Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09-09-2024 14:47

General

  • Target

    c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe

  • Size

    1.8MB

  • MD5

    d5fcf8cf3ca99a694ee9b8a97776e64a

  • SHA1

    07542ce45f902bdc773702e17621cc600d3df50b

  • SHA256

    c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d

  • SHA512

    90da999cc41cef8a44a3b0186b2de606567414024a60e1467f970e39d64f67af254067e11ac19c7f8f7e1e270c3a71cd9214de4773044e68616dfb053c058e2e

  • SSDEEP

    49152:Bjnly4R2PVRilKbs9cRs+Ams7U9N2hk1:BjljR2dol0sMfzKhk1

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe
    "C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Users\Admin\AppData\Local\Temp\1000030001\2553f2e7d0.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\2553f2e7d0.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3184
      • C:\Users\Admin\AppData\Local\Temp\1000033001\4ca0dfc0b9.exe
        "C:\Users\Admin\AppData\Local\Temp\1000033001\4ca0dfc0b9.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4608
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
          4⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4952
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffced0a3cb8,0x7ffced0a3cc8,0x7ffced0a3cd8
            5⤵
              PID:3528
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
              5⤵
                PID:3584
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3764
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
                5⤵
                  PID:4916
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                  5⤵
                    PID:1060
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                    5⤵
                      PID:3264
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
                      5⤵
                        PID:4052
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
                        5⤵
                          PID:1928
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
                          5⤵
                            PID:1484
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
                            5⤵
                              PID:3308
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
                              5⤵
                                PID:3276
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
                                5⤵
                                  PID:4436
                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5068
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,6598585354493050750,4129063461901014555,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4792
                        • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                          C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5068
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1052
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2316
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2588
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3644

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              f3bfe4b401bcbfe84262555152829cd4

                              SHA1

                              2d0c340e83d1f14a69edc1cc8f0948e9b35e932a

                              SHA256

                              aeec28a9f7a8f94b3f4594c41065c39b01eb2b2f915c6bf726ba9a9c19c651f4

                              SHA512

                              136607ffcbc456447f3f00101a45b09520182d082576a29f37041cb76b48007f2e78c51fc7d3859f443f670b7c94cc453ada4dd7fe04c29a8532984be0b20a49

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              e7f165f900d4716a5ededd7db3d81c7f

                              SHA1

                              99ef63b4b9a5a4a35e4c0ba331cdfcbc2d1f06d5

                              SHA256

                              6e7b23ae2718f38318eaf25476148dbdfd9ec3708603682184e58bf6d99a3662

                              SHA512

                              35fa4e03f602efa850923916277cd83b7bbf5172f343f750073720d357faca418d769a45cdb5fce80efffcc697c4f309e2b4a167618d1a90a516c8645e97072b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              ff2592d99c287564ebcd7ce485698af8

                              SHA1

                              a5945b83d344b22cff36c3132fe93a8b8e763371

                              SHA256

                              a3174c195aca26977465f5b8709e9fb0be36074767dd8c064122adfef29c6f82

                              SHA512

                              085568a507de2acb2426939dd9dd19a08964bc6240891658c2c685abe41317fc19c2770066e63b57b0e004e1335f16fcc30800a12a6882015659bc8cca9f16b4

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

                              Filesize

                              20B

                              MD5

                              9e4e94633b73f4a7680240a0ffd6cd2c

                              SHA1

                              e68e02453ce22736169a56fdb59043d33668368f

                              SHA256

                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                              SHA512

                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6d713d61-d68b-4966-a1cd-09bafd244f28.tmp

                              Filesize

                              4KB

                              MD5

                              5e1eb1a3dd97f412a8cb2d2855baa864

                              SHA1

                              cfcda3fcd223c17e80fcdbae058deca731cd2eb3

                              SHA256

                              8348b6044a0748893c60841c229fb4117284ed7bf101e60581079e03affb32ea

                              SHA512

                              018280f8683333edb9be4ecbcd6a5a42486462a094a58cdb7c05b9325e790153e82834d9f3be1badb20bd2f21ba09f3c0e6d674785f8284399cff4321cf1fc9b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\data_2

                              Filesize

                              8KB

                              MD5

                              0962291d6d367570bee5454721c17e11

                              SHA1

                              59d10a893ef321a706a9255176761366115bedcb

                              SHA256

                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                              SHA512

                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              48B

                              MD5

                              47bcc11702900b6caff5dc218ed2ea20

                              SHA1

                              7dd7354910d6cf68e98497f13741b200aef77c29

                              SHA256

                              6537569baed20d07b71e88de9bb4491e536a7dbad030695ef7463c5b3b2e2224

                              SHA512

                              5fadc0b5950b976c4d33ca3c6eea7f0307289d46b2d57a211d18df397e7086f364a290afa46fe4bf5241c347c2b4927a784afb85f0c776efac3b391800bf015b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              336B

                              MD5

                              a426ddf7538f3b9b875dd40aa0efefab

                              SHA1

                              c04490586388476dc0ab8683958dcc25e3f751dc

                              SHA256

                              8d8f67ebbd4a4baf0b2fb4dd2bbd46f1fdd18c30b83bfe1361836a32196857ab

                              SHA512

                              f8bd27bb409393d62f1c359250c8df43767cda2dd87f8f9e1dccbcf81c29e071158f93673b040f73e0260b6631a141c4a12a11821271767efb409b604e78479b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

                              Filesize

                              41B

                              MD5

                              5af87dfd673ba2115e2fcf5cfdb727ab

                              SHA1

                              d5b5bbf396dc291274584ef71f444f420b6056f1

                              SHA256

                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                              SHA512

                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

                              Filesize

                              1KB

                              MD5

                              611922e5b5c4e39231a3472357be5d96

                              SHA1

                              e57a41381f7fa935d704b7b94494ee6a1fe861bd

                              SHA256

                              3720d433bba2a182197885ea47e3c7aea72ff40daeb9c30b0b86f7c3a5c5b764

                              SHA512

                              f948c2e1a79972f7bd1672011479ace537dec50f4eb1c0cffe6e48ef41e8744dbd4e335e3ddb212333ef80eef6bfbabe33278c5825aba586f40e8549abdec665

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              59B

                              MD5

                              2800881c775077e1c4b6e06bf4676de4

                              SHA1

                              2873631068c8b3b9495638c865915be822442c8b

                              SHA256

                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                              SHA512

                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              68af472a280f68a5196e231e4bab75af

                              SHA1

                              e57f6a09d52a3b8759fc5296ec2f6a47370862d4

                              SHA256

                              0a4230c6f901563aa5d8949994aa4be0e3c6facc1d22dc1988ad39474b0fa298

                              SHA512

                              bb7fbbbf9150eef302ebf79873061aad2f4417d480056b87990bec9cbc7e0b53e43ba04cc1e0149415cfbf963d7f502af6921166de962d0a4bcac1b32bd391e5

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              3KB

                              MD5

                              37837bb960c7f20b292201b8d7e5f862

                              SHA1

                              edce02bbbb026e39cd4208ba9e3dc8db517d11f4

                              SHA256

                              a07fd32a06073e723ff9e8af55b988a4362a5b1b2e5984a4eb91b93c04fc548e

                              SHA512

                              e9573a507217e0c0ece5e4389c31ec7144ccd8ca2aad568190f16cd512fe5c8b4e3d7aaf38343cfc0fd7c3a030cdc607fff3f2950aafcef7babab16e079b7914

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              1605619dbd77b6f2ddab5283a4ab543c

                              SHA1

                              e916ce7dc93a095042f907873aebde618e850565

                              SHA256

                              ff31183539f0ecec4b1ce9e05eb64c585dc7581a93bc6c0f917551cdec408a37

                              SHA512

                              bc1f60c05ac4d3d3c027d7fcb5ada1533244d1a331efcba7335f2fb157aa9cce02ece9ce575969ad3973cc4f090a4bd88c4d55df9df9fb49fc78c1f091dcf84d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe5857cf.TMP

                              Filesize

                              3KB

                              MD5

                              92f5f0a849bc3a6a4cd6d89c36e77aa9

                              SHA1

                              a0f1ad79d83c710ce79bcb45e2b59b0196ab2413

                              SHA256

                              bcf3d66cce1226c484b0b6fa36e54aef2dece0c7412435f659e2e401c4111550

                              SHA512

                              dab0fa9d0ce2cf7d79b99ce2307db8aa06a913ebe629a318a59398b1828f7b1b20243e7483da88d9a0a1d1ce764d84b3f4f72bd270f1914df8d713332666aeb6

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

                              Filesize

                              26KB

                              MD5

                              bc0a19a9d63381d1f55652ec51ecc90d

                              SHA1

                              e0309b94be6497935c7a572962e28261958c6d4b

                              SHA256

                              a97cb3753d517a62f3228dbf1c32366348823bb6c33fa4e14e9d413953d726d7

                              SHA512

                              6a0a1454bae0fcb3179857223b1a52843a3bcc908a22917214494ce20244efa96b3b9c3e1228e39e6f86cc5636b693304da377d48df4a6b0b61d0de76ce7aeaa

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe587f8b.TMP

                              Filesize

                              25KB

                              MD5

                              c1ef24d50754e059ef581547d7ef0aa6

                              SHA1

                              85af98b01d25a63ddc84be09f6067d01b1588893

                              SHA256

                              259e49a7f2127def4f738a0f3970930dee027ecd2c350873684f02290215c27a

                              SHA512

                              17173e10a204fa24095a936b57f5f594a228d73ff69433266df3917a7bea9180ffe41f6615c4078afa53ed025d4913fa12c1b1877e9c00ae3bc80ce54083c7b3

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

                              Filesize

                              8KB

                              MD5

                              cf89d16bb9107c631daabf0c0ee58efb

                              SHA1

                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                              SHA256

                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                              SHA512

                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

                              Filesize

                              8KB

                              MD5

                              41876349cb12d6db992f1309f22df3f0

                              SHA1

                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                              SHA256

                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                              SHA512

                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

                              Filesize

                              203B

                              MD5

                              9b2632edcdb7dca43e795c83e299dfaa

                              SHA1

                              4cfcae01d0772a22b6497bbbeeb6b5b8cea8e62b

                              SHA256

                              8689e9796e86dd7e19ae8b4eed0664f0f34008e6a0eebc5d834196aa5e3b023d

                              SHA512

                              f92f4bd2a9fad79d9c09bad1b2f01f3a7e0bc63217f893a9bd64f95f0716846c8c15c7ba93bbfa81666860b0703956419dc2ce2bc54f8bbbd18cc86c397cabc1

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe597323.TMP

                              Filesize

                              203B

                              MD5

                              97133a00b1adb1a737d93bc54d6edc56

                              SHA1

                              c18538f78fca4d67141c69ab66eb59906f8e52b5

                              SHA256

                              51c31f83440e110534b9fcfd8a47c657373f27c41ca071eb66b4d89d2495383d

                              SHA512

                              c3915ec8e2a249f54b3d43e2989dcd8cdf8c05e8e286ec14077e77623458374776b004adc4c403d380151437ac9c70d895f6e81580615cc8977cc833126781e0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\e3a4975b-659b-40b3-9f7d-71dd2fb4f223.tmp

                              Filesize

                              9KB

                              MD5

                              14d7d3ae2eedff2fe9465a7eafa35df3

                              SHA1

                              677a30da0eda27a0e1853ee75b81327f69c0efae

                              SHA256

                              60e1808dc9ea227517943b4d528c0f83fb1fcc0870e00572a3dfd51130dc66db

                              SHA512

                              7b02141b5c0a4e84fd79bad46a8217e4b848253d5c6f1f5a20f85ab65c006e1293c65515d71ad679b0c817fabceae344bbc1eec39ec657e0acc82c443ad6883d

                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                              Filesize

                              1.8MB

                              MD5

                              d5fcf8cf3ca99a694ee9b8a97776e64a

                              SHA1

                              07542ce45f902bdc773702e17621cc600d3df50b

                              SHA256

                              c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d

                              SHA512

                              90da999cc41cef8a44a3b0186b2de606567414024a60e1467f970e39d64f67af254067e11ac19c7f8f7e1e270c3a71cd9214de4773044e68616dfb053c058e2e

                            • C:\Users\Admin\AppData\Local\Temp\1000030001\2553f2e7d0.exe

                              Filesize

                              1.7MB

                              MD5

                              110750350e3f833d4de59ed0c7dd1b08

                              SHA1

                              ff21c68dad2c4733ced39aabd130e0406a56ed58

                              SHA256

                              d89f747d96c84dcd1a704731dd4261f6eb69f1498a05cae00a4635169ce5ec20

                              SHA512

                              df963df25b627e0aa446c0170acbfd3589d0b243eae8c34d84cd77940ee1d58b90f4a4739c10053eedd3dc1036a20aaf8cf202c8ed991b487712137ec0d52493

                            • C:\Users\Admin\AppData\Local\Temp\1000033001\4ca0dfc0b9.exe

                              Filesize

                              896KB

                              MD5

                              80351281b65e08b2ce36f4f40df8a5f1

                              SHA1

                              fc5458c1c2b72403509f9c9c0a33801d92650424

                              SHA256

                              e597fb772319a806f79e33ebe4faaeca8497afbbc3081c9379ea6e9b3c1756b7

                              SHA512

                              e9aa6ac8cc70a1e8af9d0620906e9f53999bab86965e21affbb53bc6e52a28ab3da8d5924c2f877262e8103807762cd6ffea82e0262fa907fbc3fac159734973

                            • C:\Users\Admin\AppData\Roaming\1000026000\08ad955ded.exe

                              Filesize

                              384KB

                              MD5

                              34a47ed7f5085b9356f39de4dadf714a

                              SHA1

                              cd930bd313247817c84198f8edf1e26ef4acab62

                              SHA256

                              334f24670ab4d6fb54e5bfd2ee1b035f707d570ba9e9177bfd148fd92ecd459f

                              SHA512

                              d85ab82ac35d9db7e3b1561302079e1fd65411cbeb118a3e205dc2f71119c8c7b579a184fa45c623bbb8c8f679e1c179ddb793ce698834d88f4a92b07104d6d9

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

                              Filesize

                              1KB

                              MD5

                              c5861e056ce648e4f35ce74baa338d7b

                              SHA1

                              ea57614f97d70da8fd1be10af0ad776049fea818

                              SHA256

                              21494ce232384ac38c06ef68a0ad7327f206c05937394873b92fe273ff3e5c3d

                              SHA512

                              7ef3ac49cd17d57c3a1c535b1aa74f35d890b52792fd4c208c4fafa645da94c87317051e43af6308b0598f64f8f1eccc8fbf0fe768611e32a0358ae197d219ab

                            • memory/1068-20-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-16-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-422-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-26-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-25-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-24-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-23-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-22-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-21-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-216-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-34-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-35-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-33-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-19-0x0000000000E31000-0x0000000000E5F000-memory.dmp

                              Filesize

                              184KB

                            • memory/1068-410-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-295-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-382-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-370-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-360-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-359-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-331-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1068-36-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2588-330-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2892-3-0x0000000000530000-0x00000000009D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2892-0-0x0000000000530000-0x00000000009D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2892-4-0x0000000000530000-0x00000000009D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2892-2-0x0000000000531000-0x000000000055F000-memory.dmp

                              Filesize

                              184KB

                            • memory/2892-1-0x0000000077B46000-0x0000000077B48000-memory.dmp

                              Filesize

                              8KB

                            • memory/2892-18-0x0000000000530000-0x00000000009D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3184-67-0x0000000000060000-0x00000000006C9000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/3184-69-0x0000000000060000-0x00000000006C9000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/3644-421-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/5068-31-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/5068-32-0x0000000000E31000-0x0000000000E5F000-memory.dmp

                              Filesize

                              184KB

                            • memory/5068-30-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/5068-28-0x0000000000E30000-0x00000000012D9000-memory.dmp

                              Filesize

                              4.7MB