amadey | 8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08/09/2024, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
Size 1.8MB
Sample240908-l2hlhszcmp
SHA256 8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed
MD5 c77aec68cde01c2087568c637c107bf9
SHA1 78a91cc383661a50b83384f7182eba10fdf1a633
SHA512 0d431f06cd4b4a576ff1d58a1b746da54793dc85814c1b6800396cca33413278ee3d1639ba3735fca1031c93a8d2e9202b447627f76eb804868213c8adeab5b3
SSDEEP 24576:+U0RrYiFH/xAO9g2zb6V8eS6sMi/8pey88rXz8kXtbYkiRlZkrbEd0W:+7rYiF2ONv6CepsMi/qICXz8Cs3l+E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc c7817d rave discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

http://185.215.113.103

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0cb7252122.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e0cb6b6a5b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0cb7252122.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e0cb6b6a5b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e0cb6b6a5b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0cb7252122.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe

Executes dropped EXE 7 IoCs

pid	Process
4608	svoutse.exe
1140	0cb7252122.exe
3524	e0cb6b6a5b.exe
1220	d8e02b7a9d.exe
2856	svoutse.exe
5904	svoutse.exe
4884	svoutse.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	0cb7252122.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine	e0cb6b6a5b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\e0cb6b6a5b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\e0cb6b6a5b.exe"	svoutse.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000025c68-67.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
3188	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
4608	svoutse.exe
1140	0cb7252122.exe
3524	e0cb6b6a5b.exe
2856	svoutse.exe
5904	svoutse.exe
4884	svoutse.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8e02b7a9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cb7252122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0cb6b6a5b.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
3188	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
3188	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
4608	svoutse.exe
4608	svoutse.exe
1140	0cb7252122.exe
1140	0cb7252122.exe
3524	e0cb6b6a5b.exe
3524	e0cb6b6a5b.exe
2292	msedge.exe
2292	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
1032	msedge.exe
1032	msedge.exe
2912	identity_helper.exe
2912	identity_helper.exe
2856	svoutse.exe
2856	svoutse.exe
5904	svoutse.exe
5904	svoutse.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
4884	svoutse.exe
4884	svoutse.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1220	d8e02b7a9d.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3188	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
3408	msedge.exe
3408	msedge.exe
1220	d8e02b7a9d.exe
3408	msedge.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe
1220	d8e02b7a9d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 4608	3188	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe	81
PID 3188 wrote to memory of 4608	3188	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe	81
PID 3188 wrote to memory of 4608	3188	8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe	81
PID 4608 wrote to memory of 1140	4608	svoutse.exe	82
PID 4608 wrote to memory of 1140	4608	svoutse.exe	82
PID 4608 wrote to memory of 1140	4608	svoutse.exe	82
PID 4608 wrote to memory of 3524	4608	svoutse.exe	83
PID 4608 wrote to memory of 3524	4608	svoutse.exe	83
PID 4608 wrote to memory of 3524	4608	svoutse.exe	83
PID 4608 wrote to memory of 1220	4608	svoutse.exe	84
PID 4608 wrote to memory of 1220	4608	svoutse.exe	84
PID 4608 wrote to memory of 1220	4608	svoutse.exe	84
PID 1220 wrote to memory of 3408	1220	d8e02b7a9d.exe	85
PID 1220 wrote to memory of 3408	1220	d8e02b7a9d.exe	85
PID 3408 wrote to memory of 2004	3408	msedge.exe	86
PID 3408 wrote to memory of 2004	3408	msedge.exe	86
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 3128	3408	msedge.exe	87
PID 3408 wrote to memory of 2292	3408	msedge.exe	88
PID 3408 wrote to memory of 2292	3408	msedge.exe	88
PID 3408 wrote to memory of 4412	3408	msedge.exe	89
PID 3408 wrote to memory of 4412	3408	msedge.exe	89
PID 3408 wrote to memory of 4412	3408	msedge.exe	89
PID 3408 wrote to memory of 4412	3408	msedge.exe	89
PID 3408 wrote to memory of 4412	3408	msedge.exe	89
PID 3408 wrote to memory of 4412	3408	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe
"C:\Users\Admin\AppData\Local\Temp\8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Roaming\1000026000\0cb7252122.exe
    "C:\Users\Admin\AppData\Roaming\1000026000\0cb7252122.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1140
- - C:\Users\Admin\AppData\Local\Temp\1000030001\e0cb6b6a5b.exe
    "C:\Users\Admin\AppData\Local\Temp\1000030001\e0cb6b6a5b.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\1000033001\d8e02b7a9d.exe
    "C:\Users\Admin\AppData\Local\Temp\1000033001\d8e02b7a9d.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffddae93cb8,0x7ffddae93cc8,0x7ffddae93cd8
        5⤵
        
        PID:2004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
        5⤵
        
        PID:3128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
        5⤵
        
        PID:4412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:2356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        
        PID:1336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
        5⤵
        
        PID:3068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
        5⤵
        
        PID:4972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
        5⤵
        
        PID:3964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
        5⤵
        
        PID:4288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
        5⤵
        
        PID:4924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
        5⤵
        
        PID:4944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,14006214994035686294,4899316094703297229,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3868 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2856

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5904

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 a0c58740dbd730fd71d19ea0016c168138016f9ed9c556408e904fb469071a45
MD5 32f144d2b178693677261f7c14d37d85
SHA1 e57b5870c469bfd3b6f21d4d2b8db14b60a1289b
SHA512 a642c1a6981f3a7e0dfcb5e12d44334a9d4c3f810e6a79be0e7d219b5df3757def140ce41dc9e874c812b4e2e7d65bd459480c1367d98be527f5342d52432de8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 f92ce62dc6b373bdb36f1380590bd2166ad0784a52a71a6adf5381f8debc815a
MD5 9b3bb5bb617867e9eeaa4883f820f58c
SHA1 a17f42a6ceb497f7f877bc66a23dc77122d036e2
SHA512 d36c2205e04c94cabe0c17aa8513e940c7581aad9699bc82cd756b5451a9b699381a58369c08cead427dbc2663a974efdc0a5b17b3a965016542e9048ee40425
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 494d5d503cd0dbffb2de68c9f1018fb5ab2754303118691cac8cf6e2e0f81452
MD5 6cb0333ac9aac485dff12d4b3e061fbe
SHA1 7e6417493f4dbeb8e446647e173781b2ca65dab2
SHA512 5e47a452f0f7697c5fb4878b470159285a4ec1121b022ef9b10768ff6c55e22fd0cbb0bd05e00f371b38ebd6d79853f39b6e9b420c0a4e44f12d47f5dbb5fd98
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 0f498cac0bb8a7ca5c65e828141f51056ffa211ff4e70010637921150e894cd6
MD5 e220e5c525c4502012fe66bb2d41c3a2
SHA1 3cf82790c775f2282e2382b7a82fbe4578369a68
SHA512 41e513681e355a751ddacf789be167d61e97e6e0af2e5742ee94590dd7f453d2464415d79b4c0efa7f6ae3e621bd63699d571b13c00f28c2840da9d1cbe74f73
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 565e9c0d673b5a007dc345de0eab6b433ff3fe5beb90a5ead277aab76263d423
MD5 46c775db56545c4301bbebdf8b3d4283
SHA1 55fb39eda47e5228432e6afe2dba407addd5cccc
SHA512 ec330034bb89f0f7fa38ae344d810fa5c7a3b64b18371bedbb787b679af8574d382388a4b9ba3bc5e8ffed2cf6f609686e3a21666e2a07459b9b0c4a52db4f0a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 87606b747f201b3951cef241159af44b053639b66dcd94120229b37eb3e7a141
MD5 55b4832c5e6c8caf2cd1389df1c5adb6
SHA1 1871dd314d17bce01d6ec647bac6b1c4178ac7a6
SHA512 8ed45dc7a9798f305b2fa81120d3fee85a67bec2f60b5035fd042ae0537060da0d1588520bb49f6833bb8f78bfdd1ee68286b6aca9e281199a1fbaae8729f004
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 784ac4b6ac68f5d6872b6a581d00a8f843e42628b868a14391c0237a03022dc6
MD5 96b51d1a89099ff7af420762bb46ccd6
SHA1 119a7db9d38a11f99d4102dba26872049ac1b8a6
SHA512 ff2f0ca7130d1b188618cdad787e94667fc9278391e43b095b4ccd3d3a9b3c19ba1a1ebce620dba82d98c5b927984d4cd09d6cd933ce1876f3069fe6c4bba9ae
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 3KB
SHA256 ae0995f5ace82ee4600223e9a6b0cd6f6b50aad3afa39c8f642bdfab26ef0838
MD5 0e60b265513093ff1feedad19d37145a
SHA1 4ca1f5a0e8e5f61813d02b2ed8b934e866792847
SHA512 7166418eb23ff0fe44088c2216e810ace021cc59f5fdd06d4b92d06b9f1c84574c1b46a5f93b8630a16b6e575f0634d5a9599c06ef2c74613ed72ab93f869e7a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 695369e9094f316d5d61341ee60a7e75a455f208b8ff8b736abf7b847108f13f
MD5 6a2da050e083ac5b3b50ae8efbe2e6c2
SHA1 83924da56e10ce1649ed716a2fcf75da89fc4344
SHA512 61284407cf9ea7c9b9acb7681903aa21d82d50c87dad5c34097fedceeb682130844fedaad556c7b9524de241afe7e0f3eb4132e30192ca630e8af464535d9745
SSDEEP 96:n/Vv+EuYDkoQSVZ0MoiVmdgu71jIdKUBPVpAiX3wI3:n/VvJDko1Z0Mru7hId1j93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 425eca428cca463c44bd9ccd3dae9ae71d5b2bf40ae9a3bb24528c2ee6991d14
MD5 2fd73c5b4a416d2da4af8c4a5f36fd8c
SHA1 c6504f44c938fb56cef41659cae13ce3a8dca3d8
SHA512 eeab68b49d69e5d7118ca033d2fb30210b548a81072fd82440c5270de33376eca5aab01c165249ee6cb8653524fe571928f048c43e73be21172ec7e6f1245da4
SSDEEP 96:n/Vv+EuYDkoQSVZ0MoiVmdgu71jIrKUBPVpAiX3wI3:n/VvJDko1Z0Mru7hIr1j93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57c8be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57c8be.TMP
Size 3KB
SHA256 e0b9ca55f6636e9a5e221b1a02dfcdea007fd7821673d57bbadecc63fcbdd7dc
MD5 4d6cd8551ff58a4a755901cc2ef353ee
SHA1 effcbc38a3b1abb4d8e586632ab9a5bc6f55befe
SHA512 359bbd02a4de4f9cd8f1bf068969f790a8fd77a641375a3bb7bc7bedb530868294da0800b44e153ddc44622898b7fa012a66c518c474aa5c127480eb9a5e490d
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 26KB
SHA256 3fd6ae0abebfdcb75df8869c4449781fa293a084f3632ec72699324c2096b05f
MD5 ecd889aa2c0215b42663bb9bbb773344
SHA1 8f34047a5ed07bd6303d0e912d062f30b5d94881
SHA512 a23fc0e45903be4a0787489a75f1ecdbbf6d686a5e44eef613e1cb7f1440c9b39a0749faa4ad6dbe0b7b464001ef48c439e39d09fee1d164f1feca74179b32d0
SSDEEP 768:n4B8v2LWROQG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33Ll/q0WdrUp31A:n4B8v2LWROQGu1jaK3LpzW2p31A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe57f07a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57f07a.TMP
Size 25KB
SHA256 7a13d1b73a05dad0b96561330a6052af8745e77d18521744cd91de011cc46be7
MD5 f40a7a9111862e741694387559cc21aa
SHA1 e923d8ee0e7c338aa31c8d0be4b2f596d856fb38
SHA512 801d0b168d127a7065c8664ec6268e0d5b88d37a6e4303bb9350aa31e3650b7c281b51d07f52bbf81afef20d6a14c8fd2c77801e36860db10e6972d85f1db493
SSDEEP 768:gB8v2LWRjQs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3xLl/q0WxrUp33m:gB8v2LWRjQsu1jaKxLpzW6p33m
MD5 SHA1 SHA512 SSDEEP

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 fa3d342f030d34d3150d98986343e6686a20c848f382929854a0378b70d92e25
MD5 f692f36f4cda67f1e1f80b39a09de7a4
SHA1 f33928f38eed71bd11baf48c3128039fdf5fc2bd
SHA512 25ef0c6e34394c2c08de090e338400b1f4b042e90340a812867e1bee183e981c17b1920011339f2947c92ed4512f51c619f4d9f413fe2a98f4cc8dfffaa0619c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
Size 203B
SHA256 d4e17472c148b6754e5d937d60683c60215caf252f053d091a498b9444899f0e
MD5 633ac2e500a19495254454767f228683
SHA1 fa508e47678fd3911f72bf92452e1ea0262d42c0
SHA512 91a55241907b6aeac73b1901aa93bf02281e2064ffe1d36f31b03f98149b9edd56e2ee2946aa1ed62c125346b5574e6350e690cfee58137d7a0d745d2a63cd9a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58ea7a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58ea7a.TMP
Size 203B
SHA256 e91f668520dcc7e9c9837077aeaa0b02ca15eed22595256f5b63f5bde8f1bfa6
MD5 7ad843657021839db1ced217ae417b5a
SHA1 c8cd12e9c4403da0f4cd2c8f1ec2a9ab1e541e48
SHA512 7df1f9c77609e1d919ecc169414eeb5b0a275fd4e41c6905ccfb8240834e6322169d07a5844993bdde78f0032c4869fa13bcbd5b9cd4dd01c841b72c71f09e5d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

b4d6d36b-1f5f-45ca-b5b4-4285d70162af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\b4d6d36b-1f5f-45ca-b5b4-4285d70162af.tmp
Size 9KB
SHA256 ec534e9a0792928fa2d253248928e20c71213521358e0b268818f3336ff4591f
MD5 e2b87bf26f70a879cb856649ccc6c33f
SHA1 d0494a73dd2fe650f63cb4548cfd931528ab3c9b
SHA512 4307c567936cd82e25e38af333c79501b293c292cb9d4b97e9168a73eeea986ce7a2c58228e40acb03dfc36b0c02a6f4ee348a7a5132f17975d6a1277ad87121
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASpsaEeMRUSQDMrW7mh8AEdv1A:e9iIxuERzA83h09RZxASpsjZOMrW7m8c
MD5 SHA1 SHA512 SSDEEP

Submit Download

svoutse.exe

Path C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
Size 1.8MB
SHA256 8b92fc7fe77b33e3b519b1f2ce71819fb59986087b683a331cc6364b30b3feed
MD5 c77aec68cde01c2087568c637c107bf9
SHA1 78a91cc383661a50b83384f7182eba10fdf1a633
SHA512 0d431f06cd4b4a576ff1d58a1b746da54793dc85814c1b6800396cca33413278ee3d1639ba3735fca1031c93a8d2e9202b447627f76eb804868213c8adeab5b3
SSDEEP 24576:+U0RrYiFH/xAO9g2zb6V8eS6sMi/8pey88rXz8kXtbYkiRlZkrbEd0W:+7rYiF2ONv6CepsMi/qICXz8Cs3l+E
MD5 SHA1 SHA512 SSDEEP

Submit Download

d8e02b7a9d.exe

Path C:\Users\Admin\AppData\Local\Temp\1000033001\d8e02b7a9d.exe
Size 896KB
SHA256 15c6801051ae4f4ace43b481b2c0f2d7b21d412bcb1ed1f604bd845d59f0e4d8
MD5 3ce9babc03b3b3fd7e05e68d7a3f43da
SHA1 ced47d47d7c76928881ff4550a8b97a0324f7ecf
SHA512 f07b72283ea534e9b258229fde59e36964cd64f1a366d9fd9467af7d3bc3718dd3a27e19f127ae9c1819fee96e03ad4c291d60f1e7b74658b4a4b34bd9f3e568
SSDEEP 12288:7qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaoTY:7qDEvCTbMWu7rQYlBQcBiT6rprG8awY
MD5 SHA1 SHA512 SSDEEP

Submit Download

0cb7252122.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\0cb7252122.exe
Size 1.7MB
SHA256 407c7e945453f8b416b70eb3cab6e575833ea8082edf6f38b6f91325fa756a8f
MD5 13a7ce03877b76aeae5920065b34a7ec
SHA1 ead077227858fb9404d1857d25567849b9e77c92
SHA512 fdf6c139a89a9c988fea0620a81718dca1a64bd3ae07fb4bc097b0ccb3f3ebee057a82f72922b66937f031ff29a5ac08e2aad32d4c1cdd099426bb52090243bf
SSDEEP 49152:NRB3UgNCnW0CZ3KcYveQEgRuIo6/iTDi/2nuVViWQtp:xU2Z3KcYjHRuTHiYehQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk
Size 1KB
SHA256 1aafb47021b9f67463f3c467d56b3bc17aa1e1f11c15f2ba9296091e05b86ef1
MD5 3e0c3a0a3ac298b14d0b529112012dea
SHA1 47008518b93af5fae05c926bfac8bdbc32d63205
SHA512 d3eb3ea335fd90fe1bf4d44268c6d42915cb316b67b45fd05cba546f139266c112d3773abc832d7cbc245515ab93d8ffeef8cb7c110711ae73ba1337e06b66ec
MD5 SHA1 SHA512

Submit Download

BVR8GYEMHDMKR627AQP3.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BVR8GYEMHDMKR627AQP3.temp
Size 3KB
SHA256 3a3a42e448dbb7d699a047acc16f36cc218b4e4d041fdd62715df9aaeae11743
MD5 6db75c5cd40b47e76ec4de579be99c5e
SHA1 d55008296056bd8415a13622ccba565b7f9736e4
SHA512 510da31c28520f7f226c77a61411a71ee677eb11fe74314bf44a0e92dfe37d47d04331812ad698656ca823f22f43d62d413a819ddc14276172082fec769578ed
MD5 SHA1 SHA512

Submit Download

memory/1140-55-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Download

memory/1140-37-0x0000000000660000-0x0000000000CEA000-memory.dmp

Download

memory/1140-60-0x0000000000660000-0x0000000000CEA000-memory.dmp

Download

memory/1140-57-0x0000000000661000-0x0000000000675000-memory.dmp

Download

memory/2856-265-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/2856-266-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/3188-1-0x00000000771A6000-0x00000000771A8000-memory.dmp

Download

memory/3188-0-0x00000000005B0000-0x0000000000A74000-memory.dmp

Download

memory/3188-2-0x00000000005B1000-0x00000000005DF000-memory.dmp

Download

memory/3188-3-0x00000000005B0000-0x0000000000A74000-memory.dmp

Download

memory/3188-4-0x00000000005B0000-0x0000000000A74000-memory.dmp

Download

memory/3188-18-0x00000000005B0000-0x0000000000A74000-memory.dmp

Download

memory/3524-58-0x0000000000770000-0x0000000000DFA000-memory.dmp

Download

memory/3524-61-0x0000000000770000-0x0000000000DFA000-memory.dmp

Download

memory/4608-16-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-378-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-20-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-19-0x00000000000E1000-0x000000000010F000-memory.dmp

Download

memory/4608-354-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-355-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-356-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-62-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-22-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-21-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-326-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-47-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-366-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-267-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-56-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-418-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-419-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-420-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-421-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-422-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4608-425-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/4884-427-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download

memory/5904-381-0x00000000000E0000-0x00000000005A4000-memory.dmp

Download