Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09-09-2024 13:01

General

  • Target

    4627b125e316b49fbaa83c3c6132ec06b15d67bb6493552316decae452b9000f.exe

  • Size

    1.8MB

  • MD5

    26166cfdb67a25db0273b7840ca4d9f7

  • SHA1

    b61401f3e1e789d805aa23137a3e9e3b78da59bd

  • SHA256

    4627b125e316b49fbaa83c3c6132ec06b15d67bb6493552316decae452b9000f

  • SHA512

    66ef7f10c1d5bcdac62891b14ee09eb75211712dc1f2283a0db1317500facc17de9e6e652f0d03c5469fc0edaf6b362b57ab720b162facdc369b48d20e4ce36a

  • SSDEEP

    49152:azoquA+/nmvOcqak2PsYbpI80cLKAha3+:azDuAImvOcqCEYbhzLlho+

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4627b125e316b49fbaa83c3c6132ec06b15d67bb6493552316decae452b9000f.exe
    "C:\Users\Admin\AppData\Local\Temp\4627b125e316b49fbaa83c3c6132ec06b15d67bb6493552316decae452b9000f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Users\Admin\AppData\Roaming\1000026000\5ce92b6c55.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\5ce92b6c55.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3676
      • C:\Users\Admin\AppData\Local\Temp\1000030001\98e15699d6.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\98e15699d6.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5008
      • C:\Users\Admin\AppData\Local\Temp\1000033001\f5172fca1e.exe
        "C:\Users\Admin\AppData\Local\Temp\1000033001\f5172fca1e.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4080
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
          4⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5632
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff37cd3cb8,0x7fff37cd3cc8,0x7fff37cd3cd8
            5⤵
              PID:5596
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
              5⤵
                PID:5364
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1296
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
                5⤵
                  PID:1524
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
                  5⤵
                    PID:4144
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
                    5⤵
                      PID:5048
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
                      5⤵
                        PID:1444
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
                        5⤵
                          PID:2148
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
                          5⤵
                            PID:4916
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
                            5⤵
                              PID:2352
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
                              5⤵
                                PID:2040
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
                                5⤵
                                  PID:6128
                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7564 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3316
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7588 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4336
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,9594967392655589251,1375424157973422810,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3548 /prefetch:2
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4956
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2404
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3052
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:884
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3456

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\345302e2-ae87-4348-b2d9-9d82b6041581.tmp

                              Filesize

                              9KB

                              MD5

                              d663b04eb9b5ead2a4e237b03f180f56

                              SHA1

                              b8bb15867aa7a7f75c5c902ead6c1cd689aff940

                              SHA256

                              1119bddaffefcca2df5698bc1f987303c4f92dde67829ad68089fa369464d3fe

                              SHA512

                              0367101fc10d6f3303c915d9ead87f567cbd733ddb565d56dc2184870c5c8d982ce9766fdae63a882b389b8555b8e31630893a1dfa62b8c2106fd5e671d608fd

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              4502e91f50323b3100cef6aac4b65c9b

                              SHA1

                              b8607eaf0f6d55e9077639dadc93f9eba806a2d8

                              SHA256

                              7148375a7cec944b7199fc602529c16ce7d8c737197f9e15c3c53ab6ef3fd74d

                              SHA512

                              ddf103abe2c76cfe0ce29b7c61452c7d43039ca49ce0ba15b0f7f7b38f02460c9b152d11601986dae84a2a181dd2ba3ec0727b81be1ccdf5e3cabcb3d4ca1ff6

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              cc5c57ad8a7956543a8612fafff76b02

                              SHA1

                              7472041889feb513669e5c6f3f448763564447fd

                              SHA256

                              2785ac88aa7b1eb23271ad48dd8d1f108e49ef3b4046f4f84cf888d95988baa0

                              SHA512

                              86850c48ed59df090ae2cc4217036298f8784ed01b02826eb31cecb9f27ca03418fe7977579221e8945dae8900d26acb19cc1a06f2381de65b06c99fecfab97e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              28a3e5f033eb2cddcea27c198c0855da

                              SHA1

                              5914ed429bc6e0dadc5e51c744e864ead7fca54c

                              SHA256

                              22165a9f46851637a1f9bcc123fa4bc2c9a22b6b9927c1f1fabd0af0f4e35a58

                              SHA512

                              4e7f1533d9dc1ad6166adaa688ad223058366a904e72c9df115576b6c2d8d1edfa2bb6ff84fa524c27ce9fb69295fd5021d0e016e50d6f3ecb668e2734db6ec5

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

                              Filesize

                              20B

                              MD5

                              9e4e94633b73f4a7680240a0ffd6cd2c

                              SHA1

                              e68e02453ce22736169a56fdb59043d33668368f

                              SHA256

                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                              SHA512

                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              48B

                              MD5

                              be9482c10091452e7da615fe34a7dc9e

                              SHA1

                              fcaee9fadbb1b12fba2126191795047a6a71219c

                              SHA256

                              fcfdb31f5f8aa41a08962a5a13b9e87af8b3cbe9d930fc8a6fc3ce3c25e1da31

                              SHA512

                              6912be5d2531f6e34ac5b6f4f361708c9b944816b375cd86c4cc68e0f09b1bc81c91e0507324b719cad0f395d0e20963e6449ddddc5830a9682b65591236160b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              336B

                              MD5

                              8d1c4a9552cdee342cb8311907d877c8

                              SHA1

                              1f50cf8b3e722e21ddae72662fe6704b10d76008

                              SHA256

                              985f1475cab293f7a5d3e91ac7ae41d8acb3f7809777cd222ed95fc9ca3df08f

                              SHA512

                              c5bed20ea6ffb1e04ec5f590921f8a2bbff8055d696cdb3b51933f7e79cd0670c998128631aee7555e791998a583b141cecc0503dc3a45173091677df7eb396a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

                              Filesize

                              41B

                              MD5

                              5af87dfd673ba2115e2fcf5cfdb727ab

                              SHA1

                              d5b5bbf396dc291274584ef71f444f420b6056f1

                              SHA256

                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                              SHA512

                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              59B

                              MD5

                              2800881c775077e1c4b6e06bf4676de4

                              SHA1

                              2873631068c8b3b9495638c865915be822442c8b

                              SHA256

                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                              SHA512

                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              15cdda39161659e8de81c62e91ad30c6

                              SHA1

                              fa5499ff29791f8b8d8b569a63ee5cf64ca2824e

                              SHA256

                              b5a71b15c7e8083f38db7e067cd1826c24244d2d2985b8c054f8e18a2b3f7277

                              SHA512

                              d69059ef42e1ff75fb3b904144c250f291e39e6aad33a70fe607aa31296c2b26288f2ca8371a9e009a733a3cfcaa582a8ad19436f0aab9303ceb6ace0bfc30e2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              3KB

                              MD5

                              9f2b895c25f366f63e2d55a74516411c

                              SHA1

                              81e5fa178988e3aa5f3a0aee6cbf1979de9bd875

                              SHA256

                              58c4bd1756778d35c6744b7677bc62284a4b7e1f2405ec7d325f693ffb1456b9

                              SHA512

                              05060baaa76c1e2ca07266097572b35d09e00759296215c476d025242d7d9da06ff98b8b833da291070ca2e5c7efee18038fd089bb5a9a09980b44daf6180b66

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              e4477a404a213463fb8cb32ed826679a

                              SHA1

                              84f517898635209d8ff41581dcc0d3c0404e2b01

                              SHA256

                              cf98906788cb345f0fbe30d2c56dac4828eab418df0a53f8854835b5f5b74a96

                              SHA512

                              8b9a3394db19b5b748acb370a7ec63fcaf6e362ad6a19375f55a3dd84ede296199c00218aef8dbbaf1bee1700cc8901f25669575e2f3364cc06b882449aef1e6

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              442de33cb37b6f4cb3f472f766824777

                              SHA1

                              11a1a59f942f5c61323300db5bf3f0bee2f3fc81

                              SHA256

                              4a5d83f3c9923faf0c74b6e763b62063d61a7a784439510a8716372ef3616a46

                              SHA512

                              a282c27ed04e67375ae0b8edf4c6eb5e2b99fd52f179acd0b11e96cf3005100ceea4854b657360e107f18010148200f5b61a55cafe3c470bb74fc2e0a614299b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57e985.TMP

                              Filesize

                              3KB

                              MD5

                              e011ce0164cb1a7753264e2e489eda8c

                              SHA1

                              ea0ac92d9af2e731ca7d0865f159f5b1aaa3df38

                              SHA256

                              6455696c9264a946adf1b4a89e5c7b88271e9b3bc983c3370bbc10e9a783a40e

                              SHA512

                              64c35e1eed7b57a92c83c8400840070b4bbb50dee4401e4f26a827b5944ffec18a70bb621e9645789512c2a4ac81fe9deef5c15bf7542e602ebd33c0fc811fc7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

                              Filesize

                              26KB

                              MD5

                              6901ff3e306d6216a73603af24d658d5

                              SHA1

                              71d375303f0cdbd875cf5e65bd54c378a74ed6da

                              SHA256

                              615046cd807d558039fa026f3ec22c038a36c26a277011c031f32bd02bbf3a7c

                              SHA512

                              5374a7fe1a8ce51c64240d8169acb23e5e849fc6df4081312783faecdc7badf9c096dbc478d2f328699ac311653db0496be29c1e4b8c39f3212a95c014290ffb

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe581170.TMP

                              Filesize

                              25KB

                              MD5

                              7cd305734e7580a68023f2a62498e77b

                              SHA1

                              596f93a6a4e1a30369e6138c01a66c134f4f389c

                              SHA256

                              6393accb88fbb19b9861f42a3b5215e18f215b0e0603984137f3e35254766c69

                              SHA512

                              6f43bee2804e906fca3ee7bf74e9cc59c4d3120ea21197d82ad4ad3db452455f1fb7468eab915012ff0ef03708226a8203ac85afd58c1a8975fcece8c24e00b5

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

                              Filesize

                              203B

                              MD5

                              e4f013cfb768dffc9f1d225e95441e3f

                              SHA1

                              b6e5941575b105d239c88559db6d7f3e81ce5901

                              SHA256

                              153645c2da7af42b5092b809dd402a8109fcb158389ab7155509211016b8f270

                              SHA512

                              cf53ce6dc58928113214f893452915c5ad5f01dfe67bdd039e7e215127a856582e0a46548dc3fe4f6cc02bd19908919f12c4d6f8fd86c2f279de602b9ff302d6

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe590ff4.TMP

                              Filesize

                              203B

                              MD5

                              ae56616d30945abaef6a3b63c6aeaafa

                              SHA1

                              7272682ec9cd4c3581787fbe8dcd1705803c5780

                              SHA256

                              02ae2e8972acf05cb796f403517dc03661dab0915d478c0c908e0ac769b37a43

                              SHA512

                              4c83ff10bb69cbd59c2ead2dfaf41b619ab9e3acc8108d7e6fc7b52da73cd71e146a03c61d1ce5ef72b2e433ac9976c9f922c5e3fe29e35274688c17d9d304ad

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_0

                              Filesize

                              8KB

                              MD5

                              cf89d16bb9107c631daabf0c0ee58efb

                              SHA1

                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                              SHA256

                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                              SHA512

                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              d0d388f3865d0523e451d6ba0be34cc4

                              SHA1

                              8571c6a52aacc2747c048e3419e5657b74612995

                              SHA256

                              902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                              SHA512

                              376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2

                              Filesize

                              8KB

                              MD5

                              0962291d6d367570bee5454721c17e11

                              SHA1

                              59d10a893ef321a706a9255176761366115bedcb

                              SHA256

                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                              SHA512

                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_3

                              Filesize

                              4.0MB

                              MD5

                              2b02a61508b5857937745e7b5a87cb9c

                              SHA1

                              1dd21e40002ec6199751dee6fddd2fe0d79f31c2

                              SHA256

                              25f6019b7563053b4796dda357d96d106a98aae48b732a9a4b7e598f9aa5e6a8

                              SHA512

                              c8beda8d2c35632700fd719fd656e5d204518ef0568221ce07e4520e0ce1e2d2ac9136f1ddf3e21fddbd7dbd2fc55dd0e71a417cbb6b7bc1182d739b02710b0d

                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                              Filesize

                              1.8MB

                              MD5

                              26166cfdb67a25db0273b7840ca4d9f7

                              SHA1

                              b61401f3e1e789d805aa23137a3e9e3b78da59bd

                              SHA256

                              4627b125e316b49fbaa83c3c6132ec06b15d67bb6493552316decae452b9000f

                              SHA512

                              66ef7f10c1d5bcdac62891b14ee09eb75211712dc1f2283a0db1317500facc17de9e6e652f0d03c5469fc0edaf6b362b57ab720b162facdc369b48d20e4ce36a

                            • C:\Users\Admin\AppData\Local\Temp\1000033001\f5172fca1e.exe

                              Filesize

                              896KB

                              MD5

                              0df4978ab22502c7ae122ab13a255448

                              SHA1

                              845169633a45d0bc64c4799c0b5118ce6148131f

                              SHA256

                              e2a03fd46d56cb79ec4c0cbef9e6fe2bd3067418f81f77355c908cfeae03ee76

                              SHA512

                              d1b2a6ac51348f698f4d06ba62be48150fc7e1c0fdb1a99853caf555c3afcf76eea26a5862768c54a113bef2d5ee84d8c5f49c1903fecc7e15ee0282b903a69a

                            • C:\Users\Admin\AppData\Roaming\1000026000\5ce92b6c55.exe

                              Filesize

                              1.7MB

                              MD5

                              c06c4e6ed6f4c67541e9cdacb508f653

                              SHA1

                              0a587b8151e8634a48dd686157b45a2e0477093c

                              SHA256

                              75406b44f46f30aed814150ed323b10f34d6e68b585a75b6e9796f556f1cd691

                              SHA512

                              93f7d6ee59b28bf72d1bfe16c5482d9fa0e1eb0f8ce9b901dc31a66b07e2e65cf21972723c90d5f86826d2cad53d126f18f1ae085416cc203059fa3c13d71440

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

                              Filesize

                              1KB

                              MD5

                              ffb26e1f5ecd232f2983bdc280035365

                              SHA1

                              89baabc8f53590d7d481b867fb8569ce404d3f31

                              SHA256

                              1bb84a53e70a61906860c7f6d40d022ed6717f94a0a47e42c7c7fdc7a2a265ee

                              SHA512

                              769a7c9f96bc53aa1698b7107ca148cd8fa549d1a00785c175af6ee9a59df3adcf4f485b882b783ff55e797d6c7c5e81b97df86a662da11d65c387a3e3b5eba4

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

                              Filesize

                              1KB

                              MD5

                              6069832b1d88ce36cc8c18211af59745

                              SHA1

                              d0d654f832c30dbcf9ec190c7179b6a0516ead35

                              SHA256

                              ba604f1cacc0567a72708b8e40601e83a0145a2ecd889c9dc69553325dd1e9f4

                              SHA512

                              68cbe5c2d1be942c713e8a874e4f50add6d1b57e02b2683340cd7c458ab287321641f079584ff148f78fa89722a76373b0c55b5e8020a82ad410e58cd7f6afbe

                            • \??\pipe\LOCAL\crashpad_5632_MKJFIPOPCJGSCXMP

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            • memory/884-351-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/884-350-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/3456-415-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/3676-40-0x0000000000F91000-0x0000000000FA5000-memory.dmp

                              Filesize

                              80KB

                            • memory/3676-59-0x0000000000F90000-0x0000000001618000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/3676-41-0x0000000000F90000-0x0000000001618000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/3676-39-0x0000000000F90000-0x0000000001618000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/4584-23-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-353-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-62-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-22-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-21-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-288-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-321-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-20-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-19-0x0000000000B91000-0x0000000000BBF000-memory.dmp

                              Filesize

                              184KB

                            • memory/4584-18-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-418-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-417-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-352-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-219-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-363-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-375-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-416-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-413-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4584-403-0x0000000000B90000-0x000000000102C000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4840-3-0x0000000000120000-0x00000000005BC000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4840-2-0x0000000000121000-0x000000000014F000-memory.dmp

                              Filesize

                              184KB

                            • memory/4840-1-0x0000000077E56000-0x0000000077E58000-memory.dmp

                              Filesize

                              8KB

                            • memory/4840-4-0x0000000000120000-0x00000000005BC000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4840-17-0x0000000000120000-0x00000000005BC000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/4840-0-0x0000000000120000-0x00000000005BC000-memory.dmp

                              Filesize

                              4.6MB

                            • memory/5008-61-0x0000000000AE0000-0x0000000001168000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/5008-57-0x0000000000AE0000-0x0000000001168000-memory.dmp

                              Filesize

                              6.5MB