Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-09-2024 03:42

General

  • Target

    4cd700c07d346e16f4d802b9d7a59201fef4b209deef6bcae26bc2b8b6c0ca1b.exe

  • Size

    1.8MB

  • MD5

    73f3d06a3027d3f7e86b6e44ac5eb905

  • SHA1

    e0608353485f123b49e7a18b880971be24584046

  • SHA256

    4cd700c07d346e16f4d802b9d7a59201fef4b209deef6bcae26bc2b8b6c0ca1b

  • SHA512

    5722e0b54a6e8dd56b2f3f9f2b56d82ed48f867231c9faad4f716000d495bb231184e511cd277f697a49094e92a3e38569c770d3f56d45f7363723a9e3128ad3

  • SSDEEP

    49152:oWvri3EAd+FLt8onSN6aNIY5dZfi21tRYIpUXQBP:ni3NdUi6al5Xiei6P

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cd700c07d346e16f4d802b9d7a59201fef4b209deef6bcae26bc2b8b6c0ca1b.exe
    "C:\Users\Admin\AppData\Local\Temp\4cd700c07d346e16f4d802b9d7a59201fef4b209deef6bcae26bc2b8b6c0ca1b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Users\Admin\AppData\Roaming\1000026000\f5c0d9b66e.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\f5c0d9b66e.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4116
      • C:\Users\Admin\AppData\Local\Temp\1000030001\4c657176cb.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\4c657176cb.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4624
      • C:\Users\Admin\AppData\Local\Temp\1000040001\9968150715.exe
        "C:\Users\Admin\AppData\Local\Temp\1000040001\9968150715.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3780
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
          4⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3164
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe29d63cb8,0x7ffe29d63cc8,0x7ffe29d63cd8
            5⤵
              PID:2432
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
              5⤵
                PID:2688
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4440
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
                5⤵
                  PID:3144
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
                  5⤵
                    PID:4664
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
                    5⤵
                      PID:4996
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
                      5⤵
                        PID:3200
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
                        5⤵
                          PID:1312
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
                          5⤵
                            PID:2800
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
                            5⤵
                              PID:2096
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
                              5⤵
                                PID:1064
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
                                5⤵
                                  PID:3128
                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5012
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6448 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4824
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,1618278830063599338,16629008028035072917,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6156 /prefetch:2
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:580
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2648
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3432
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2216
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2860

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\28aacda1-3d12-44ba-9c66-4d57604afe31.tmp

                              Filesize

                              9KB

                              MD5

                              63f3e7ccecc50291e6dbce693ff7d0d1

                              SHA1

                              63f5e215b8e0444edd8ad18647db62800dc781b7

                              SHA256

                              d326e5e42c1f6deda124fdd696d9ce54dca421f6bee9805eb4ffcb349c75d5ec

                              SHA512

                              bd679f8173781b3f6265e8c693aa2ae960aaff18e4cc0d1bbcee18b533d06098864d9e35f2c5b71475ae94caf2313596040c97ae309c7c744bd7470f692033f8

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              08565c6c3412a40d64094f93fd8e4572

                              SHA1

                              6029b9e46a223b2edf8b1ed8f0e87527a4f1694e

                              SHA256

                              35234bafcfa109540a3ba55d5b1cb7cf23a5d526cf2f2b03be90ff8cb158058b

                              SHA512

                              8d442e7ce17e7e89ab2bc8180da48ad405442c447a05caa4dd9a2a657334950348e0b40aa4b14e31d2ba12ab03cfed547efbca2f124f3ac5bc6d6486eb4942a1

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              a9b823889a5ceefc1f05833a76471039

                              SHA1

                              4ebbc46196450024f3fc8ef0a9e962dcfc690c9c

                              SHA256

                              f6ba838f5a107f2ed57e599251435b8e59aadb985738737345c378f9eaa5437c

                              SHA512

                              ee241f3a8f0b06f55a72cfe7e611cf72877ec6cf5405d6600ed31994939a86e8c143379140c0947c6cc24617d86e9e4931636ee9922807c958548bababc86ebd

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              c1369bf4b2f8b40dd3d1529ab95a4a4c

                              SHA1

                              cc75c45d7641bf79d1a017964ee9e03a5f1b8436

                              SHA256

                              f2d88fe5b5003dbf578b61934d9f147b82436b466e8c8e3e4ed24149b390a108

                              SHA512

                              0bf2f2d92d4b1b86b2c1340b73cad73173e8212fe242d3c5a83bb66bc25f5770b1fa7f28d1dbf4dfdf114119091a7288b3a93c2dc9d9ee854e260a38cf71c147

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

                              Filesize

                              20B

                              MD5

                              9e4e94633b73f4a7680240a0ffd6cd2c

                              SHA1

                              e68e02453ce22736169a56fdb59043d33668368f

                              SHA256

                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                              SHA512

                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              336B

                              MD5

                              fcce28442a7461ac208b37e86eda33ca

                              SHA1

                              8b6001b736bfb8ec1a8fa7f254d762bade296b00

                              SHA256

                              b119be686aeeb445a7dcb58931d16a4a323bec631ca45c8119624bd2057542c8

                              SHA512

                              c47cd59cd31e37654d88bb0c6cbc1df8e4ca4dfb17525af46ebedb217d0f304cd0d1f89cb99a2eccb44aedc42ecb833e6398cb7e0f92ff4965f7a777ab796b5c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

                              Filesize

                              41B

                              MD5

                              5af87dfd673ba2115e2fcf5cfdb727ab

                              SHA1

                              d5b5bbf396dc291274584ef71f444f420b6056f1

                              SHA256

                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                              SHA512

                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

                              Filesize

                              1KB

                              MD5

                              79e50c8058841b4895019e2acedca2d6

                              SHA1

                              7b7ec22231a45bec9de7e86f1a9b3921b2f94add

                              SHA256

                              c90163539559c4071f92624f628d415eabc79825f58bd1e1aeab40982848a452

                              SHA512

                              7a8cfbc6bcd3129726d3376621ca0859cdd4fa19da49c1e535d7415251c4c8fc30251208402fc296265fe24f09302cb50d6e973b0188c931a83ab715cc2b3c40

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              84efb80c74c2e7db7dd33c0c212b1cac

                              SHA1

                              f92344ba2b3d86907fc216aafcf368f03310e436

                              SHA256

                              13614c4f89af99104cbef6104c8117ac97821d2a5de45ba3f115915179dd47a3

                              SHA512

                              9f90ca363150c1a233cd98f496aa7a2088c55893377db32b864454e55a5e22e79f11a5dc0094c18ca391670b60bc72bbbe5fcc8882c98f4154a1ec351f1678c6

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              59B

                              MD5

                              2800881c775077e1c4b6e06bf4676de4

                              SHA1

                              2873631068c8b3b9495638c865915be822442c8b

                              SHA256

                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                              SHA512

                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              639f7975da36ae0137c065ee661f0d79

                              SHA1

                              4a537eeccb2ecd872a131ad7142c33e1e66b0697

                              SHA256

                              3d00f441af0a8ea2a74320815316656aab6c97e8e3341c559ba94601048b8768

                              SHA512

                              7e226d3066bd3c90394b6201452c803234fb223b1de18ec1598d16263f2fcfc2875f1f5e123a9241ca729ca40f1246cbda226b9143436beafa75e040f85e1641

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              3KB

                              MD5

                              d774cc396208445cee1f79d72f506199

                              SHA1

                              8d6e2a22123eff6197ddc796767f4a00c693f9f2

                              SHA256

                              2f8b370dc4531b9b6ebdf9ee39e36fad01068284322cb486b6512b17c006417d

                              SHA512

                              3ab6e70b51f77284ce1d744d16d2b351c13bcc8a5fd06afa7e5cd1aca97c41c78c126219c11d72fb8b4ca3def4351de2f22f711364a011b9dd1be050051d80da

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              a260fcd105de9fe59aa9d9338291398a

                              SHA1

                              d01fa3f21ce4ae9916c8f81a9d47abdbcdade80e

                              SHA256

                              87a8ef16b72a42ab8e2ef55a4d101b609729605cd304d637462584aeaa4a3909

                              SHA512

                              c2bc0978bab2674aa03a08f3c5faad38bd2ec969a708d9d7dc640a5ad5464b0e5643aa7b0e0cb85a04810903bf479b2159cdd438682545997bf744fcdda1e709

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              1a4afcf1c103fd473c5fc68073b259cb

                              SHA1

                              b6b4d30d4e5a4dcd15ab67e582a43d25f7033a00

                              SHA256

                              9447f592513075ff710d8e5e35a48759da2b007e2c10e9ad0e341a864912234b

                              SHA512

                              3bd8ac6241b7c2a5e9e20ccd65785bdcc04a69ab2773bdcfeff81d694a5f3c7171ba9950bb64ebcb07a87ea871dbbb10dbb2a287fe2d90abe68764834a38cb6b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57c91c.TMP

                              Filesize

                              3KB

                              MD5

                              e95d9dace9bc54a9a5dabcd936cc5c43

                              SHA1

                              8cd49e0e46398afd3c04e395e5685879d81b851c

                              SHA256

                              039051e3c0a5b994ce7dadace6e5507d8b74ccea1c822470f74569ea782d789c

                              SHA512

                              45c43a338fd0b56e2505a9b971d74d28ae3880c74cdb00509c7a0bee454afa5b5ef3d0ada26b25cef9aa9df65bc1d494584cc684b49bf1c11e827632a3029311

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

                              Filesize

                              26KB

                              MD5

                              a98d8ccd3379cdb72192f489b4a1add2

                              SHA1

                              11ed2b492422a326b0c83751a2d9dc3b2f0bd0dc

                              SHA256

                              1421e6d62c216b84c140f87388baacd332b1308cda57723ac53507a6dc03b7e7

                              SHA512

                              25c9e5b6d591847b58e1bf458b13b1ed039af2298ee8c234dfd3133c2eb2afebe42eb025ef1549fcfc8af74827530f41fe9ad3083afaabdb203c6ef1719b536f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57f107.TMP

                              Filesize

                              25KB

                              MD5

                              ba91b3b646c600fcb62370e0f745eaf0

                              SHA1

                              a0c45e0e40de8a5b3df24c16482c3665c554f412

                              SHA256

                              7b2541d2d38c640e0cdab4914b786848e57c25b41364674e6d9c8957fa237b76

                              SHA512

                              22952a561ca0bfe4b2924467685f6c2a629f77d3c1b699061154b70aea3cd52181177b011704d55be5dd158d269f9da04f4092c4fb28da05e8af9b41e6177390

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

                              Filesize

                              48B

                              MD5

                              87aee601423a19c71d5e288173d21922

                              SHA1

                              f591fc2d02f52c67abb3af619201ac6719cf2424

                              SHA256

                              039581ab58dddc55530b553049e417e5ee08335450d20fbbfee1788369108063

                              SHA512

                              8166e5bac379cd16f5dffda96edcc1a76cd749e10ed96aa6823a342362d3f8cf66c1c737a9f5da3874d206e4a8e82a13c0765ed51c2136cd4b497ea9e7370d71

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

                              Filesize

                              8KB

                              MD5

                              cf89d16bb9107c631daabf0c0ee58efb

                              SHA1

                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                              SHA256

                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                              SHA512

                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

                              Filesize

                              8KB

                              MD5

                              41876349cb12d6db992f1309f22df3f0

                              SHA1

                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                              SHA256

                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                              SHA512

                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

                              Filesize

                              203B

                              MD5

                              35601ef5e2ca3118c28f0eb10314eff3

                              SHA1

                              b26a3e0068c973ba06a94daf64ebb5a1274d8810

                              SHA256

                              7b97f0babbfb0f087464c262fdace095ce1da2a62a80bd22cafa150eafcc296f

                              SHA512

                              e53a229f08880b34bc244f69251827c909eb5e2adec85f7f380a976b00505669eb35d745e9bc58038dc7cbcb0fee915925b4d9cce3348222f9dc47c921b5cde2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58eb36.TMP

                              Filesize

                              203B

                              MD5

                              869f2722b2bebe4a127812be0edf7efd

                              SHA1

                              b59e4d812e1b9d01ca88bdbc74ef4f16fd85daf2

                              SHA256

                              7a13151c53ddd519a0a7568958c4cc8abf059d35ba9453d9dc78053174503666

                              SHA512

                              022f52a30089d90be6a8591dcab4ccb45211af79b492e454c6aa0c626d4b7d0d3716b0f6a238a8cf0f3d973d624669fa14b2111c72109c004c27e951fc42ff34

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2

                              Filesize

                              8KB

                              MD5

                              0962291d6d367570bee5454721c17e11

                              SHA1

                              59d10a893ef321a706a9255176761366115bedcb

                              SHA256

                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                              SHA512

                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                              Filesize

                              1.8MB

                              MD5

                              73f3d06a3027d3f7e86b6e44ac5eb905

                              SHA1

                              e0608353485f123b49e7a18b880971be24584046

                              SHA256

                              4cd700c07d346e16f4d802b9d7a59201fef4b209deef6bcae26bc2b8b6c0ca1b

                              SHA512

                              5722e0b54a6e8dd56b2f3f9f2b56d82ed48f867231c9faad4f716000d495bb231184e511cd277f697a49094e92a3e38569c770d3f56d45f7363723a9e3128ad3

                            • C:\Users\Admin\AppData\Local\Temp\1000040001\9968150715.exe

                              Filesize

                              896KB

                              MD5

                              c5090cfde317cb004d4ee929fbe966bf

                              SHA1

                              62707964fb1e4b3003a208c088a7976cd317d374

                              SHA256

                              b736c6b7105621cabf5402e769b37818e51fb96a2308413c959a0a642cd603f2

                              SHA512

                              49c2219ccd4058277d298b023ca3592e97e9fb2e4df33a5971b042dc632546158439aa37a1ed6a5096cfb23af45cfdd07b2fb84a411f6464e120d7764bd687a3

                            • C:\Users\Admin\AppData\Roaming\1000026000\f5c0d9b66e.exe

                              Filesize

                              1.7MB

                              MD5

                              b3a239beeb5dedb7629a68e9ed216d4c

                              SHA1

                              f8092284123f59a72267611ef31fb60759eafbdb

                              SHA256

                              f539c6ebab703708ab993bacab000fd97274d49364bf0d58a2df6857d7d5d1d7

                              SHA512

                              05fcdb1089cf89b6cce19f6535a4e42adf8b2feefb6a273ab082180a3c43cbb55e0ab60a23bc00717e423228144a8825497b62dfecb469d142558148f6455459

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

                              Filesize

                              1KB

                              MD5

                              a689d3fee4d54981d79b14db6ad4af7d

                              SHA1

                              0effb4e4235cbba6c3fe9ceabb521eec82ed0891

                              SHA256

                              3f325e8f04df95808bb4a8ba5d9b15d5e5643f554725c51a2cb9ac9240eed36f

                              SHA512

                              5200e86f996e5138c162d4d5e1c8f5909b4285c837334e8a94ccb0b109c3d6adf18c687a95837fa753817ab79fea8a6b1d862e0622c27a74812babb430c7cf17

                            • \??\pipe\LOCAL\crashpad_3164_JMCUBOWODEGRWNHP

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            • memory/1412-350-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-414-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-61-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-198-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-433-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-421-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-260-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-416-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-54-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-415-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-289-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-17-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-413-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-21-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-20-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-331-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-19-0x0000000000991000-0x00000000009BF000-memory.dmp

                              Filesize

                              184KB

                            • memory/1412-92-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-351-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-403-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-363-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1412-375-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1956-0-0x0000000000860000-0x0000000000D18000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1956-16-0x0000000000860000-0x0000000000D18000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1956-4-0x0000000000860000-0x0000000000D18000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1956-3-0x0000000000860000-0x0000000000D18000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1956-2-0x0000000000861000-0x000000000088F000-memory.dmp

                              Filesize

                              184KB

                            • memory/1956-1-0x0000000077D46000-0x0000000077D48000-memory.dmp

                              Filesize

                              8KB

                            • memory/2216-362-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2860-418-0x0000000000990000-0x0000000000E48000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4116-46-0x0000000000191000-0x00000000001A5000-memory.dmp

                              Filesize

                              80KB

                            • memory/4116-47-0x0000000000190000-0x0000000000802000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/4116-58-0x0000000000190000-0x0000000000802000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/4116-37-0x0000000000190000-0x0000000000802000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/4624-56-0x0000000000020000-0x0000000000692000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/4624-60-0x0000000000020000-0x0000000000692000-memory.dmp

                              Filesize

                              6.4MB