amadey | fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Size 1.8MB
Sample240901-vrpfraxdqa
SHA256 fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6
MD5 1e1be607275af8bc71fab2203e02efd5
SHA1 39959642e9e919c88ac7bb870b9c9484a298aa1e
SHA512 1ed45303c6592268f1629dd9f086234bfe5543e488fbed0023859c892633db8d355f45809aaaef659bf4746761e4132a8c47fbce6ee648979cdab3d019297bab
SSDEEP 49152:lp2ivE7Z+VA1Nc4Xppga2vwjRf1CwgnNlm4:lsiGQcS4yvoJg6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c33625ae9f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0f46b9bf8e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0f46b9bf8e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0f46b9bf8e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c33625ae9f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c33625ae9f.exe

Executes dropped EXE 7 IoCs

pid	Process
2356	explorti.exe
1476	c33625ae9f.exe
872	0f46b9bf8e.exe
1972	3279f06212.exe
5036	explorti.exe
4280	explorti.exe
1436	explorti.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Wine	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Key opened	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Wine	c33625ae9f.exe
Key opened	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Wine	0f46b9bf8e.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000025c87-66.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
4936	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
2356	explorti.exe
1476	c33625ae9f.exe
872	0f46b9bf8e.exe
5036	explorti.exe
4280	explorti.exe
1436	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c33625ae9f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f46b9bf8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3279f06212.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4936	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
4936	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
2356	explorti.exe
2356	explorti.exe
1476	c33625ae9f.exe
1476	c33625ae9f.exe
872	0f46b9bf8e.exe
872	0f46b9bf8e.exe
224	msedge.exe
224	msedge.exe
3128	msedge.exe
3128	msedge.exe
2964	identity_helper.exe
2964	identity_helper.exe
1996	msedge.exe
1996	msedge.exe
5036	explorti.exe
5036	explorti.exe
4280	explorti.exe
4280	explorti.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
492	msedge.exe
1436	explorti.exe
1436	explorti.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	3279f06212.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4936	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
1972	3279f06212.exe
1972	3279f06212.exe
3128	msedge.exe
3128	msedge.exe
1972	3279f06212.exe
3128	msedge.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe
1972	3279f06212.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2356	4936	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe	82
PID 4936 wrote to memory of 2356	4936	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe	82
PID 4936 wrote to memory of 2356	4936	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe	82
PID 2356 wrote to memory of 1476	2356	explorti.exe	84
PID 2356 wrote to memory of 1476	2356	explorti.exe	84
PID 2356 wrote to memory of 1476	2356	explorti.exe	84
PID 2356 wrote to memory of 872	2356	explorti.exe	85
PID 2356 wrote to memory of 872	2356	explorti.exe	85
PID 2356 wrote to memory of 872	2356	explorti.exe	85
PID 2356 wrote to memory of 1972	2356	explorti.exe	86
PID 2356 wrote to memory of 1972	2356	explorti.exe	86
PID 2356 wrote to memory of 1972	2356	explorti.exe	86
PID 1972 wrote to memory of 3128	1972	3279f06212.exe	87
PID 1972 wrote to memory of 3128	1972	3279f06212.exe	87
PID 3128 wrote to memory of 1416	3128	msedge.exe	88
PID 3128 wrote to memory of 1416	3128	msedge.exe	88
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 1704	3128	msedge.exe	89
PID 3128 wrote to memory of 224	3128	msedge.exe	90
PID 3128 wrote to memory of 224	3128	msedge.exe	90
PID 3128 wrote to memory of 4760	3128	msedge.exe	91
PID 3128 wrote to memory of 4760	3128	msedge.exe	91
PID 3128 wrote to memory of 4760	3128	msedge.exe	91
PID 3128 wrote to memory of 4760	3128	msedge.exe	91
PID 3128 wrote to memory of 4760	3128	msedge.exe	91
PID 3128 wrote to memory of 4760	3128	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
"C:\Users\Admin\AppData\Local\Temp\fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Roaming\1000051000\c33625ae9f.exe
    "C:\Users\Admin\AppData\Roaming\1000051000\c33625ae9f.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1476
- - C:\Users\Admin\AppData\Roaming\1000052000\0f46b9bf8e.exe
    "C:\Users\Admin\AppData\Roaming\1000052000\0f46b9bf8e.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\1000053001\3279f06212.exe
    "C:\Users\Admin\AppData\Local\Temp\1000053001\3279f06212.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd48de3cb8,0x7ffd48de3cc8,0x7ffd48de3cd8
        5⤵
        
        PID:1416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
        5⤵
        
        PID:1704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
        5⤵
        
        PID:4760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
        5⤵
        
        PID:1560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
        5⤵
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
        5⤵
        
        PID:3020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
        5⤵
        
        PID:4480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
        5⤵
        
        PID:2936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
        5⤵
        
        PID:2968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
        5⤵
        
        PID:1192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
        5⤵
        
        PID:4364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7592 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7152 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,15025857702172962401,12221103870630636192,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1676 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5036

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4280

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

856d678d-f983-43af-b5c2-9b778deda531.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\856d678d-f983-43af-b5c2-9b778deda531.tmp
Size 9KB
SHA256 2668dce1dbe7c88b400462aa47ad41b5b1f6a7b3b1a877f2e1953726a120f8f0
MD5 e3f28cd8bddaf449695b7cb6d74c863f
SHA1 370660432d6dd1918f1fba66c0cf42be8db1ac0b
SHA512 b27cd51254161344e765977010d5048387a9b7455cfce0c2b0dfa5c66e91e5dfd5cfc130ba991cb5a4c983102dc4f90c7b96cd968c403ebd180744cb42d3d7fb
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAS37eMRUHfRnN8CLSf7mK7raQjR:e9iIxuERzA83h09RZxAS3PM5nN3Sf7mO
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 6e969dcbc56ca67966c8a72377ff0757be12a1a43aa5d003b8f229cedbe44d4d
MD5 df958e17ab29d0cc222566917457a023
SHA1 cf915caef007b4893b51a2ad0c3a7a80cd89498c
SHA512 861168ec264b007b832875151f065212515461c203ea5ee1b7c4d6d2debea55e54b3e217380f795ba20da14ac57bf73d2cf44b7c646fb1132f65293ca5cba67e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 e09946a50d3f8d6b73b45b1b43ae6eff06f7e39998b498bbb34c8d2f4cba50f3
MD5 35ff5c7e24741ad0aaddb6289fa699e2
SHA1 8cba97b561baf72087e2f3ee3c4d27c487ec3ae6
SHA512 2bc4953b46c2288c7a49fa5d6ac3e2a747e68e42d3ecae7a21987249a9f06fdcc451ad8e29da8aeef72eb7497854520f50ec862078497abc826bcd9345a7c39d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 a5f4b5227add74c3729b2c51ce02a56926df02c14bda9cf50e1be6e4f27ffab1
MD5 9fc24665ce3ed409ff3f6a2436542858
SHA1 2a4797722a1f43e8ebf5618ed0d32f8c2fe4f460
SHA512 7e8b3b9bda95c3caf813099ed179d5420fb51dc094ee95db229e878c0a5298718046adcb1eeee94df20388690fd0a28935ae6165cdab4c1396bfa77259dfac86
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 5214fa6f8dba52d20e063055787afc4f25a0428f22f4da54201af63b84c81581
MD5 1aee5fd668f1e1b39718fe872af59aa1
SHA1 b5cfda035d5a18d13189276da897c237d8f03f55
SHA512 2733b9e00ca06a699173d1da8539f7a74cc7fe0d6ac2442677a8b93f6ccdada6946bee35448a5e9cbaeab0fa57c61a4eb93cd9a604c6c8914b543568cd7bf0ea
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 b6f587b813f14760e1b7f01be707dac476003b1ba5de1e7e49ee872483620ed9
MD5 d8190de4a0933519f2d006682d896dd1
SHA1 e8b4a8f9f4fecc4729f24ebffab172dff4e8a0d1
SHA512 ac5e1a60b1302acbb0ea56f8ad435ddb3a16f5b8516fe0f049d27a62dbf4c0bc23d2bb76b42647ad2a7d5c43ae35ba2a8d26c51be59204cf0e338c628a366412
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 82051d939153decfa335a0412815e4898ad144ef7052738a5eaa9ecfe921558c
MD5 8969427610da7200122706bdcca9fd37
SHA1 a12f6ae35009f43423631bd3ed31224df81ae1a2
SHA512 d5df2f2c1bcd98f0e86f833edc820f08fbdd535949b54ffa4b379977cc22732674a755017af286c4033390998d752bf8940b67a28be8106382f43b2c35544a01
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 b05a53cbf8edb481427cf07cd11d5e25eaf78cf328a328ae38452303c63452fe
MD5 0d4787d169dff20b56a35c0cd9d9bb71
SHA1 9dc98e2074916ad9719b4dfa8e616c896905eed3
SHA512 a93ac44973f3b7846691251ccfd268370727261a24999b68cb263f5421d65ec7a552b99f9b5f09c833c0affe3b3658e0c9ab6303f13ae5c1f25a3c898bf9c980
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 3KB
SHA256 e0711745612c04b7e304ee13d2f8b494e34a9c7e3cda606e10149828a659ccf6
MD5 91d1d9dd2e292cc0d59e57801bfa5984
SHA1 23930f25097cba89053f78d62b608635944c2c9d
SHA512 9d9ed51ab4e025304800149bb4892409856a3f6188eb16620ff4a98c09e7c65cdf3a07820cd3923be7ca3f5087be39aa166a5ce41bc3d6d1e7148a236261436e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 2212c0701cc6bc029a121376673d5f6e4fb041d9381f56b4ffd3846f0c0d9652
MD5 ea7389667eb2f0751a4b048300e8205d
SHA1 ba66586428b910bcabded6fb85c2a0216d8dd971
SHA512 0149bb4c67a6d331ad489a57a881ad49cf1e26b3ab6700eab9cda91db5aae5bca7e285611a69bc6e8d7aa79c2fb51beb9d73e4076079f6d51073c32ec01b07ae
SSDEEP 96:nLv++ptQkkneSsu0MoiVmdDuG1jIgUBPVpAiX3wI3:nLvPQkkniu0MUuGhIjj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 3415ba75891e231825ece3c85c7983ea1fd46499d0230a95826e897a03411732
MD5 4977c45c7dd6f3cd1e904e1ac07b8c29
SHA1 d428f5c3923c178e3ee21ac1c8bfca7ab2b8e884
SHA512 cea4000b13f36addeab4b841f411fd16aca30d19bdce6994723f6489818bd24be7c45e9c001960d2f2c7f3f2bfaa63f95485bd020f468120cc367e4e5c7e36ad
SSDEEP 96:nLv++ptQkkneSsu0MoiVmdDuG1jIzUBPVpAiX3wI3:nLvPQkkniu0MUuGhIsj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57ed7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57ed7d.TMP
Size 3KB
SHA256 40be4ab865464619626d1791f3f533adf3077e1a099e5ab9d649b4fed9bad8cd
MD5 a8b463481de44b85cf0714600bc6a3a4
SHA1 c01c275ace55743f6df5eccc9083aec4b2c1e361
SHA512 b542f1af1e651602191ea207412074e9448454f6ef5bda34f6c6775a5eb49e8927eda579ef9582d036dca9fa3889c206b984518c6ad46b7b824da7c578fc0b2a
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 26KB
SHA256 028f2a2d0e2a4be5edcc0ac097e09e68baca426cb07b9627b64907dad820d011
MD5 877a70752a0bb168f5ad92d3dea00911
SHA1 4763c849bcd97a8b158bf264b85c966f5d9613c9
SHA512 5d8999804cc39e9493c7976e517d82ae4d1c6e59eb5324a312808d633b13459b2df8df22df5a2619efee428def285fdaa8e99acb50d5ac8ce671b51453578c66
SSDEEP 768:nbs8u2AWRvQF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3YLl/R0RirUp/6p0Q:nbs8u2AWRvQFu1jaKYLp+Rxp/C1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe581529.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe581529.TMP
Size 25KB
SHA256 c321137ab3687e53439e21da68fe181bddb799e6549ee809ca268ef32ce19590
MD5 ca0e844ce4479e049d934587afccd8e3
SHA1 48bde2bb8930dbc7db7f2fceafa9b9caf5327bf3
SHA512 c21fbe682559512020cc0cfcd0f10e7d46a43b720e36fc68276720f0950bb29e97cbc0476a3b99039a80aabfe92c9339a11d2ec00c6e34c252cdf7935e89ed84
SSDEEP 768:Ts8u2AWRCQD8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3yLl/R0RmrUpC6p3:Ts8u2AWRCQDu1jaKyLp+RFpCC3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 2e09a9cab1ad87a27bfee3ccd6e8619363e4d10ecadfd93289a5ef66ee0ee837
MD5 e110633f3f1040ba235a396eb68d1fc7
SHA1 71900fa211bed1092f80205af65fc1d78210ad25
SHA512 ab236559c6ee3063f40ac19993c159b0c408b44d72e3d6b2f0e5a3b49b7ec794813c390020ae3eb05605134ef9bccbcf72bd9d890f735e9826dcd877a934c95d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
Size 203B
SHA256 990ca19c4b52db2b5d32b60590a3dd48e198c120db075f2692e38c355685d617
MD5 3b4701b6afe83bb49a0e686ded67610b
SHA1 1079afd8ac424b27e4fb08862dec53f4c614f265
SHA512 8479e86419a65371cd79a8eeaf290e902439f237b85d72bcf27e606e27827d65e2e059d8568896219b9c557d349d8e9f3320907b252a6924d3e6830bc35f513e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe59116b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe59116b.TMP
Size 203B
SHA256 2ca0c2cf676e4dbae47fe50774303ff2ed700d5f01efd2d3d4a9781f4c6180c3
MD5 357478ae004fc329471df99f8bb9077b
SHA1 1f1556f3a48f4b8b4510415b133613f7f1d2978d
SHA512 b5f91004cc88424fa7b9845bac7d8181517dd3d5e0a7d5b71ba4e096478db2860c042278dcf7efbde270a9d37cc76578f5f3a023c080e5dc7daaa51e869e71b7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6
MD5 1e1be607275af8bc71fab2203e02efd5
SHA1 39959642e9e919c88ac7bb870b9c9484a298aa1e
SHA512 1ed45303c6592268f1629dd9f086234bfe5543e488fbed0023859c892633db8d355f45809aaaef659bf4746761e4132a8c47fbce6ee648979cdab3d019297bab
SSDEEP 49152:lp2ivE7Z+VA1Nc4Xppga2vwjRf1CwgnNlm4:lsiGQcS4yvoJg6
MD5 SHA1 SHA512 SSDEEP

Submit Download

3279f06212.exe

Path C:\Users\Admin\AppData\Local\Temp\1000053001\3279f06212.exe
Size 896KB
SHA256 6bf87f8901a0b1566635af5168eeda50b928c5a0dc058616f2e41c3060d03333
MD5 351126693eef50cd162af79231d4dd79
SHA1 5c23d3d5ba2d97ac1a1994dd67a66e7e3f361f8b
SHA512 4d33547604e1e082cfc98e4ec22f0f337daf571bf7b95af37dda15335c2632291601c87940e8ff7e5af2535b04e07bf44bb3788c8bd93bfc07d125be54e4403e
SSDEEP 12288:GqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTu:GqDEvCTbMWu7rQYlBQcBiT6rprG8asu
MD5 SHA1 SHA512 SSDEEP

Submit Download

c33625ae9f.exe

Path C:\Users\Admin\AppData\Roaming\1000051000\c33625ae9f.exe
Size 1.7MB
SHA256 27dab34b33fd6fd425193ab264e1a0bbcc695a173c64de5d479fc96e189f979e
MD5 5f608251065b3a8efb3d707df00ffede
SHA1 8b5ee84f54f599d9ad9369ec38aaca5d2a59873c
SHA512 f4327b16343b2651a97f9ef29ca269efec6185dfbb7db2c1cccabe2134629e86de6efd716d1032ddcaa72ae7969a38573124249d234f7c75a09525ff8300f875
SSDEEP 24576:ULGk0+QMiQ/s4oeI0uWqD3qcrantWSvMP17B2BSLiI7YJisKRgOLqJ1A5j/:ULGFQluWqDrran/417wBhKjLpp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk
Size 1KB
SHA256 10fcaa604a347e6d4f2150c4ffa44fe1053cffd5269e454f6f92653a183cf377
MD5 a695f9fedd31373658e1654c710896de
SHA1 7b9a8790564f4724d8eec2d11d1c5e3a508c2280
SHA512 867ee435289cdc814c019dc96b524a8f3209be9ebc0de33aa00c3b744dc59cfaab8dcac7cd82c1f00784bd69880dabb92a111c31eb7288e76db375510b60c7d0
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 8e04dc1e44cad0f244c1838c08b40b2d77f1177b3f9906342e1731c29b5c0b0a
MD5 5598c47285048c16e868bd4f08737dd7
SHA1 a41cc0cc0b941d0f54de35acb8f369f57e74694d
SHA512 a8e321ed272e24ec558aea6b29830f65c88d476f660e35e09d1d2b95dfab89fcaad15bad14dba5cdfc054184053bb8b899720cd3de567891a008442c7ca37c22
MD5 SHA1 SHA512

Submit Download

memory/872-59-0x0000000000170000-0x000000000080D000-memory.dmp

Download

memory/872-55-0x0000000000170000-0x000000000080D000-memory.dmp

Download

memory/1436-439-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/1476-57-0x0000000000900000-0x0000000000F9D000-memory.dmp

Download

memory/1476-46-0x0000000000900000-0x0000000000F9D000-memory.dmp

Download

memory/1476-36-0x0000000000900000-0x0000000000F9D000-memory.dmp

Download

memory/1476-45-0x0000000000901000-0x0000000000915000-memory.dmp

Download

memory/2356-326-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-19-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-54-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-290-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-425-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-422-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-58-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-60-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-61-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-419-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-20-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-426-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-354-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-355-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-365-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-377-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-18-0x00000000001D1000-0x00000000001FF000-memory.dmp

Download

memory/2356-396-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-421-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-16-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-420-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/2356-197-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/4280-409-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/4280-407-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/4936-3-0x0000000000CD0000-0x000000000117C000-memory.dmp

Download

memory/4936-4-0x0000000000CD0000-0x000000000117C000-memory.dmp

Download

memory/4936-17-0x0000000000CD0000-0x000000000117C000-memory.dmp

Download

memory/4936-0-0x0000000000CD0000-0x000000000117C000-memory.dmp

Download

memory/4936-2-0x0000000000CD1000-0x0000000000CFF000-memory.dmp

Download

memory/4936-1-0x0000000077656000-0x0000000077658000-memory.dmp

Download

memory/5036-293-0x00000000001D0000-0x000000000067C000-memory.dmp

Download

memory/5036-292-0x00000000001D0000-0x000000000067C000-memory.dmp

Download