Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29/08/2024, 13:38

General

  • Target

    5dac0bb26a5a94bab13e7f3d8c254acb93ac6f09109812c1d7893b50912ce908.exe

  • Size

    1.9MB

  • MD5

    9bae5899c44d66c2466adcf3d2c080a8

  • SHA1

    902994c6e3807a8e38cbd56ee55e491568905f97

  • SHA256

    5dac0bb26a5a94bab13e7f3d8c254acb93ac6f09109812c1d7893b50912ce908

  • SHA512

    b0e26c33779584da5cfb47c55dd92386f72dd03bb5d633410175ce32119cb0843a29480a6b1d60c929aa5198c835ae5edfcb0845d573e16c95d216aab8f45c60

  • SSDEEP

    49152:X6jGfqif201isvq0wYK4qvWXn/Pp3HIBebFyxsZfCwqX/:3fG01vC0FcWXnXp3IwyV/

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5dac0bb26a5a94bab13e7f3d8c254acb93ac6f09109812c1d7893b50912ce908.exe
    "C:\Users\Admin\AppData\Local\Temp\5dac0bb26a5a94bab13e7f3d8c254acb93ac6f09109812c1d7893b50912ce908.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Users\Admin\AppData\Local\Temp\1000015001\6494acf963.exe
        "C:\Users\Admin\AppData\Local\Temp\1000015001\6494acf963.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2660
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
          4⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1684
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffff8033cb8,0x7ffff8033cc8,0x7ffff8033cd8
            5⤵
              PID:4212
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
              5⤵
                PID:3896
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4144
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
                5⤵
                  PID:5012
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                  5⤵
                    PID:700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                    5⤵
                      PID:2364
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
                      5⤵
                        PID:2232
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
                        5⤵
                          PID:2624
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
                          5⤵
                            PID:3968
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
                            5⤵
                              PID:2328
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
                              5⤵
                                PID:232
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
                                5⤵
                                  PID:1336
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1136
                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1136
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,16244807379680281838,6842763260153100790,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3952 /prefetch:2
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1508
                            • C:\Users\Admin\AppData\Roaming\1000017000\0c0d8b8e77.exe
                              "C:\Users\Admin\AppData\Roaming\1000017000\0c0d8b8e77.exe"
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Loads dropped DLL
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4588
                            • C:\Users\Admin\AppData\Roaming\1000019000\ec37de2697.exe
                              "C:\Users\Admin\AppData\Roaming\1000019000\ec37de2697.exe"
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3364
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:5052
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4020
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5752
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2396
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2464

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\ProgramData\mozglue.dll

                              Filesize

                              593KB

                              MD5

                              c8fd9be83bc728cc04beffafc2907fe9

                              SHA1

                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                              SHA256

                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                              SHA512

                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                            • C:\ProgramData\nss3.dll

                              Filesize

                              2.0MB

                              MD5

                              1cc453cdf74f31e4d913ff9c10acdde2

                              SHA1

                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                              SHA256

                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                              SHA512

                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\21ad887a-c1ca-40b6-8fb3-af818f23ce34.tmp

                              Filesize

                              9KB

                              MD5

                              cd6710aeb02bf176a26617cb98aa91aa

                              SHA1

                              c4b466b05091ed24bd2ed904164c53fd81cf9591

                              SHA256

                              6016c395a57e08fa86a124c912ba0329841bb99d2739578bdeb6616b82591772

                              SHA512

                              5079d12b28615cc2dfe8751cac96c2f9579603d247aad11d12d9c505d66007cd183c94182cf945a6825375cbaca7252dd6caf9d94a6e0153d4eaa0817f54f8b1

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              04e0d7b1d171351c268d62667c33b694

                              SHA1

                              3c675bacbe82b49c3d06caa218d1d7f26f16a9c5

                              SHA256

                              64f6cf8ffe3107886e4666c63ca6e671d109409374e7174ae38f7137702dc22d

                              SHA512

                              7f262d2f80e30ee1943bbd498e85c91b5a3cb65af13ff8b1ab303bc5fb41280c3c2116c85954baaa6c2d4e84c8096400b02baca775764b8fda0d09c6d93d2a7e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              871009fa17c07d89a36eb443a14bb7d4

                              SHA1

                              c3a8b5e9bca6f2788f9a3379d1abaf144185adc1

                              SHA256

                              dcecc0fcb4cbf890974cb2b544bdd83e46b69b19b33680f75d7c07c44006f3b2

                              SHA512

                              b866b2b298d117dc9f9a3a509b4d5c4b9fd544f38ebffa3973e9262e893732700f66c15fe489668bbd77b50baa05aecba596d715c3f97e4e1b01555676dd3d77

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              e50bd42bb42bfa3c00a9e27fd1311666

                              SHA1

                              404a6806e9a8eaeef0d5921c06327bc1669a8609

                              SHA256

                              ff9098e15e52802e350e1adbc77e7fc631cd51672e4c9f8cf3fd12e55e272ac4

                              SHA512

                              265fd5243ed963a8122d8172266f605ec358c3074ca2dfc713891b199ca298d61b0d0a06d924f85caf5c5ea4d3152159943fca63cf56658b404b110b4dcc168d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

                              Filesize

                              20B

                              MD5

                              9e4e94633b73f4a7680240a0ffd6cd2c

                              SHA1

                              e68e02453ce22736169a56fdb59043d33668368f

                              SHA256

                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                              SHA512

                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6f277ce2-89ed-4f33-83bc-4d547e7a019b.tmp

                              Filesize

                              4KB

                              MD5

                              9b367d4225a0d3dbe1fdff3d865a9c27

                              SHA1

                              4c5590e6a1fbca4aabee14287e21ffbbe3e42c5a

                              SHA256

                              b339428c3ba12393fcfa2097926841f1a1fe8b27d197e20ea4963a429a33a6b4

                              SHA512

                              a4a0be513f6d9f9f4c26484e1ce1b1fe06746794dba919b7ac227b716f333c07411f2f361ffec7da0bafd69af5678b871c596a249d882685a12d9652b3249b9c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\data_2

                              Filesize

                              8KB

                              MD5

                              0962291d6d367570bee5454721c17e11

                              SHA1

                              59d10a893ef321a706a9255176761366115bedcb

                              SHA256

                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                              SHA512

                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              336B

                              MD5

                              3a6a4d69313f4a42458f28397184a103

                              SHA1

                              4a0702efebbdd79d709f4287c80d8235f660772c

                              SHA256

                              26cec85926dca93641a2ce8143a0d35b77c69e8f4a6233445309ad03fddf9365

                              SHA512

                              8b5d8989941edd53b4a95ddc2216ae963840c99dd0b0e42b0e73ad20af69fc1144006052a6887d3b1f935463afad843aa7c33e45dc4abbadc4806b41ec55e531

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

                              Filesize

                              1KB

                              MD5

                              82aeefd2c35ca318527dba0fadcdb4f3

                              SHA1

                              4f1b6d512f58c5df8591c93b914716d48109cccc

                              SHA256

                              e7bf6755b8eb76a0f1802523725172b6ebcd97e85218a48b2ac8b47c9fa07f89

                              SHA512

                              46b070d2085f81d3180b9ccdc5cb2698222264b5f67f5ffa8dae106c3e97df04dd118dee7a905a77582f118f9ebf81f2411f85b656ccaf98704a611a87df8db7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              05385b1c9bbc4d3ed9b4558fac7f2236

                              SHA1

                              927e9702daf8871a645f88fba5a4061c61f602e0

                              SHA256

                              c60a41f508543265a234d0dcb9050838f73c490494cf2005d433d6d5a5c35a72

                              SHA512

                              e786ecbd41973e3c859c9cea3865f15031bac9e35392860ce90c3ab48cd20e88dfa67243eb2e7eb2d4a01d4b62391749e498749c4ab85dba5faa94298259be8f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              59B

                              MD5

                              2800881c775077e1c4b6e06bf4676de4

                              SHA1

                              2873631068c8b3b9495638c865915be822442c8b

                              SHA256

                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                              SHA512

                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              f768a47fa787c3cf55089cb8594648e8

                              SHA1

                              cbc94f90e46c7b17ab1c1681134f54f06ee59d12

                              SHA256

                              1fe765db503aa606e3b04890f5212db6b867dd75cd67a7c4c7599768ffe02204

                              SHA512

                              10338d56f4bda50475b925b4f399d5961d5d3bb9a9420d392a23eb52c92a133755a8f2a36a1a72872bba7d845de6ad4ed14091a009821700153d84cd38896b68

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              3KB

                              MD5

                              06dd6e288c34e0bf49230edc9f929aae

                              SHA1

                              6fa7c08bd7eece3eabac1ea84dd2bf5d9f382c54

                              SHA256

                              f779bc67524069c6225a3d9e324850814a8793216a0668388bb85d8d4acd50d7

                              SHA512

                              281a66bc0fd1e95d75fa2bfedcac5ba67f2170fa7df6f1f850ad32b6a1b0a5e2cb3d2bfddc63b032e75ba9d7ef0479d8ff62d95d5508203d881983098144ece3

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              7dfa77bc86917192e693c0150f57610b

                              SHA1

                              d95fc0294265919a144c3f38df4bf5d312e95833

                              SHA256

                              3a6134a7e50bb6b8963f294cb8193d502a0db8c20271224518da9d4970321c71

                              SHA512

                              b1ee6e1a049628354f3b0ef2a5a4b8feab52b46826c997a15643bc7bf206539049553ef35f6701bb0184acdf76c5d91a9f279f6d9b37e65c8fa43e7aedc37108

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57a7f8.TMP

                              Filesize

                              3KB

                              MD5

                              c708e6c5a4fe10fa45cef143610b55e1

                              SHA1

                              893853ce3f3eb7d3088c1966e506fd68c9fd05aa

                              SHA256

                              a1ea738a903ebe50b70db6cfab62cd676d1b71a03cf9e1636c7afb44829ca611

                              SHA512

                              3af48904805e49bb196f4ab9f2ec2b20bd19d2b888fd8ae24b10ebf72331999b85c36741da853799150bca202760f7366bfc268a545f1f24305f006127edbefb

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

                              Filesize

                              26KB

                              MD5

                              921f013474dbdf304c4850de9f65a59a

                              SHA1

                              0ae40c1ec1039c7a866202e574aaf863d4c0b2f7

                              SHA256

                              f86e7e53c14013ff49a300e6522e09444fd3129e737d20819650014ab2dd443f

                              SHA512

                              bbf0de43cd362599a0f8b2e5a4758d2d7a52992ce32e58a8f198e68874d1e858d1466ee9e98d5bf363849379445764add49e101a580d42dbe60c407d7741d018

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57d07f.TMP

                              Filesize

                              25KB

                              MD5

                              15ac4429ec85164de8a47c837d5ccdab

                              SHA1

                              00f34315da201d6b70a562463b3204d9515469a1

                              SHA256

                              9325d5fd2b0cc13d8239f8ac44f14e54b4aa7814db189871ee57820f3a4ca2cf

                              SHA512

                              659163542c88fcd059f84feaf238231e485e141502aec3bdac4b09c629aea9ff7e7c97de597ddd722cf65e6ba31acab4e9c373f150474a9fe2ff6522b1d82510

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

                              Filesize

                              48B

                              MD5

                              2af9a320a9db0f360c1f1f50f583c375

                              SHA1

                              50b56e835513473d11d5174905f1febf7550fbe8

                              SHA256

                              7167377438abe275b4adbd0d82d2bc570d6850f7b59bc27c82f3ff2b60380c59

                              SHA512

                              56c44e406b10398540f45564c93aa59490ba2919db10e26c5cd226beb9a123208c20c7e4a6f935c8f8d915e0f770c9cdaf0d927b7483fadacf0ca40cfb2009c9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

                              Filesize

                              8KB

                              MD5

                              cf89d16bb9107c631daabf0c0ee58efb

                              SHA1

                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                              SHA256

                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                              SHA512

                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

                              Filesize

                              8KB

                              MD5

                              41876349cb12d6db992f1309f22df3f0

                              SHA1

                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                              SHA256

                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                              SHA512

                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

                              Filesize

                              41B

                              MD5

                              5af87dfd673ba2115e2fcf5cfdb727ab

                              SHA1

                              d5b5bbf396dc291274584ef71f444f420b6056f1

                              SHA256

                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                              SHA512

                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

                              Filesize

                              203B

                              MD5

                              08bd113002e09a2338a38764a9b64351

                              SHA1

                              0ea27a4c39019ee1c299661c33d734d06c2f4e7e

                              SHA256

                              8ab3a604c59fbfb9b8c502c1ebe1c43d313e283de899cb5169cc23d847216b73

                              SHA512

                              8f2288a697b02fd50c8ad92ce49bcedc7caf4d37785a857599f2593298798eae4fa5b5016cbafd8eeca9de0eab17e2b0cdd708d4c08ea1d6afcc5b9f81708a4c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58cb88.TMP

                              Filesize

                              203B

                              MD5

                              833da7290386acabdd0a049ddb520282

                              SHA1

                              7f79dc7afd1ecf04fde031cbb038b3bba8c7ae5c

                              SHA256

                              3047e9643ddfb11afa9828b1d4b484178b31a6afe58d8d9f86a275cc0ffae907

                              SHA512

                              b1363569f286656d172fbf5610106b8ec84514440d127179acb874845c7770c443e3ccca55d8dcc84c44f209f5adb0eb4f9cf96633bfe1583d47f33718d9d5f7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                              Filesize

                              1.9MB

                              MD5

                              9bae5899c44d66c2466adcf3d2c080a8

                              SHA1

                              902994c6e3807a8e38cbd56ee55e491568905f97

                              SHA256

                              5dac0bb26a5a94bab13e7f3d8c254acb93ac6f09109812c1d7893b50912ce908

                              SHA512

                              b0e26c33779584da5cfb47c55dd92386f72dd03bb5d633410175ce32119cb0843a29480a6b1d60c929aa5198c835ae5edfcb0845d573e16c95d216aab8f45c60

                            • C:\Users\Admin\AppData\Local\Temp\1000015001\6494acf963.exe

                              Filesize

                              896KB

                              MD5

                              cd9163260f1a058d21b379f9f4ebf3d1

                              SHA1

                              b18c887583216ef1ebf7061a2cf909ffa618089f

                              SHA256

                              c83dc38f80cd4412b4314327a36c2f02bdf4c901425203438fe0f69aab360b10

                              SHA512

                              f89d4c236c0f538da12ee1a703d4a25959a9f7cd7fcc726774d6c309b7ff32eec2ca8fa50ed560b6101cd5a978682e94bf1b3b3391575c5c43503406804e756f

                            • C:\Users\Admin\AppData\Roaming\1000017000\0c0d8b8e77.exe

                              Filesize

                              1.7MB

                              MD5

                              78bdea9e949a906de71a9e7e392949e8

                              SHA1

                              1817e5f65fddb23cd1c2f3e6ad45844045b3e72c

                              SHA256

                              9c6971462e3db561147b9a7291e611b275c9053af1c1aa83abe5327ab197739f

                              SHA512

                              b95e9329f446cabd287632e8d5ec4fcdefb61b0fa4b027b279c256285a0044d85566ce7dcf9b7b37b3151f7fdf4d9c184993919ec7ea9294d98ef3f5165fb03e

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

                              Filesize

                              1KB

                              MD5

                              a74230bcfe2574598516dc2363ce2a56

                              SHA1

                              cfa4790c1cd9ff5d285bdb8361a704e4cc71a10a

                              SHA256

                              16c86852e8aa0520148ce56c9196c0b7d74724b02bac0db2386b2d75a7a3a560

                              SHA512

                              aeaaaab70f3fb719ec0031ebbdff180055bab7f70fc0e6fb011c3756d9a2a274156c0601539be24bc47119f1df03b71e0b34d47ef5bc610ba6a8b96ff55e4d73

                            • memory/2396-487-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/2464-509-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/3184-1-0x0000000076EF6000-0x0000000076EF8000-memory.dmp

                              Filesize

                              8KB

                            • memory/3184-2-0x0000000000F31000-0x0000000000F5F000-memory.dmp

                              Filesize

                              184KB

                            • memory/3184-3-0x0000000000F30000-0x0000000001428000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/3184-5-0x0000000000F30000-0x0000000001428000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/3184-18-0x0000000000F30000-0x0000000001428000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/3184-0-0x0000000000F30000-0x0000000001428000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/3364-392-0x00000000004D0000-0x0000000000B63000-memory.dmp

                              Filesize

                              6.6MB

                            • memory/3364-211-0x00000000004D0000-0x0000000000B63000-memory.dmp

                              Filesize

                              6.6MB

                            • memory/3364-351-0x00000000004D0000-0x0000000000B63000-memory.dmp

                              Filesize

                              6.6MB

                            • memory/3364-349-0x00000000004D0000-0x0000000000B63000-memory.dmp

                              Filesize

                              6.6MB

                            • memory/4308-488-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-21-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-506-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-391-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-494-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-17-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-424-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-425-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-426-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-436-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-448-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-20-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-19-0x0000000000501000-0x000000000052F000-memory.dmp

                              Filesize

                              184KB

                            • memory/4308-491-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-289-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-230-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-485-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-490-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4308-489-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/4588-352-0x0000000000C70000-0x0000000001303000-memory.dmp

                              Filesize

                              6.6MB

                            • memory/4588-214-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                              Filesize

                              972KB

                            • memory/4588-348-0x0000000000C70000-0x0000000001303000-memory.dmp

                              Filesize

                              6.6MB

                            • memory/4588-347-0x0000000000C70000-0x0000000001303000-memory.dmp

                              Filesize

                              6.6MB

                            • memory/4588-193-0x0000000000C70000-0x0000000001303000-memory.dmp

                              Filesize

                              6.6MB

                            • memory/5752-405-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB

                            • memory/5752-403-0x0000000000500000-0x00000000009F8000-memory.dmp

                              Filesize

                              5.0MB