Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-09-2024 04:55

General

  • Target

    eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe

  • Size

    1.8MB

  • MD5

    1ee73753a0b72f8626580ad785e1838c

  • SHA1

    472801cbedda05c4ebfd13c44941ebabde085100

  • SHA256

    eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2

  • SHA512

    1efdc2c3de948d3203916a68c1eec289f1332c05b1345f84a61df48f074b4bdd7fad1811ec3944bf63e43ba8cffc0ea9ff334ff90421b24c2623ab4f0ff12023

  • SSDEEP

    49152:2za4sgwo1Sp4yjYMe86P8T52ebbwHZKNup:3zCwYN78HA5

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe
    "C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3848
      • C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3444
      • C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:248
      • C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe
        "C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
          4⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1332
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb50193cb8,0x7ffb50193cc8,0x7ffb50193cd8
            5⤵
              PID:4124
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
              5⤵
                PID:2864
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1004
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
                5⤵
                  PID:2836
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                  5⤵
                    PID:4104
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                    5⤵
                      PID:436
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
                      5⤵
                        PID:2536
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
                        5⤵
                          PID:1536
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
                          5⤵
                            PID:3080
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
                            5⤵
                              PID:4300
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4384 /prefetch:1
                              5⤵
                                PID:2400
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
                                5⤵
                                  PID:2556
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7272 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2348
                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7572 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1412
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4552 /prefetch:2
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3604
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3980
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2768
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1836
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4624

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\ProgramData\mozglue.dll

                              Filesize

                              593KB

                              MD5

                              c8fd9be83bc728cc04beffafc2907fe9

                              SHA1

                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                              SHA256

                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                              SHA512

                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                            • C:\ProgramData\nss3.dll

                              Filesize

                              2.0MB

                              MD5

                              1cc453cdf74f31e4d913ff9c10acdde2

                              SHA1

                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                              SHA256

                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                              SHA512

                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              95883d76d2c5ad3bd6a44e018cab1112

                              SHA1

                              654052d8d94664de1f0ba31858c5f16528c4ebb1

                              SHA256

                              e27326b1de0951f47acac242a4e34ec9ea6d382af040994ef54169a641d60e6c

                              SHA512

                              ba6641921605f53ba937962677c3fc738919835171a200c5f34b11db3455826335e31775f7ed55f61b9fe14e2f6c820edef6a26c55ede2c0ada038f8bc228200

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              b44d917907c60a9e56586bffdde3a705

                              SHA1

                              7522805bbf7c03c3458348a5558b3c55fa2538b4

                              SHA256

                              8b2112afc4477c14179a065bf2e60c099f47691b315a8c77dc1f269502541b2c

                              SHA512

                              21bf74bfb046655b09ab75ae1d46bb4c823c2fe15c05e1aa6adfa9af16aef5787926eccca6b2f2ab0c2b3aa212051e4e301551f35bbf8edad205f01853e4ccca

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              12352c0bf8923a856075654e800e919c

                              SHA1

                              58aa48ea507e3980078575c4b661a54251e857ea

                              SHA256

                              fcaf742435636963ddc5dad1380de6a03c11fa56f94bf1c9269db70b5a26673b

                              SHA512

                              274c374a3c208244e46a7f7b6b7d5acfea15ac8229f42a959b711ee666f40be36582320fe080fd00bd9360970ac3b787f1540c0ee1c493b4ba31f72a0188595d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

                              Filesize

                              20B

                              MD5

                              9e4e94633b73f4a7680240a0ffd6cd2c

                              SHA1

                              e68e02453ce22736169a56fdb59043d33668368f

                              SHA256

                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                              SHA512

                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              336B

                              MD5

                              cacadc7e7bd23d153c9f5668a18772a1

                              SHA1

                              efda606e49734f0c264e66d089e869bcd5b4562d

                              SHA256

                              a2a694a06fec7475d0268ae6bc76be42cd19c67ca812b83440fc18c4d18d9328

                              SHA512

                              89fae2d99c8729a9fd5c1cc8081986da3780c307340f55dfb2ecd05c654fdca0d42b0d1b66dd23a77977e6f98953df61249c112ab3947b9738884ee7cd4d7aea

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

                              Filesize

                              41B

                              MD5

                              5af87dfd673ba2115e2fcf5cfdb727ab

                              SHA1

                              d5b5bbf396dc291274584ef71f444f420b6056f1

                              SHA256

                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                              SHA512

                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

                              Filesize

                              1KB

                              MD5

                              c6e1e3976d596a0b69133fc7eb673fac

                              SHA1

                              ed9eebc350e8dad2c9e306ea3eb9ebb7718ecc51

                              SHA256

                              2a42b1c8d0e22ccd472311bbb9d9d2777c879a9d433b5daf30c86c1228330664

                              SHA512

                              ee66ff1fcded0ef7494d9615e0f00208f369dc2fb4eadd014ddd62bc3d75b623c3b99776e51ec55b107aca9ef22b23028bff943ee003a469718843a8be0acba9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              59B

                              MD5

                              2800881c775077e1c4b6e06bf4676de4

                              SHA1

                              2873631068c8b3b9495638c865915be822442c8b

                              SHA256

                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                              SHA512

                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              1911f7344ea5bcc0a1e73cb19b8b5da2

                              SHA1

                              951f062c277471166101e65f10ef8612c9d75e3e

                              SHA256

                              99d3ea1b6dbb5c2c99cc21622ce9c283e2b4c733fa81af4207cfb5beed0afe0c

                              SHA512

                              2000407871ebaa15893509f6763d03ae4e729a774d72245188e9b794ee281723cd95741046d2751fa09b7b668fca2d6e3dfad56400d3cf67355cb03973b9cc07

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              d606382c71c01fdbdd82c50e3b2379a6

                              SHA1

                              bf6854c291a6a3c426ff700cf7df92ae8f1e0109

                              SHA256

                              87662743821bcf8060d2af153b59be907a019c6feae1b432bfa1deb44067ab90

                              SHA512

                              6641f7221f53a73824573d090486d1b7968f9ecec66343691452f0c17f9c4a043fc6e71fe1e6d8b487dee24d25a6be0a88db619897aa5b052b667fee8705f214

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              3d64dd18a77bc05b7cafbda171ef7e16

                              SHA1

                              53cb9767039ad17556d65c9a1e9a48fd2a50c7f4

                              SHA256

                              86178ebd4b9f0410a6e86ba63a7eaecf7ff1f2e14703964b8befc810613fdd61

                              SHA512

                              7495c7e28a35f56bd505be5023279f839839aa25451bad3b80d1b10ca4766f36e76d090bd0d2109b7fb9d7d6068f008b6e35eab6d58fdb1c7a31e6db03e1ece2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              38196c236c320de5304f822b56ffa12a

                              SHA1

                              52e3c43ccadfd7776edef5e80446bec97f1a43c5

                              SHA256

                              98b77997e8cbe80afc6cc94c22d6736f83ee303caae67f17b85ae98539f1f8f5

                              SHA512

                              e10e8097357a5a64c2c7e6fcf2e506024836be6768c702dc11d2bc468940637c6d5f4e66673e58fb756481848126337a416c5c1293d52462954df09b3e18fb5b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              3KB

                              MD5

                              2dde31d3340876a58ac507dc3a40151d

                              SHA1

                              d27806154e0be5ff23461353a48ecf3419bd6fef

                              SHA256

                              2f6f224e69636f94ce04b2dcb1293212813f7c33e3af03ce4dedf0266d2d59d4

                              SHA512

                              2a1dd3be1fb9a6de43a82421dae3f0cc8bf390b7e86a7c2bfcca44cb2e1a9e52b940168aef58e267a0baaf2f5c8c25ae7605b9796ff1a054a89039d932c78891

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57cb20.TMP

                              Filesize

                              3KB

                              MD5

                              4652dffabcb69db4306ad4b99363921c

                              SHA1

                              f4c3a310a265c744b55ba05c15c76221886c6a40

                              SHA256

                              dbc608e074023d00c833c61f33eb365cf82658c8d3d81d5d9b1f8bfd8f93720b

                              SHA512

                              c1d911bdf21e6dc2bd7da5a6b0bbdb4530f7573def86642231ef6db38491b1f7af1b246deddfc3c6a6a3fc14d502a906e4392751e96f55cb92a059d6515a1dba

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

                              Filesize

                              26KB

                              MD5

                              6eeaa4af4bb31cd560a16378db6cbc2c

                              SHA1

                              c188b7e5d17d81ae256a3f4dfda5f49c82bee56a

                              SHA256

                              ffab28e8bc54eeba258b7875c23e79a49f40205d48323f5c91fd004b8ca6a0ff

                              SHA512

                              b2a01726d506699f450831cf237c8f489a83525ff49e4f7c5bd6baa26150500afd45d1d179763eb2bc000cbe14ac00b7e1ac460afd4c80dbe45def4ed71d155c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57f2cc.TMP

                              Filesize

                              25KB

                              MD5

                              02b7662d542929ef6a41ea340b09f74e

                              SHA1

                              1cb35adf9e1bc04ff645f36b4ecb2bc05820123e

                              SHA256

                              ff71b5b89a2d35bac2859e9f1f4585531bcdaf46b23c097e7da112187d7461a0

                              SHA512

                              68e14262be2e92617a172ec544b9816c61e99fcc595cea0ee59bf554a3b189d6dafdc9be170e410a84ee196a96972ace5da1722102123100f0114cf48202c3a4

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index

                              Filesize

                              48B

                              MD5

                              0e1e16d186532c62e800ac401b5014e6

                              SHA1

                              24b53066880aab36dcb20d173426c1c5940ffc08

                              SHA256

                              180c015318105e1823aaeff1bdef91e4a897e3ea587ac3a53b7090bc3593979f

                              SHA512

                              9cbab1ca631a4f672589f08570f25559ccae3d9004cab7ed265d04d180b112e9b67fb6e10f86fe4b5bafef1078a75c59e03c76d5367fca39ef1acf6dee2a8de6

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

                              Filesize

                              8KB

                              MD5

                              cf89d16bb9107c631daabf0c0ee58efb

                              SHA1

                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                              SHA256

                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                              SHA512

                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

                              Filesize

                              8KB

                              MD5

                              41876349cb12d6db992f1309f22df3f0

                              SHA1

                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                              SHA256

                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                              SHA512

                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

                              Filesize

                              203B

                              MD5

                              2ea0c71301e5305832bb9f72fa81b998

                              SHA1

                              a1b2368d351ba44689e0e97f5b1a2630ba78fd4d

                              SHA256

                              3c9424f4fb700d440fa13b45f36366052993b54876172b0570b34acbf64bdcbf

                              SHA512

                              a87f4bade7f30c12a1fb68b883270a7b42493572cf43857ff4072797f9b2eb10f6bca9050b4231d1dbf2be48ff1fa2c8048bf5d1dc8bcde28b009773e57527e8

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58efaa.TMP

                              Filesize

                              203B

                              MD5

                              2af9014ec43ae463112e3cda7f1439e4

                              SHA1

                              b685d890a55de0c973e7d5f6d6ca573c1bf01d6f

                              SHA256

                              85eacdc882892b8128b9857cf867909b24990f7206dd327d2a271a9f5843cd0b

                              SHA512

                              3455a1c2952e1e8021ac01ce93cac816e3c77d9471c8611de743d82f713a7257d0b6ebd7a1366fb6f24565e6bac54f75f752771fadbbc6e8873f49a0c7f0e377

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2

                              Filesize

                              8KB

                              MD5

                              0962291d6d367570bee5454721c17e11

                              SHA1

                              59d10a893ef321a706a9255176761366115bedcb

                              SHA256

                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                              SHA512

                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\a0cb652c-a556-49f8-ac5e-2ea9da0ef957.tmp

                              Filesize

                              9KB

                              MD5

                              c659160a642445e2c444685771622399

                              SHA1

                              dc51ae9943dcf5369ee3718f0d4d45b6a2e1d12c

                              SHA256

                              3b701bb826efaa1945429034d60904811a454391feb83089519daf9ed0383158

                              SHA512

                              3651222f3f75149157e92cab46f3d0aa05b4535ba60a3ffefb8c2d14856858691a2a3065ae6d5a66e14539b116557af634886f2b44507f371ca265b10ea40e31

                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                              Filesize

                              1.8MB

                              MD5

                              1ee73753a0b72f8626580ad785e1838c

                              SHA1

                              472801cbedda05c4ebfd13c44941ebabde085100

                              SHA256

                              eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2

                              SHA512

                              1efdc2c3de948d3203916a68c1eec289f1332c05b1345f84a61df48f074b4bdd7fad1811ec3944bf63e43ba8cffc0ea9ff334ff90421b24c2623ab4f0ff12023

                            • C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe

                              Filesize

                              896KB

                              MD5

                              e2ab2436433949f8959e5e5ff74e4e8a

                              SHA1

                              cee3a8c173207a0ee04dc07e66378c80528f93dd

                              SHA256

                              ba0c008b44599da07ba9545833d4184d9b17b980fd38963fcd25e1d6d312f99b

                              SHA512

                              2d69fae0fc6af7cef780b89999f4a952609d95e630167e5d39ad6d393a04cf031cae28e39a6d987e44ed6d3abcecb066cd5fd899b0a6e49c15887fb366eeb39e

                            • C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe

                              Filesize

                              1.7MB

                              MD5

                              b3a239beeb5dedb7629a68e9ed216d4c

                              SHA1

                              f8092284123f59a72267611ef31fb60759eafbdb

                              SHA256

                              f539c6ebab703708ab993bacab000fd97274d49364bf0d58a2df6857d7d5d1d7

                              SHA512

                              05fcdb1089cf89b6cce19f6535a4e42adf8b2feefb6a273ab082180a3c43cbb55e0ab60a23bc00717e423228144a8825497b62dfecb469d142558148f6455459

                            • \??\pipe\LOCAL\crashpad_1332_XSXCAQCDOUYDXYSX

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            • memory/248-309-0x0000000000850000-0x0000000000EC2000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/248-391-0x0000000000850000-0x0000000000EC2000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/248-310-0x0000000000850000-0x0000000000EC2000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/248-56-0x0000000000850000-0x0000000000EC2000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/1836-422-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1836-423-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1976-5-0x0000000000660000-0x0000000000B10000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1976-3-0x0000000000660000-0x0000000000B10000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1976-2-0x0000000000661000-0x000000000068F000-memory.dmp

                              Filesize

                              184KB

                            • memory/1976-0-0x0000000000660000-0x0000000000B10000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1976-18-0x0000000000660000-0x0000000000B10000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/1976-1-0x0000000077966000-0x0000000077968000-memory.dmp

                              Filesize

                              8KB

                            • memory/3444-262-0x0000000000680000-0x0000000000CF2000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/3444-166-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                              Filesize

                              972KB

                            • memory/3444-272-0x0000000000680000-0x0000000000CF2000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/3444-38-0x0000000000680000-0x0000000000CF2000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/3444-261-0x0000000000680000-0x0000000000CF2000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/3444-342-0x0000000000680000-0x0000000000CF2000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/3444-51-0x0000000000681000-0x0000000000695000-memory.dmp

                              Filesize

                              80KB

                            • memory/3444-54-0x0000000000680000-0x0000000000CF2000-memory.dmp

                              Filesize

                              6.4MB

                            • memory/3848-434-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-21-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-105-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-420-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-209-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-234-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-424-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-257-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-446-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-358-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-22-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-401-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-474-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-20-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-19-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-484-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-485-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-505-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-489-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-490-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-493-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/3848-16-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4624-488-0x00000000004E0000-0x0000000000990000-memory.dmp

                              Filesize

                              4.7MB