amadey | 61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07/09/2024, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe
Size 1.8MB
Sample240907-154eqayapp
SHA256 61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d
MD5 6e602c4dc0a37b461122a4e17472cb16
SHA1 3b6b6da1151c7df173be75dda271aacc9d938153
SHA512 4d67b14674bcb374ad479d021df45f47e3a9226185b629cec56b76025c45305ad8f480d1a9dc722aa8842548561e31e6c1d883f288a2f39129102211d1b4842d
SSDEEP 49152:BMO5vsnq7zpHsCPfOsIgtQ8VomBjJYdFAvcYtubMfp:Oq7SCes3mYTGWxtubMh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc c7817d rave discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

http://185.215.113.103

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0f46f8b50e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	66f727e0f3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0f46f8b50e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	66f727e0f3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0f46f8b50e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	66f727e0f3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe

Executes dropped EXE 7 IoCs

pid	Process
1836	svoutse.exe
5028	svoutse.exe
2012	0f46f8b50e.exe
3196	66f727e0f3.exe
4848	2f1b627660.exe
5040	svoutse.exe
2864	svoutse.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	0f46f8b50e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	66f727e0f3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Wine	svoutse.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\66f727e0f3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\66f727e0f3.exe"	svoutse.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000025c76-67.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
3568	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe
1836	svoutse.exe
5028	svoutse.exe
2012	0f46f8b50e.exe
3196	66f727e0f3.exe
5040	svoutse.exe
2864	svoutse.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f46f8b50e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66f727e0f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f1b627660.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3568	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe
3568	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe
1836	svoutse.exe
1836	svoutse.exe
5028	svoutse.exe
5028	svoutse.exe
2012	0f46f8b50e.exe
2012	0f46f8b50e.exe
3196	66f727e0f3.exe
3196	66f727e0f3.exe
1560	msedge.exe
1560	msedge.exe
1384	msedge.exe
1384	msedge.exe
2368	identity_helper.exe
2368	identity_helper.exe
3756	msedge.exe
3756	msedge.exe
5040	svoutse.exe
5040	svoutse.exe
2864	svoutse.exe
2864	svoutse.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4848	2f1b627660.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3568	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
1384	msedge.exe
1384	msedge.exe
4848	2f1b627660.exe
1384	msedge.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe
4848	2f1b627660.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1836	3568	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe	78
PID 3568 wrote to memory of 1836	3568	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe	78
PID 3568 wrote to memory of 1836	3568	61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe	78
PID 1836 wrote to memory of 2012	1836	svoutse.exe	80
PID 1836 wrote to memory of 2012	1836	svoutse.exe	80
PID 1836 wrote to memory of 2012	1836	svoutse.exe	80
PID 1836 wrote to memory of 3196	1836	svoutse.exe	81
PID 1836 wrote to memory of 3196	1836	svoutse.exe	81
PID 1836 wrote to memory of 3196	1836	svoutse.exe	81
PID 1836 wrote to memory of 4848	1836	svoutse.exe	82
PID 1836 wrote to memory of 4848	1836	svoutse.exe	82
PID 1836 wrote to memory of 4848	1836	svoutse.exe	82
PID 4848 wrote to memory of 1384	4848	2f1b627660.exe	83
PID 4848 wrote to memory of 1384	4848	2f1b627660.exe	83
PID 1384 wrote to memory of 4184	1384	msedge.exe	84
PID 1384 wrote to memory of 4184	1384	msedge.exe	84
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 4688	1384	msedge.exe	85
PID 1384 wrote to memory of 1560	1384	msedge.exe	86
PID 1384 wrote to memory of 1560	1384	msedge.exe	86
PID 1384 wrote to memory of 2248	1384	msedge.exe	87
PID 1384 wrote to memory of 2248	1384	msedge.exe	87
PID 1384 wrote to memory of 2248	1384	msedge.exe	87
PID 1384 wrote to memory of 2248	1384	msedge.exe	87
PID 1384 wrote to memory of 2248	1384	msedge.exe	87
PID 1384 wrote to memory of 2248	1384	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe
"C:\Users\Admin\AppData\Local\Temp\61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Users\Admin\AppData\Roaming\1000026000\0f46f8b50e.exe
    "C:\Users\Admin\AppData\Roaming\1000026000\0f46f8b50e.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\1000030001\66f727e0f3.exe
    "C:\Users\Admin\AppData\Local\Temp\1000030001\66f727e0f3.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\1000033001\2f1b627660.exe
    "C:\Users\Admin\AppData\Local\Temp\1000033001\2f1b627660.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe9b9b3cb8,0x7ffe9b9b3cc8,0x7ffe9b9b3cd8
        5⤵
        
        PID:4184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
        5⤵
        
        PID:4688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
        5⤵
        
        PID:2248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        5⤵
        
        PID:4664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
        5⤵
        
        PID:2752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
        5⤵
        
        PID:2064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
        5⤵
        
        PID:2044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
        5⤵
        
        PID:1428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
        5⤵
        
        PID:2104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
        5⤵
        
        PID:1880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
        5⤵
        
        PID:4884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7212 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,8631891804910159939,7018827153049976486,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1996 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1520

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5040

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5094d9a8-08ef-461c-86c9-dc2702c29d1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\5094d9a8-08ef-461c-86c9-dc2702c29d1d.tmp
Size 9KB
SHA256 bc94157447642ba08637aa1616c36454c1885036a5b83c90a6dd1b3b34bc448d
MD5 878636bc2b18c94979ec7904951d1575
SHA1 d8a078f736730e2f140bb0b4ab606a2aa9e122f1
SHA512 171248bdf924b78427b08c988374492d5b46bd07e4b429e0304a8dd438fbbb4f1f5cf53d63be7ef03739a3f473f5fc7420b0f5c40735b72cd947d8af7d01a776
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASKr4Z4TeMRUGyDZIPfW7mh8AEb:e9iIxuERzA83h09RZxASIg43PyDePfWN
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 24fd28360d0e87538d5ecd9965bcbe637861c5e9c26e78967d8cc26b238683d1
MD5 3ff9f4d2384d10606fa0749b1d01988e
SHA1 46489dad51716fcaaeadf2a7ca8ec467114d7de3
SHA512 b2ab4eb0d3d91a5d96ccad17acb9a326493a1eced2a782df2173162df0151c6d21b1fbe0dc8ce04ad7f1eeb9db1834111d1200f223210027eceb2ab96c75a2ff
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 88a97cdc33921f410fdb2583e2f1728bffb90f79cb7de47489b10a93dd5f1d65
MD5 1b892f41650e061ceba5cea00cfa359d
SHA1 787bad5c3a99cbb5fc6cfb9840d3756295d4ac55
SHA512 4a593baafe34ec269c88d3ce2b6d103273de216b3741a809357d8956f1a78e5c42f78d8a89da643271c8b829b40ec43fc5e44288379c5f17bd759af42f3cc8eb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 03dfa34ac68cbeff320781052ebde8d9a1ecdb1d54be03b0f254e1279cf34a64
MD5 594eae4c3e14ba216cc8a224094b16e0
SHA1 55bd2e3ac36bd79ff5cbd2f39fbb2af1aa48fb6b
SHA512 c07fecbf3020a64747746c5786a43a0d2100febd194d20ae12c10da85ec8b2d30ae364f6d706f66ed445790632229d192947f29e848a679fa1e4d63a34b8bc04
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 03f11127106e0c0393f6e7695986f3231a59d63300a547c64f813bd9cc0914d0
MD5 0cb914f82e430629a8f39e19364e5272
SHA1 2140b52b2914bdf9113dbbf1f1a9f4e1a58412b8
SHA512 b13459326decb669c915623f744b97724f512317d46bb8a83477ad41c85d21dd7b5dd73921197a2b7466f61fcbc06dcef4147eaf79d8b1a97be2f35d87ead786
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5838de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index~RFe5838de.TMP
Size 48B
SHA256 7993b36f41f471252328c354277e85e8e0565145913a3c9266dc388a4d23c517
MD5 a40027f40dc442c6719bcd6418eb7227
SHA1 72036eb1775b9ca0bf49b9ca58f9aa77cb7a3d31
SHA512 e4596ed1f64ce1098cf58d6efa6218b65f5d8d2d0a29e79cff0e764953aefd4723ed57013a8e62ed7d7f28632174f9601f8e3d431ffb7a9c6dd1a55c2211df86
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 ace5200e61ea6594506a1ba05f108ce5e4bbc7b8539681c3a56262793137121d
MD5 594f9bf65e5591e91658f158b2777266
SHA1 f3d42324cbafe93bb17747e026c25f14dbdb004c
SHA512 4cdd6b51dfed445a32f095c74ce54da45210a108e889b360d687347f4e7d048b4fdfc61ca2469b7570f305eadb061d5a278c6b0503080fb2d732f78a098f018b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 c56fb749dedea125308bc951c46c02e443f0511454a7399d3b177d78c01470ae
MD5 58e7d0dce20ec9e854e2336cd7f4ed58
SHA1 dc1836288ecba5464c15fbc189f3449361ef46b2
SHA512 4c2968e0816e701b47f24dd733b31e881e0215fdac1b12dbe3371e993c949c5f5b9dcd70db0cfa7d0724c671838487df66bc91df2261773bd6245f2943d89a7d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 5bffd943e8925f2918ad40e580d23a3e0e29d5e90513036f73f1081c0a760b5b
MD5 bbdc1efd6ebc8f9ea06e89c3dfe32088
SHA1 7e89a1ad87e3e7c5d57129e97fe5b9389c685b12
SHA512 9af42067e4d185ffee348d8eb3b7d433517a555846e0b926d6a676cc0d08b5a159b62a454343b184d916caa6d448e9f4366eafa036468ef682cef685d1715471
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 3KB
SHA256 be11f1fc237a9e61305dec115ebed6a88d89fd935004ab53ea9e8726da71a062
MD5 8618dbba2ba4e030a5230a11272bc117
SHA1 f42986f4c32a3c7d2bc3708c12c9b0676c0d6754
SHA512 61b8ad71cd784b3cde18f3b9004e7038c2f44a5264119496b7d9bc9048322141ffeb94523296f68fef447dad704f9ca6c4da31f011c725971f4f12822355eb5b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 77295c0f5aaf5b6cc8673346b3d6f957662271634ae7d75710086ac477837657
MD5 bce54d411c885f3be0a2103a0ea1fe11
SHA1 d232aaf5107e010d352d391c7d3f4fe78baa505d
SHA512 af000177ff0bad762969a38b46620817f9db64187630f6b3d8b1aa42e4dc79e304a4ce60954bb6a01c1bc396e785eee52ae60b973e4b809029da62621fbe8931
SSDEEP 96:nc7v+Esc+BXkdrGS+sS0MoiVmdhKuI51jInwdiUBPVpAiX3wI3:nc7vK/BXkdEsS0MWKuI5hInwdtj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 c8a45aa16cc97e9f89a0901fb15085832c50b6472330fc9597e01e5a693c43d7
MD5 7751b920d51f6eaeacb6967221d239eb
SHA1 dc1c17654570c0add832e2c7b5599b57c228d4b9
SHA512 e01df7b30bc059d7d3cb762f4d43f72802e88eea99800f45d775fa47ba8e304abd27e6f82a7641070c6357578a236e8c44a8e9523ac2ab6ef9682bb543dd8a82
SSDEEP 96:nc7v+Esc+BXkdrGS+sS0MoiVmdhKuI51jInwziUBPVpAiX3wI3:nc7vK/BXkdEsS0MWKuI5hInwztj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57de5a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57de5a.TMP
Size 3KB
SHA256 0d1818ee57dbb410b904bbab3e9d96f0f1084b06c807a9c26c59a5f24f0afdf0
MD5 384a0eb1c34d6cc1cdeec11316619cbe
SHA1 c7018e600c59d4696c6ee89dee2717ecde2e52fb
SHA512 a54d513c0726e182f8d9e0a3793cf6c42fcdab253500f49ecf0a7e8544935913d0f634cc60de144627f5afb4bb8d78a0c05651bd46291033d09b0d1c1647864a
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 26KB
SHA256 4a059aa256f19c106858ae12261bb40aca4b835c143466e58eceb35b2fd8d8eb
MD5 6e58fa9ab7bae38e3b93e7f1e98d61af
SHA1 f5e5089122f013eb8c903926a69be31889b07e51
SHA512 ed9c5a12d4453bfacb4cb0d8c8e2630eb88e4065bf9ec230f30dc5709a07d519fe993a19f8a814926d20930b512ba661931d888df8d8b349219752af456a371f
SSDEEP 768:ntm2C80a21tWRcbQmL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV34wLl/mX0ZE3trUp4:ntm2C80a21tWRcbQmLu1jaK4wLpmkZEf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe580654.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe580654.TMP
Size 25KB
SHA256 2265467d8b40ccf300d2f193668ab60753ad9fc2fcbe2eaadede93e1b90c9229
MD5 13e437e9052ed16c6543c27941c56c8b
SHA1 aa1ee5f6dcd606bd97323f2d460e90c50bbc0386
SHA512 96be1179aa9ac5966a97bad0e58467e3bbadfc99185367ace7e761af22e54863470dc60cc23d6c8f7253350511416357afd0a5204a8ae955f55e53294494c857
SSDEEP 768:Fm2C80a21tWRvbQoL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3ywLl/mX0ZETtrUpew:Fm2C80a21tWRvbQoLu1jaKywLpmkZETG
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
Size 203B
SHA256 4ae3e7a42812ae06c724ec1b972a211d8fabec8a25dd8756b99879fe465a4d84
MD5 11a17364982782c23d886e9ac7b003e6
SHA1 18a93ac59207bf911d199c9e26f5998913258a00
SHA512 ca1757196cb2fb23f88a54ddd95b06fc81666c366d7ccea9c19b9fd64af03055b879f2a8f9848ec086e4777e989b8ea067b4ea8a8d846b5857f17dbb867ee92f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
Size 203B
SHA256 d3f2757b22807ae9a77101e7d66c9995a6bb4f977f404157b130315def211836
MD5 49b049eaf07a250bd72bab40a1b0c648
SHA1 d17478b760a2ff77afed610f5d0053314c0ca85e
SHA512 876b860613c80bb5036dc1636fe283ef8ab6b7f9905bd911ba6ce5fbba961f2dc48e941edd6ac3092de22061373cb3956257ec2f39b35238ed0f289966f4f49d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe590546.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe590546.TMP
Size 201B
SHA256 097f9b3fde2232de72ea4c87c0ede7bab8a2a3618bb7c9d3f98c1192118b051a
MD5 adf3491bcadd2d47d634f12846878e15
SHA1 2f00787eb3bdd3ba64a9890058060eccd1a35bb2
SHA512 f7a8e604d69c677d99ea42c6692e1e326ce221fabb3f6ad7bc32d165386f657cf952062cb08572684e9e8befaef8cf20eb77087632445fa31c59a8061e810b12
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

svoutse.exe

Path C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
Size 1.8MB
SHA256 61f4560b6b72647dd294d7b0cd361fe69fd640228ceed016782c6f1bddf06c8d
MD5 6e602c4dc0a37b461122a4e17472cb16
SHA1 3b6b6da1151c7df173be75dda271aacc9d938153
SHA512 4d67b14674bcb374ad479d021df45f47e3a9226185b629cec56b76025c45305ad8f480d1a9dc722aa8842548561e31e6c1d883f288a2f39129102211d1b4842d
SSDEEP 49152:BMO5vsnq7zpHsCPfOsIgtQ8VomBjJYdFAvcYtubMfp:Oq7SCes3mYTGWxtubMh
MD5 SHA1 SHA512 SSDEEP

Submit Download

2f1b627660.exe

Path C:\Users\Admin\AppData\Local\Temp\1000033001\2f1b627660.exe
Size 896KB
SHA256 b7f5d83ad4d4d1048d74fd01bb40d6115c4af450ae9e837415712fdd9235427d
MD5 65edbb2eec2aac0f7aef79e1a21ce955
SHA1 c27f2ed175902b3b2046efbe5181ee1b65c97d1c
SHA512 ddd9362c7892295d568bf38c2e15c3be256ca841d6986e0c55612c4b175a60d0c8286bf0c488df559776a10e23f35b927854ee897a7266d496334a40e0ff908f
SSDEEP 12288:MqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgasTY:MqDEvCTbMWu7rQYlBQcBiT6rprG8a8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

0f46f8b50e.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\0f46f8b50e.exe
Size 1.7MB
SHA256 ace2552b3703c501864780a7be926a0b257dde57dfa386d7fb04fc619a21b894
MD5 2195f8e30d841d8d760752698d972219
SHA1 42efae55910e3d1376c84cf22cc746849f43ebd1
SHA512 0bcfc7f9d5db488706890876bdb37ad0f704569b88e86046f7b366e5e6316848fc64f4f05aa4a3fab6b10994c97237dc5406216a8ce8350681e0f1776fa93c71
SSDEEP 24576:WH4LEU9WEntDg1uiXJZwHbwKimbBJ+rDou8z6oQQFqc3vJzNibUoa2CDb:WHrU9WEFgxJGHcKi++B8zXTRzAqD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk
Size 1KB
SHA256 762a74cce038244a6b1f3393441aa76624191a0f8339857fa4441e1a40ae4734
MD5 05663642409cb5e98f9bbb6d97ddca9e
SHA1 016b7045009b818149110db1859c09c2692cb67e
SHA512 f8059d3e2aa976a09cef6d2c3af61e07712f555087302515f9e30054c24a53c448fceb41539a4d2f428a5a0cf7ecad57e583a6a2ec6897e18d863cb570adde52
MD5 SHA1 SHA512

Submit Download

memory/1836-361-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-322-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-405-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-204-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-61-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-16-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-415-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-58-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-19-0x00000000005E1000-0x000000000060F000-memory.dmp

Download

memory/1836-289-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-428-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-425-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-377-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-81-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-416-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-21-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-20-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-350-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-351-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-418-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/1836-417-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/2012-42-0x0000000000550000-0x0000000000BEE000-memory.dmp

Download

memory/2012-60-0x0000000000550000-0x0000000000BEE000-memory.dmp

Download

memory/2864-420-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/2864-422-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/3196-59-0x0000000000F50000-0x00000000015EE000-memory.dmp

Download

memory/3196-62-0x0000000000F50000-0x00000000015EE000-memory.dmp

Download

memory/3568-3-0x0000000000200000-0x00000000006B3000-memory.dmp

Download

memory/3568-4-0x0000000000200000-0x00000000006B3000-memory.dmp

Download

memory/3568-18-0x0000000000200000-0x00000000006B3000-memory.dmp

Download

memory/3568-0-0x0000000000200000-0x00000000006B3000-memory.dmp

Download

memory/3568-2-0x0000000000201000-0x000000000022F000-memory.dmp

Download

memory/3568-1-0x0000000077406000-0x0000000077408000-memory.dmp

Download

memory/5028-23-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/5028-24-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/5028-25-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/5028-26-0x00000000005E1000-0x000000000060F000-memory.dmp

Download

memory/5040-365-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download

memory/5040-363-0x00000000005E0000-0x0000000000A93000-memory.dmp

Download