x00000000007A0000-0x0000000000C6F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

memory/3220-342-0x00000000007A0000-0x0000000000C6F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\cb00afa0-99e5-4100-9e89-df200b1dcd7e.tmp

MD5 b16b3ac88ed41eaf9752219f54a16139
SHA1 1c12481cf677732566af013649289588563ced97
SHA256 001b2f23c11356d0d74d58c575afd3d07e713d43e14b5a4ef1b5ccf5d5b91873
SHA512 7443bdf544a0e0eff3f0181c62f588d0546407a1319134929f62022cdbc18da079eb582ef0b51c36f09ea1094d3982f5c89a0cdd1fef59d9840d043d2a400caa

memory/3220-361-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3220-362-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/1416-364-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/1416-365-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3220-375-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3220-385-0x00000000007A0000-0x0000000000C6F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 535e771d2eab3b62df474b68143dc1e6
SHA1 a8582dc3608a0534bd52cb382cfc0c994ad0e4df
SHA256 5e7832e1350289c50a921ad5c3f4024b70569492bf235b416a69fb31a2fe7ecd
SHA512 119aea358518ba36621453e3a92e5b1713b986378578fd943adf4f5e497929ad53b6e1cd30c8c563d1c121826abbed73c9e52eb17644e008a874d7cf1327e490

memory/3220-404-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3220-405-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3220-406-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3220-407-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/5492-409-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3220-410-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3220-413-0x00000000007A0000-0x0000000000C6F000-memory.dmp

memory/3220-416-0x00000000007A0000-0x0000000000C6F000-memory.dmp