amadey | 0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/09/2024, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
Size 1.8MB
Sample240909-mm35cawcld
SHA256 0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd
MD5 0169ee4d4e6b3186975108ef0dca0ea7
SHA1 1346be6f0a2de26b0eea593a734f406b7d21e7ca
SHA512 7f8e9e2c14cf6dee704b87c8b6b97d795bf630449bb819fe5ba03fb5dc6ec58ebfa6629568d9d947778c15626f052137cc4eeffceb459aa73a7347c1ee552fc6
SSDEEP 49152:A83/W2BHKl6IX2nekyKE/ZOP0ZALdtLtwuR:B3emnHwOsALPtwuR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc c7817d rave discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

http://185.215.113.103

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	276a7a2f06.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	249c537054.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	249c537054.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	249c537054.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	276a7a2f06.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	276a7a2f06.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe

Executes dropped EXE 7 IoCs

pid	Process
1868	svoutse.exe
2680	svoutse.exe
4668	276a7a2f06.exe
1968	249c537054.exe
1188	249c537054.exe
2300	svoutse.exe
3888	svoutse.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	249c537054.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Wine	276a7a2f06.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Run\249c537054.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\249c537054.exe"	svoutse.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0004000000025b6b-74.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
3332	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
1868	svoutse.exe
2680	svoutse.exe
4668	276a7a2f06.exe
1968	249c537054.exe
2300	svoutse.exe
3888	svoutse.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	276a7a2f06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	249c537054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	249c537054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3332	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
3332	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
1868	svoutse.exe
1868	svoutse.exe
2680	svoutse.exe
2680	svoutse.exe
4668	276a7a2f06.exe
4668	276a7a2f06.exe
1968	249c537054.exe
1968	249c537054.exe
4616	msedge.exe
4616	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1364	msedge.exe
1364	msedge.exe
4736	identity_helper.exe
4736	identity_helper.exe
2300	svoutse.exe
2300	svoutse.exe
3888	svoutse.exe
3888	svoutse.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1188	249c537054.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3332	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
1188	249c537054.exe
1188	249c537054.exe
1516	msedge.exe
1516	msedge.exe
1188	249c537054.exe
1516	msedge.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe
1188	249c537054.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 1868	3332	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe	81
PID 3332 wrote to memory of 1868	3332	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe	81
PID 3332 wrote to memory of 1868	3332	0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe	81
PID 1868 wrote to memory of 4668	1868	svoutse.exe	83
PID 1868 wrote to memory of 4668	1868	svoutse.exe	83
PID 1868 wrote to memory of 4668	1868	svoutse.exe	83
PID 1868 wrote to memory of 1968	1868	svoutse.exe	84
PID 1868 wrote to memory of 1968	1868	svoutse.exe	84
PID 1868 wrote to memory of 1968	1868	svoutse.exe	84
PID 1868 wrote to memory of 1188	1868	svoutse.exe	85
PID 1868 wrote to memory of 1188	1868	svoutse.exe	85
PID 1868 wrote to memory of 1188	1868	svoutse.exe	85
PID 1188 wrote to memory of 1516	1188	249c537054.exe	86
PID 1188 wrote to memory of 1516	1188	249c537054.exe	86
PID 1516 wrote to memory of 1444	1516	msedge.exe	87
PID 1516 wrote to memory of 1444	1516	msedge.exe	87
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 764	1516	msedge.exe	88
PID 1516 wrote to memory of 4616	1516	msedge.exe	89
PID 1516 wrote to memory of 4616	1516	msedge.exe	89
PID 1516 wrote to memory of 3816	1516	msedge.exe	90
PID 1516 wrote to memory of 3816	1516	msedge.exe	90
PID 1516 wrote to memory of 3816	1516	msedge.exe	90
PID 1516 wrote to memory of 3816	1516	msedge.exe	90
PID 1516 wrote to memory of 3816	1516	msedge.exe	90
PID 1516 wrote to memory of 3816	1516	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe
"C:\Users\Admin\AppData\Local\Temp\0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Users\Admin\AppData\Roaming\1000026000\276a7a2f06.exe
    "C:\Users\Admin\AppData\Roaming\1000026000\276a7a2f06.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\1000030001\249c537054.exe
    "C:\Users\Admin\AppData\Local\Temp\1000030001\249c537054.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\1000033001\249c537054.exe
    "C:\Users\Admin\AppData\Local\Temp\1000033001\249c537054.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9fdd73cb8,0x7ff9fdd73cc8,0x7ff9fdd73cd8
        5⤵
        
        PID:1444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
        5⤵
        
        PID:764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
        5⤵
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
        5⤵
        
        PID:4252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        
        PID:1168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
        5⤵
        
        PID:2968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
        5⤵
        
        PID:4852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
        5⤵
        
        PID:3716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
        5⤵
        
        PID:1512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
        5⤵
        
        PID:4048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
        5⤵
        
        PID:3288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,15070018462792243642,8777156905661471649,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4736

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2300

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1106ca78-c109-4fc7-901a-97747fb98ad9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\1106ca78-c109-4fc7-901a-97747fb98ad9.tmp
Size 9KB
SHA256 0414ac026fa85ab4fe52889eda9d6de1e742e67caa388301e33e51d7de0f0edf
MD5 2c9b83f5b33b726a2aa4e17f30072923
SHA1 b17a0d1df467545fc493bf86d3d1050cab44d7f2
SHA512 4ae1db2986003211379639fc8d42b8dce79e09287028d9bb9098f9c2af9b7a0a2d7cd24b7f647309b901483416a79d4e4aca747613c5f74ab40e7e33f5eab7de
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASuleMRUschdwmVea0BLX+xJ96N:e9iIxuERzA83h09RZxASuR7c8mEa05OW
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 84ce6f1350843d9e91356f677e53aa9b81c8e820994fb07d89f2a9aa40424aa0
MD5 7870e3c829c48d47d409d521ad6d1caa
SHA1 6d9ac8aa74b1f4ef2a16314ac3ad9c5228fd4275
SHA512 138084b9d1ed5f851330b771bc53a7326f62a48082503cc339201ba26a317f6378d0f5b3c8a4f8172beb882db883b2b55003ce21d7bccb45dc9ef679ee5a048e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 8040d6316dd916761fa3e62fe67335d699f9652f39fc798cc5c59926956b7e01
MD5 24ed041b9bef9c01744183659d25b861
SHA1 65e94bdf7b2f10c2cde465deb178fe2b232c4018
SHA512 f88edbc3e91550b6662cc572529d33b7761794bc9a21b53788540b4baee0b812fade39667deaf9a43a98f35255e64874fb5f05144f8c384a6fe599197bf68074
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 25972195a7322ac1869d67c816b08fc0b6e37577365b5721cca84640699cc004
MD5 08d8644b1760ef343159eb55f68a697a
SHA1 27f2c35080003b72156b82e4c2c28ca9d2254f0c
SHA512 d6e6cf7fb39c34fcb5838da0ecb7a4241d911ce30db73aaef78b5a37c9a8a54b2f738401a710cad2d8a51e21f0eb02c4d04c3edcbf2184e681c88f93373ad083
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2d2a4428c8c3d54b010fa21732cf621b4203a23fefa76fce639d6ce663bf4c5a
MD5 b3824f04e3013be2a5dab7950a5b9230
SHA1 4343adda7d745a7ef7c9ab962dfb936a32de6da2
SHA512 d1eff8fdf9b51eb0987c3589babd0a83994af310797183717e042070d2ffdb5126f7cd2754eb8358469370538be4b432e4a73ef427ee3522a71cff33191c752d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 3b7c613c828290f335770b561a1d2b5008d4809fdf56bb77e62f54413ff53e17
MD5 da50a990dacdff45508ae2cbf5aa4be4
SHA1 0aab3a1d05b87ddf3096fcd0981f3764f050c92c
SHA512 75dff4a42b204ad7e00c9a4c7564a397182cecbfc0e13ea8f201a50fe89d10f53e52c856f0235b458227bd72d6fc8d8ace3e6bbd4998f657648ad81e60d3ab9d
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 1a6c70d7cff330b0f31b7c4016288c0749dcf068c7894a20540f4af392fb16ea
MD5 2064131ca2bb16696a6c71196aac3241
SHA1 08696afe18461eb82df671a2e798ff2f26c8d314
SHA512 c8346a44244a14267293c7ba2b3a63e5a3c7f35e68063fdcc6a37b99050e94a2fcf69594cdc66cda0a46136b58aee8a79508fd619c9daa20c5113657997b3168
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 776f756b7400a5062a7c02d8e7c2b42dda9f93f2ef46a3c6cd1979bd7f7c14ff
MD5 ff8b596d9b97723e4cbe3c86b5091e40
SHA1 5d0ff1c303b5077759228739e386d5bfcb679344
SHA512 d4f9f748088f538257fe76c253a6caa466112337d0d134d306ca6c3c5e35a5af395b01c7b28565284641284061cf5a981cd3b785522cd2b39b4602a3bfe34a7a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 3KB
SHA256 824359e9bd82139898c5cfcf9166ba9638bdea2cbae265e8c557a8e72e9389d8
MD5 a63b78a95839c3dd44a4f9e4f09fe1ba
SHA1 ea20eaeae725601afee15289fff76fda2035b3bc
SHA512 7702452674416959dec2f712a7a6b4d4c4696d248923462257b825e143cbaa62c30d7d692630189ec0e6f79aee4125ed5a9a66cd9b646781ccba1e853951f02d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 811065ca384dc3f9449be440638dc4e84ada1138b4e16a1f79183af0a8c3cdbd
MD5 712fde9778a460b989e9619d268e26eb
SHA1 649d64b74fb9efe6c60fee96d8ea8332ea7e922d
SHA512 8d59fbac0be7240b8daf9712cace95e8dd8d258922befa98335c1bfc4b1755731b4235a3170d11794fae8657bd608f0e777f97dbf6d29b9f7c32984f31448049
SSDEEP 96:nLv+Ea50kpAPS4Vf0MoiVmdsuB1jIQFUBPVpAiX3wI3:nLvY0kOTVf0M3uBhIQGj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 bac69eb20bfb30ea80731143a53b1c8c3de23b75a928e1133dbd2a37b46a6cba
MD5 27039ce0679991d7c5fd9041e76380ed
SHA1 5f5846e345101c332c0054868721619fe9130da6
SHA512 de2eda9f3059968c377c3794aaec816f9a1268a573f6951a943aee015e6dd7d971be2460508aa569df5c0d58837c079118e98e2cb51f97fc85bbe0ac343dc190
SSDEEP 96:nLv+Ea50kpAPS4Vf0MoiVmdsuB1jIRUBPVpAiX3wI3:nLvY0kOTVf0M3uBhIKj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe58c232.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe58c232.TMP
Size 3KB
SHA256 08a6c8de38683ab1abb2676fa0cae153a8d82a5bd0039a7e556b5df86c1bfffd
MD5 00dc20871a304a0acb20e57be4a4b143
SHA1 9c8ec3c3aaa3dbc35749eaa2a6c1b5644ed17ca1
SHA512 7dec2a24c70683c169744bbf4a8972625de72d8d35a08958ecd5f869531e9b73a16cada98d1ded6b4263e650051d1adff7c66afa1c63b77f464235dc5182fecf
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 26KB
SHA256 5f61021f99cfabf65b5659baf09b65b7ea5cca544aebb8b9ad4ff589a657feef
MD5 3b73bfe419246ab8ebb39e5a679d2d7e
SHA1 52ee155a6745f5b450aa1ef362ed0fed3ca27c40
SHA512 fe3f47e7d5f24a01cc81241fed2ec2e8085ec2f942760219695b41d14de74616497dc9f0221c6d0e8369e71fcfd0b96fbceb3f02600421b6f6d7e1ee3cba0d79
SSDEEP 768:nMh8P2nWRuQA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BLl/t06hrUpju:nMh8P2nWRuQAu1jaKBLpq6Kpju
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe58e9af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe58e9af.TMP
Size 25KB
SHA256 60f586805cdccccbeba6ad7e03e995e2d346582ae8c645fc516d22dea96d624a
MD5 62f7b005ec2f98afbeabae0c5974bc4c
SHA1 8485f51af157eedbda2cbda7eaea7fd85f8d48d7
SHA512 dd0556f1abb831cb5e9d663324ca9574700c87b88c2b74b4a7e59e521814acf6e7a73d3b41078dffc557e11e4a5e187fdafbe3f3cb422ad14d94dfb56bd88c4e
SSDEEP 768:Uh8P2nWRHQi8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fLl/t06NrUpju:Uh8P2nWRHQiu1jaKfLpq6Gpju
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
Size 203B
SHA256 e7cba0a59c4536377f3bc1ecda769770380887bdc6c5d9637526aa7b2abad9d3
MD5 b935a7d619351c9cfae3fc1af54a0fba
SHA1 15fe7fa327f1e8c378dcde3de4a7d0be08eb38e8
SHA512 413ee1b9f7ac76ce75fb00cf693f38764d43f9f36f5a58515d9c5de2d73eb4108c1d62ec4f936970a5f9ad07934c474332fea0d4e5179a1839f1d3be9d63b652
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe59e759.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe59e759.TMP
Size 203B
SHA256 2970278974185582b46adb9675ee3a341e5fb702671166d706afdb6af0b427a9
MD5 a007287ce091d30daeb9ab18cbc08fbe
SHA1 294568e5f2e28332f30a6256bcde8f096a8eef9d
SHA512 a9d29dc69fa91aa65608fb21fc14f2d406574692491fc4a7c2f97862fd532609bc7d335b04921202eedf76af1f6ba80e138241b4f60701c7be0f662b7ea75516
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

svoutse.exe

Path C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
Size 1.8MB
SHA256 0ccf2d1ef66fa2af716feb358fe2fff14cf24235892c23f8d92857eed695babd
MD5 0169ee4d4e6b3186975108ef0dca0ea7
SHA1 1346be6f0a2de26b0eea593a734f406b7d21e7ca
SHA512 7f8e9e2c14cf6dee704b87c8b6b97d795bf630449bb819fe5ba03fb5dc6ec58ebfa6629568d9d947778c15626f052137cc4eeffceb459aa73a7347c1ee552fc6
SSDEEP 49152:A83/W2BHKl6IX2nekyKE/ZOP0ZALdtLtwuR:B3emnHwOsALPtwuR
MD5 SHA1 SHA512 SSDEEP

Submit Download

249c537054.exe

Path C:\Users\Admin\AppData\Local\Temp\1000033001\249c537054.exe
Size 896KB
SHA256 adf208ac660095b79a3830a6d4d6a80d419f6b5374bff6641cccf7e82d4464fa
MD5 3958a8cda22bcad619f098ce1d203bc0
SHA1 33f295c26f5eff47f6b2cef4649eecc359674bd7
SHA512 156873ea642a764571c3383400b1b5e85243642155ac4b17e03392449ac8f2db1d2dc74d7db799bb7aa8684c87cc54fca231ea1fb58f7ba1d3c56388ab432e3e
SSDEEP 12288:mqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaoTY:mqDEvCTbMWu7rQYlBQcBiT6rprG8awY
MD5 SHA1 SHA512 SSDEEP

Submit Download

276a7a2f06.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\276a7a2f06.exe
Size 1.7MB
SHA256 d2933695af37c10388ff102f6193b2749545ece3b2e13dbc8c3c715396658423
MD5 fce0e8e783b3a5376920ae6a4ecebe77
SHA1 8c545284615c0675ce9136895ab7d510aef5bbb2
SHA512 33e2fe5f66f465cf584476efaff5642cbc6c056324293d6b0532c9d5fb707ac7e13f29d4f185ca5f609da8d5fe4219dac314ba43927c836c84dcfa02fc93002d
SSDEEP 24576:DLK8L87DESeyOAd5HT6aXZDjp/mqfTpdiHF4KtGyVdsdrvo4HY7F6f2IF:DLKrDOy2QBZTGFFtGMspRb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk
Size 1KB
SHA256 b78d6287b708cd4635eeb67df0e0bb7591d15c65111520cdf33321d3277b6bec
MD5 a950e579dfd537d01f28c9497e3d9f8f
SHA1 05e4d1606d80419a7a48d450369ec196ed81d243
SHA512 024859862a1365d97d962153cb57cd189604c118be6491afae3cc3f60ad599cbe78b2ed209dde97046e6aa9762f11d3dceae792e78797dd3879a881395d3f6b7
MD5 SHA1 SHA512

Submit Download

memory/1868-31-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-383-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-425-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-424-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-411-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-69-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-33-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-32-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-371-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-231-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-28-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-361-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-360-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-18-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-19-0x0000000001001000-0x000000000102F000-memory.dmp

Download

memory/1868-296-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-23-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-20-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-21-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1868-332-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/1968-68-0x00000000009E0000-0x0000000001069000-memory.dmp

Download

memory/1968-65-0x00000000009E0000-0x0000000001069000-memory.dmp

Download

memory/2300-331-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/2300-330-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/2680-26-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/2680-25-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/2680-29-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/2680-24-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/2680-30-0x0000000001001000-0x000000000102F000-memory.dmp

Download

memory/3332-1-0x0000000077556000-0x0000000077558000-memory.dmp

Download

memory/3332-4-0x0000000000780000-0x0000000000C44000-memory.dmp

Download

memory/3332-3-0x0000000000780000-0x0000000000C44000-memory.dmp

Download

memory/3332-17-0x0000000000780000-0x0000000000C44000-memory.dmp

Download

memory/3332-2-0x0000000000781000-0x00000000007AF000-memory.dmp

Download

memory/3332-0-0x0000000000780000-0x0000000000C44000-memory.dmp

Download

memory/3888-422-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/3888-423-0x0000000001000000-0x00000000014C4000-memory.dmp

Download

memory/4668-49-0x0000000000B10000-0x0000000001199000-memory.dmp

Download

memory/4668-67-0x0000000000B10000-0x0000000001199000-memory.dmp

Download