amadey | c26fa240909261e0502f8477938318228c7b1d0969418a39ef687a89fcccc336

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
Size 1.9MB
Sample240903-b36pmatcnl
SHA256 f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805
MD5 baf9c65740a624a1368c5daf804dbe75
SHA1 4d420290abe5a7cb44aa3ee6471e2f914d7f092a
SHA512 5624e7a58773275af48696b0a382863402b61019a22f779d579b50f649aba21f4cd74d21bc6f58c57b10f0ecab03627897046b08282003a3516efc9f46612573
SSDEEP 49152:85k1rXyxjjLjmnH6n8wVSg2oHJ0HU5gJA:8ygxjnana8wzBHJ0NJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 c7817d leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	72643a3094.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4f6e3a0f0a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	72643a3094.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4f6e3a0f0a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	72643a3094.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4f6e3a0f0a.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	svoutse.exe

Executes dropped EXE 10 IoCs

pid	Process
3128	explorti.exe
5764	explorti.exe
5916	svoutse.exe
2864	72643a3094.exe
1160	4f6e3a0f0a.exe
856	2d29286eaa.exe
5336	svoutse.exe
1900	explorti.exe
4832	explorti.exe
5540	svoutse.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine	72643a3094.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine	4f6e3a0f0a.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Wine	explorti.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023623-86.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
2684	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
3128	explorti.exe
5764	explorti.exe
5916	svoutse.exe
2864	72643a3094.exe
1160	4f6e3a0f0a.exe
5336	svoutse.exe
1900	explorti.exe
5540	svoutse.exe
4832	explorti.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
File created	C:\Windows\Tasks\svoutse.job	explorti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f6e3a0f0a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72643a3094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d29286eaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4452	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3336	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133698012924763656"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{CED2C042-0E91-495C-8FEB-D1E7DC964D8B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2684	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
2684	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
3128	explorti.exe
3128	explorti.exe
5764	explorti.exe
5764	explorti.exe
5916	svoutse.exe
5916	svoutse.exe
2864	72643a3094.exe
2864	72643a3094.exe
1160	4f6e3a0f0a.exe
1160	4f6e3a0f0a.exe
5336	svoutse.exe
5336	svoutse.exe
1900	explorti.exe
1900	explorti.exe
2364	msedge.exe
2364	msedge.exe
5540	svoutse.exe
5540	svoutse.exe
4832	explorti.exe
4832	explorti.exe
2360	msedge.exe
2360	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
856	2d29286eaa.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2684	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
5764	explorti.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
2364	msedge.exe
2364	msedge.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe
856	2d29286eaa.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 3128	2684	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe	93
PID 2684 wrote to memory of 3128	2684	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe	93
PID 2684 wrote to memory of 3128	2684	f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe	93
PID 3128 wrote to memory of 2924	3128	explorti.exe	97
PID 3128 wrote to memory of 2924	3128	explorti.exe	97
PID 3128 wrote to memory of 2924	3128	explorti.exe	97
PID 2924 wrote to memory of 3336	2924	cmd.exe	99
PID 2924 wrote to memory of 3336	2924	cmd.exe	99
PID 2924 wrote to memory of 3336	2924	cmd.exe	99
PID 2924 wrote to memory of 4452	2924	cmd.exe	101
PID 2924 wrote to memory of 4452	2924	cmd.exe	101
PID 2924 wrote to memory of 4452	2924	cmd.exe	101
PID 2924 wrote to memory of 5764	2924	cmd.exe	103
PID 2924 wrote to memory of 5764	2924	cmd.exe	103
PID 2924 wrote to memory of 5764	2924	cmd.exe	103
PID 5764 wrote to memory of 5916	5764	explorti.exe	104
PID 5764 wrote to memory of 5916	5764	explorti.exe	104
PID 5764 wrote to memory of 5916	5764	explorti.exe	104
PID 5916 wrote to memory of 2864	5916	svoutse.exe	107
PID 5916 wrote to memory of 2864	5916	svoutse.exe	107
PID 5916 wrote to memory of 2864	5916	svoutse.exe	107
PID 5916 wrote to memory of 1160	5916	svoutse.exe	109
PID 5916 wrote to memory of 1160	5916	svoutse.exe	109
PID 5916 wrote to memory of 1160	5916	svoutse.exe	109
PID 5916 wrote to memory of 856	5916	svoutse.exe	111
PID 5916 wrote to memory of 856	5916	svoutse.exe	111
PID 5916 wrote to memory of 856	5916	svoutse.exe	111
PID 856 wrote to memory of 2364	856	2d29286eaa.exe	112
PID 856 wrote to memory of 2364	856	2d29286eaa.exe	112
PID 2364 wrote to memory of 2516	2364	msedge.exe	113
PID 2364 wrote to memory of 2516	2364	msedge.exe	113
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114
PID 2364 wrote to memory of 1668	2364	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe
"C:\Users\Admin\AppData\Local\Temp\f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "explorti.exe" && timeout 1 && del "explorti.exe" && ren 0657d1 explorti.exe && C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe && Exit"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "explorti.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3336
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5916
      - C:\Users\Admin\AppData\Roaming\1000026000\72643a3094.exe
        
        "C:\Users\Admin\AppData\Roaming\1000026000\72643a3094.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2864
      - C:\Users\Admin\AppData\Roaming\1000027000\4f6e3a0f0a.exe
        
        "C:\Users\Admin\AppData\Roaming\1000027000\4f6e3a0f0a.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\1000028001\2d29286eaa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000028001\2d29286eaa.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        7⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9c6eed198,0x7ff9c6eed1a4,0x7ff9c6eed1b0
        8⤵
        
        PID:2516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2232,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
        8⤵
        
        PID:1668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1892,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
        8⤵
        
        PID:2580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=1832,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:8
        8⤵
        
        PID:5208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3372,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
        8⤵
        
        PID:2272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3388,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
        8⤵
        
        PID:5340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4520,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
        8⤵
        
        PID:4352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4528,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:2
        8⤵
        
        PID:2936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3360,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
        8⤵
        
        PID:5940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4804,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:2
        8⤵
        
        PID:2688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4864,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:2
        8⤵
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5244,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:2
        8⤵
        
        PID:3972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5472,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
        8⤵
        
        PID:2108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5480,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:2
        8⤵
        
        PID:1132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4060,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
        8⤵
        
        PID:316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5660,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:2
        8⤵
        
        PID:2352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5636,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
        8⤵
        
        PID:676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=6140,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:2
        8⤵
        
        PID:320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5272,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
        8⤵
        
        PID:208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=6424,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:2
        8⤵
        
        PID:4316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6412,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
        8⤵
        
        PID:6124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6492,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:2
        8⤵
        
        PID:4004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6600,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
        8⤵
        
        PID:2908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4876,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
        8⤵
        
        PID:116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6208,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
        8⤵
        
        PID:784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6184,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
        8⤵
        
        PID:1444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=7324,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
        8⤵
        
        PID:2108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=7552,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
        8⤵
        
        PID:676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=7680,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:1
        8⤵
        
        PID:3128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=7816,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:1
        8⤵
        
        PID:4976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=5448,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
        8⤵
        
        PID:6092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --field-trial-handle=7880,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:8
        8⤵
        
        PID:3256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=6792,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:8
        8⤵
        
        PID:4832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=6792,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:8
        8⤵
        
        PID:3672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=6856,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
        8⤵
        
        PID:5740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5088,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
        8⤵
        
        PID:4356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5064,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
        8⤵
        
        PID:3828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4884,i,9332883150665446261,9107178056183263620,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4768,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
1⤵
PID:4048

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1900

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5336

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5540

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 280B
SHA256 6dc71e452adb51d8d4db2fd9cfa527d26a837d3878950e32d5189d83cbbbe529
MD5 1c5e427392155b64d6d4556050d17c24
SHA1 fec0177f694ec6df0c1bb188da82f0e1f3885790
SHA512 539c94e073abf59b99644a1617e89e3b88cf962c76d9736dc0425a997e3b0065033aa54b8c61da188b56b5fa9c48058fb66e2c08a99746ed02ee52f9d15a5904
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 280B
SHA256 8e9350bba354e9a86415ca22b723f850b9b0ad7d99a999bd7759c0c3a9bc8cec
MD5 994d25a61b51212e760a8ec27c469ec5
SHA1 87ef03e06cb2beefa4fef9f50bc72b0bc5650f25
SHA512 e7000f53e0d7efb5aba69d8182e0503ab1cfc69bef7812f887d388d86c0c174383663e38dff2685f19ab6b58e332d7d944a7c911b3175eb4d93760f07061e1ec
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 dca6e91e06ba21a6108919ec27ce960e7c0981c67c4f9be3a303033f6bfb65b7
MD5 1e9bd61a180d30b0ab53d903e49d7e8e
SHA1 5178708206ec7c97442109598e6cd43872aebe5f
SHA512 d7597442f8bdb5e93b210ea251fa0d15046377fb575e5f19470d6d87ded998edd45d2f5e55c45e83aea2ee30a7650c54c3173f2fa90424b388a280afc8bbdd16
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe590bfc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index~RFe590bfc.TMP
Size 48B
SHA256 accc00e51ab56de6d53349ffea40b799ca386db395f2c5986a378dbc38d8d703
MD5 450cc41de81e488a5ca605032d35a914
SHA1 cbcc09c12fb5e177b62a49a797b79a8ae8d82aaa
SHA512 dd0623e15e046421c522b0de571cd286ad8a06910e44bf941dc9abb20deca3848bfe793ea65c43a08da393d299516fc33254b6cfb98e9f6fae44d2aff43672a4
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State
Size 627B
SHA256 bde161e3174b7d24d528e905ff6c6d6b06d36ff4acac98e9a242f42629023c75
MD5 3deaf3a1beb7e4970941cb2ec64ca4c9
SHA1 07fda5c38c6fb7920fab2946cf8a72af8f30252e
SHA512 2b8319bfca09d1655e7d20b8bb3a8777971ef77e7c8f78aea9ec2e1180747c5f6777e4987f909f67de73b656c0226f1d3697fa32ab6420e79e7950edfeac56c2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 7KB
SHA256 d2761f9ad05aa64d27f501512e8402584c10685d81d56266a004ea39e55f0217
MD5 9a1e93e364104f851fff9954df01fd85
SHA1 6e63728db64df0e0fc175acdf66921da9b8adee1
SHA512 b9502afc08482fd87d0302777608bbb467f8ed65dbbf94ecb374a9d5789c3fb34739ba32030d055a295cf4e890ed3757cf0d163bc0f0ccf80e0321ea07625814
SSDEEP 96:stShiEpkVEscmFb9W7psT8i0vhEB6Z6/7/x+hHMSm+uecoYxWK+gy52MlhgRC4J:stOdDsS1sT8pah/V++KYLYPlhg5J
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c3b829c4c8d134c89fb3cdf5c53e0d0b0893e772903cfe82768382a3e5f51a03
MD5 49c1bfac9bdb2796f4dd3eeb7c8666c3
SHA1 6d633eaa1362b0d26351274dacd67ee4d58f0482
SHA512 b0c89835e654f93ea0162c0d20784b9b84f738a8c7b60880604c63b3a427a635ad493535f1a69c9c8ed14ef1d6f9028f06532d86d83954cd3f5180a0b565e55c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4d1dfd1c8c69dde80aa801008e5b9dfa860b10142345f81eb19f02b087496dea
MD5 b419b2a31509cab70c54bb96bf0fec10
SHA1 b1a5d35571f66d3d5fbeb4a17194f15dfcb9c508
SHA512 6d36c03a93fc6112a8828e1b307748884e73023f82e1f545f6594e1042413bb6ad6edde25b0cf1796028788a09cea6583df8c8d79b50cf08f58949dd5faf8e5d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ceb909c8-7145-4066-b4c8-2cc708533eaf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ceb909c8-7145-4066-b4c8-2cc708533eaf.tmp
Size 6KB
SHA256 25ada020e4f42ce1786cfa1aff4b74c6acb7977d2d8e17439838ce32c4bf7b40
MD5 08c156b9c92f8eca14d5c1916d024e35
SHA1 5f035349d01589bc415ef5b5739bad8321f3f3f6
SHA512 fc17a81f2faa554cedfc2c2e287ada780a86887ab59e1b144d41e385f6f1ca28ab35e3e287d4b494a3e69786de856403ba34f8aaec3b3918fccc685b310a985a
SSDEEP 96:stShiEpkVEscUb9W7psT8i0vhEB6Z6/7/x+hHMSm+uecoYxWK+gu52MlhgbC4J:stOdDsM1sT8pah/V++KYLMPlhgHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

e6dc26d4-d66c-4917-955c-02d25a095bcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\e6dc26d4-d66c-4917-955c-02d25a095bcf.tmp
Size 23KB
SHA256 3f9e61669ff86df9c5dc77a8f6f954d4c1d4077c0b5f732d5f7a5ca4638cb5b4
MD5 aaa8de554a5dec8dd638cc69a0d71249
SHA1 0b8f6663916cdf026ae799e11387461d9c8f6c0b
SHA512 8c90c5c5342771a83bf33497c4e0df91ebe17f72634b70e25a73c0714f2a9e0a0ee84457398b169ada92108c26d7eb263dbc398210650c1b29718d7d9c2f2152
SSDEEP 384:5oZ/9MyfCtw6wFfasKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVBq93IV31rwhAU:5A/9MYWw6Qfas8F1+UoAYDCx9Tuqh0Vt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 1KB
SHA256 667b79fc200443bc430f9220163288550ab96af3c65545a56b3eb8abf509f8c1
MD5 784159b1ee87f5731b4d46fa6b529025
SHA1 98ae8aa3cf98eb26bbbf9bc0e9d1cec7fa2036db
SHA512 cab01760ea7c262875e305b4eb27b30baeb0d76f6dfaf7c1e750458f78afd5d72a1dd90054c2f0929769ce71f668b1b6696f6725e0d423027f8ba5493b19df43
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 3KB
SHA256 f38ee1b40b63362a1b50c1a5d92c12d99c19690b4e8952f08a9e2933a30d335c
MD5 13f5c22a26ebe0c94724dbc889969ac8
SHA1 a94e4602dc92e2e94d30abd0be93a01ca5aa7d79
SHA512 dd641b20b26993ce76c21fcabb06f26202b819fe3fc5da54ce6c5acceca103cae56a651ea90fc366ed1465ac7ecc682b8e0252a6f69808f33774946b2b0f086b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 4KB
SHA256 bf18ace355dc8e74428a687e427d973aa4875d92d8324b5d12047d6c8e120671
MD5 681e49380ee70efd41093c165d428922
SHA1 197ff17efcee1f50111fad8b2771089deab1f5f6
SHA512 1af87792da25c12d7eb3556a92d2a6214b169fc1ff0477aa870e54e01bd429a30c3ecd8bb5958c31184ccd8d3ce28d85aaf1bb0f093254ca18220181e180a21f
SSDEEP 96:SqGNkGSufUCVC358kh/cInURoDoto+SB6PzvB5/E0JBg0rDMBSDS4SYSuSDSDSk1:pGNBSzU2ooDU08T/Ek2O7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 23KB
SHA256 ff60057e06c07b8b2a1e2a0416876b278c40cce6664ad597932f2427a964a193
MD5 148efe1243c9f70710d0fc5c75ea8ac0
SHA1 ef51f767832cc056d5ecb414ac6510f074cdb964
SHA512 e0ac37f66f6b6f0a2105b2ec97a6f3f62b57df2696a481935cba950ca421d321a2bd88ef8fef7d9ddf4ad4f04803c91d51ac7e134dbccfaf8e13f2ef32fbb61e
SSDEEP 384:ziE67lurKyK5Ew/SuklXcD+68NBSVLPsEMWOSJg+NHfcjBXSOs0KCZUtF:uEDK96sSfXO+6J0EMP2VH5ff
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 27KB
SHA256 4d933313fc7699bcd1e0f15fdb80699b5f322ca416e5b79f482a991e20dd74c1
MD5 c9bb30abb455f9cf35a63aa28995e7a2
SHA1 2b46b63b82955952558827cbb2672cb0bfe4b822
SHA512 6aad873c77deb3800f8a5d848a9550189a1615f1621b6bac52c2eaf2969a11ef439b2e8a9d9269f6abbd36fc2ccfca624f373808f41e3c81203f919296c420d0
SSDEEP 384:z/E67lurKyK5Ew/SuklXcD+68NAuLPDEfHfzZ9xKxDoOSJg+NHfcjBXSOs0KCZUf:DEDK96sSfXO+66rE/fzZ9xKxh2VH5ff
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe58b9d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RFe58b9d5.TMP
Size 1KB
SHA256 c9ae9b14d3b157b734815f8180fcbd115033bc22de9d0667bdeb42b3bede89b8
MD5 147dba8fdd82fd4189361f8e2125e913
SHA1 e9e4fde6a1bd4d6c11dc9f4e384254f7d3c4c1d9
SHA512 7c5cf5d18228f4e7ddb7c91f0aa9f1dc74f95e1014afe8c0b9b8cc3bd06a168db41d7f1266a3d93b06e86082a9719a12db39babd764c46b8f6512ae12d3b8d9a
MD5 SHA1 SHA512

Submit Download

0657d1

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\0657d1
Size 1.8MB
SHA256 d69e2df72932f9b3d60415aec6686cd3989b99eba1b661010fe648ff7360ea1d
MD5 44dee3b05a04b1984b1d36b1bc09e4f6
SHA1 c9ffd103993fb91d78865006e52a9a87a8186007
SHA512 a9510b9cdcbb9be7067e1632e89440eac6395a76069258f3e573cb64d9d281f52d29d144e943a6fc7ff726c6568946f0df49904a55e7446aa245673763c19921
SSDEEP 49152:VWrgj7dzZV8W7xkd2yOaHukHZng/ug1pNKHfIWe2lw:Ir+ZV7+0yHVtgGgPNKHJtq
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.9MB
SHA256 f03a849ae2d670ff7e468da63c26789b8c738d830a0e49aad3a26ff5bc555805
MD5 baf9c65740a624a1368c5daf804dbe75
SHA1 4d420290abe5a7cb44aa3ee6471e2f914d7f092a
SHA512 5624e7a58773275af48696b0a382863402b61019a22f779d579b50f649aba21f4cd74d21bc6f58c57b10f0ecab03627897046b08282003a3516efc9f46612573
SSDEEP 49152:85k1rXyxjjLjmnH6n8wVSg2oHJ0HU5gJA:8ygxjnana8wzBHJ0NJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

2d29286eaa.exe

Path C:\Users\Admin\AppData\Local\Temp\1000028001\2d29286eaa.exe
Size 896KB
SHA256 48f7414709cbb505820ba1af450f22a5225a5a141b1a7580b1b1157c0e68e0c5
MD5 b59002a810aebd5373ff3863afc1c42f
SHA1 ef9499096a2a1ccc25efc791a0c0047cb4b32d6d
SHA512 5f199178c93ef373181a76e21f8423b3e346f970c262236a03d97eb26aa1f12824752ad0628bc01dfa1190b8ab818823077c29de0da359756e1c1bc3323aef50
SSDEEP 12288:8qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTM:8qDEvCTbMWu7rQYlBQcBiT6rprG8asM
MD5 SHA1 SHA512 SSDEEP

Submit Download

72643a3094.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\72643a3094.exe
Size 1.7MB
SHA256 f8366120d820594290cca65aa7165b6582a5f3442fb66d7992929c821c217c3c
MD5 a0f1a3fb687a03fc519f656904fa3c3a
SHA1 2e38364f4ee4e4306895ccbada109c9c960fb303
SHA512 c0e4488765d0e1e4f8d5a1218439bb73a6d4e4deacd5f5c7e0f90d137aa8d85021ae0ce385934933b942b47fb56438e4d70e8cdab2853fc7d3a1e97fd7dfab1f
SSDEEP 49152:eQjS1ht9DnkfSn9rBy+rbPEscpFgLCi9:3jkhLnkSBBy+nYoCi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 fad823d4e2fe20afb0000f4042b35b618c7ac23b524788e5c47315aa8de7e789
MD5 2a0f09ac3ed0461be46f26bc2ed76bba
SHA1 85e507d6192f0c6348909c7e64a4e5a90c144b7d
SHA512 e1fddadd79315ddc619506c4cee1dea9c88b937697e0d116a1c1598cf8792fe3f8932f81f9bcb200124c35b6df5bf6dfa169f60968eb68f852f8cd94bb68a42a
MD5 SHA1 SHA512

Submit Download

memory/1160-79-0x00000000006E0000-0x0000000000D7F000-memory.dmp

Download

memory/1160-375-0x00000000006E0000-0x0000000000D7F000-memory.dmp

Download

memory/1900-541-0x0000000000F60000-0x0000000001414000-memory.dmp

Download

memory/1900-545-0x0000000000F60000-0x0000000001414000-memory.dmp

Download

memory/2684-0-0x00000000003C0000-0x0000000000894000-memory.dmp

Download

memory/2684-16-0x00000000003C0000-0x0000000000894000-memory.dmp

Download

memory/2684-5-0x00000000003C0000-0x0000000000894000-memory.dmp

Download

memory/2684-3-0x00000000003C0000-0x0000000000894000-memory.dmp

Download

memory/2684-2-0x00000000003C1000-0x00000000003EF000-memory.dmp

Download

memory/2684-1-0x0000000077D54000-0x0000000077D56000-memory.dmp

Download

memory/2864-62-0x0000000000B60000-0x00000000011FF000-memory.dmp

Download

memory/2864-81-0x0000000000B60000-0x00000000011FF000-memory.dmp

Download

memory/3128-30-0x0000000000EB0000-0x0000000001384000-memory.dmp

Download

memory/3128-17-0x0000000000EB0000-0x0000000001384000-memory.dmp

Download

memory/3128-20-0x0000000000EB0000-0x0000000001384000-memory.dmp

Download

memory/3128-19-0x0000000000EB1000-0x0000000000EDF000-memory.dmp

Download

memory/3128-21-0x0000000000EB0000-0x0000000001384000-memory.dmp

Download

memory/4832-615-0x0000000000F60000-0x0000000001414000-memory.dmp

Download

memory/4832-620-0x0000000000F60000-0x0000000001414000-memory.dmp

Download

memory/5336-540-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5336-543-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5540-618-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5540-616-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5764-46-0x0000000000F60000-0x0000000001414000-memory.dmp

Download

memory/5764-33-0x0000000000F60000-0x0000000001414000-memory.dmp

Download

memory/5916-570-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-403-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-525-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-342-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-610-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-611-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-571-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-582-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-546-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-47-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-630-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-631-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-632-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-637-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-365-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download

memory/5916-656-0x0000000000E00000-0x00000000012B4000-memory.dmp

Download