Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-09-2024 07:33

General

  • Target

    d3d9c29e91ab395b758f67c897c209b2f64ad2de6f8a2ef2b62965a995cbbf16.exe

  • Size

    1.8MB

  • MD5

    3bdc7e756889b37a74b5004d7c07be4f

  • SHA1

    521d481d6e8f8bbb9b9e73270fb574e32651cb53

  • SHA256

    d3d9c29e91ab395b758f67c897c209b2f64ad2de6f8a2ef2b62965a995cbbf16

  • SHA512

    5c17e749b2c4aad764d143fc1e489eb7e5241a6d01c7a5d0e35b8ea815b62f9a95dcdc35638b782888922af2011963f199a9a9dd66d890317957829f56dd8c5d

  • SSDEEP

    49152:spWu9EytQgpXB8xV34984FV/vCeY8Vl39:XoEytQg9Bk68ghCu9

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3d9c29e91ab395b758f67c897c209b2f64ad2de6f8a2ef2b62965a995cbbf16.exe
    "C:\Users\Admin\AppData\Local\Temp\d3d9c29e91ab395b758f67c897c209b2f64ad2de6f8a2ef2b62965a995cbbf16.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4388
      • C:\Users\Admin\AppData\Roaming\1000026000\48b653eb59.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\48b653eb59.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:900
      • C:\Users\Admin\AppData\Local\Temp\1000030001\956a49b81f.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\956a49b81f.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4696
      • C:\Users\Admin\AppData\Local\Temp\1000040001\ddca894545.exe
        "C:\Users\Admin\AppData\Local\Temp\1000040001\ddca894545.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
          4⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff975183cb8,0x7ff975183cc8,0x7ff975183cd8
            5⤵
              PID:1036
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
              5⤵
                PID:3892
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3660
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
                5⤵
                  PID:4712
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
                  5⤵
                    PID:552
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                    5⤵
                      PID:1960
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
                      5⤵
                        PID:2040
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
                        5⤵
                          PID:1592
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
                          5⤵
                            PID:2916
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
                            5⤵
                              PID:1628
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
                              5⤵
                                PID:2488
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
                                5⤵
                                  PID:3908
                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7608 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3484
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7264 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1160
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,696133570849363787,14338800830392759487,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4144 /prefetch:2
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3140
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4872
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2176
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2888
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4800
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:748

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\26e9829b-df9d-4a08-8b89-b5d4325c058d.tmp

                              Filesize

                              9KB

                              MD5

                              1b777586c2d716f116e48fc329c80a58

                              SHA1

                              b144eb4b52c62b511504bbe956691ad7ba09eb35

                              SHA256

                              aefdbe6e26789e3888f7480e7aeb5158ec503fc9d8dc5cd5334a84a53ac696ac

                              SHA512

                              fe34cb4d7bda61958f5d9f89372d79e1149d05df1ffb5a45f09f11cc1e1c1ce244e18c78fc11fd8ba90836fcef080d5275526000ff6bd00c84930d48e1b65269

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              4b6760e6b8431d4edd29ee59806c098c

                              SHA1

                              a09977ad4e4f5fe5967a730e384177f924cc4292

                              SHA256

                              15b415ff5a386d6d4d52fb5d3e80ab01d564aff219e0a668e3b480bb77f862b6

                              SHA512

                              6080237c2c771e9cd0e83b493fff2d8e0138d90b733a7082e10b069fe7f3620705ff4a3b5b70c6a86b2b4a2b0fdacf8128c7edd3cf35c9bdd7fb6ab83504ebfe

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              744312889a05338d39a87ae98d19ab6a

                              SHA1

                              27af129b1283a4757b9ab0e7f87eca7a4478aca4

                              SHA256

                              06a9993ea5c56a5bc7af55884f1a5ef26b35e8846477ab1fd65ff9d6dc0002f4

                              SHA512

                              9986b545c6f18b8f6705d5ccb2fd348a859cc2169e39934621de5925cd25c0b8ed9e9056c4cca793cd4ac0562852ac548bd026c43e6f934a1bc99eac872882ed

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              96daf963da50a5251c6aab93d042cf29

                              SHA1

                              babf7ee7d9ee2c8cab520538d0e21b24a4a702a0

                              SHA256

                              b5c8a9b57f81be1ddfafc759850e5863feae7154b066a0fd2d042f9e4e16916d

                              SHA512

                              4d5a51cebc898f95f89a26cbd44365229b74f4e74635377d5cd4cbf75c05c17314dd7724a21f4b2e4890988366510839974e3f97abc5ceaee860cc510f440615

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

                              Filesize

                              20B

                              MD5

                              9e4e94633b73f4a7680240a0ffd6cd2c

                              SHA1

                              e68e02453ce22736169a56fdb59043d33668368f

                              SHA256

                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                              SHA512

                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              48B

                              MD5

                              b3f3d7d423fb16c173f4fff0e8a4f8cf

                              SHA1

                              113cb462af617cbb9df676531b6c32d2a37d31db

                              SHA256

                              c332fd8e0666aadbf642a3f7994e38148ccf7cc90ddfbc3eeed1ca9f0c1f49ea

                              SHA512

                              9ae08b547eab930fd9dd39ed93cfcb0f8b55821b6a21c101cb7df0529d9c7f8d80a0d8f385b0b22a1c5d4b22d7534dacdc0feb662472d7b02178ee9bd1693109

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              336B

                              MD5

                              4abef54b4d9a44e051e0555a2483563a

                              SHA1

                              6dd23a827c06723ceaaed34d91a3de312bc736c8

                              SHA256

                              315666567c12ef9a01f5170afc108f868efb17adf433717aaa689c8027dbe24f

                              SHA512

                              69e287ebddf20e3419402d91bac7496fab83426ddc5044329d169fb2653eceef5ffe979d7c8fd2cf85e8dc163cc721a5fcc0ec5f998baafc6e5edd4505bd1af0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

                              Filesize

                              1KB

                              MD5

                              3d29e1b9351baba570d7cd8e31a34af8

                              SHA1

                              0de7077877404100ec7502304bbf7cb54b288ca9

                              SHA256

                              01fbc6e251a3be3da5d15062d94b47c56989b5638974cd030bc19b5f81c80812

                              SHA512

                              dd76e9162d7962a41e4e84d713ecd399881f17bd3c52801c9d1bbddcbb55dcc16f214687c5acacebf0691bb1d3083bf1dc006fdcbb01e7ce9e19b14d6d10fc90

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              59B

                              MD5

                              2800881c775077e1c4b6e06bf4676de4

                              SHA1

                              2873631068c8b3b9495638c865915be822442c8b

                              SHA256

                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                              SHA512

                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              d473f4ed80dc1f2bedd445ee11af9713

                              SHA1

                              7ebe90d327bee8069b4aeeb44ee5e0fa5a66c016

                              SHA256

                              87f392ae534a9604604f88bb9c1a146ea53a84e2aebfd687bc1554b47e6f0303

                              SHA512

                              6e250a688107cac29afa3919dc7907adc0cfbf8c5e60a43724516ab641a61b8325eab06a7c0a9e4a655d6412216bf4346fc67af066e82703fea1f29f480441d2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              81ac23f4a69d5c3b7f5f3a6add337b52

                              SHA1

                              bc94c967846ee101e384f6436dcf8addeadacdd7

                              SHA256

                              6e1b7bf3cee0b7aa9356cfdc3e65df2ed32ac14113e337a34a6cd8150876c1ca

                              SHA512

                              de12e7536b5135e6b34d40ef4e46e2ca2d8c395f115177e9d671445a6d0bdc003355d3e56c197ad620370c194149b2825ba46e2af75e112c433256be8062f0d7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              3KB

                              MD5

                              b56df735abf850c0c2b93693f2edca41

                              SHA1

                              4112cca4305bf5d2be02de4ad06703fd03c841dc

                              SHA256

                              f4cdc1faebfde1ca4b23b3a15b31a9185a3c1c11b51a29e123c395df0c89b26e

                              SHA512

                              14a491a3ab71d901cea632d49bf4b1aa8e0489d5ef14f8912b2299c9fdf6464b8076b597da3063e4489dcb867630da2e52b81ddf8ed5bf979f261539d309b91e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              1781048b24fc2ee9af6f399d1230e3e0

                              SHA1

                              d5aa35dd5e5a8d2c7a38a1491841181e14b2c0a2

                              SHA256

                              9881a82dcbe8780262d0e5e628d171090c227e7d81e0b86f4fa35f0999cd1a92

                              SHA512

                              c7890a78159f26ff5fd4f30d5ad07f3335001614721fcc93e66ec6355095f2c5d3d6575f6915fdd017975c255d6fd8004cc0cadcbbc81326546dcee60d12c964

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              8b169adc00fdba176b4144d943688cb9

                              SHA1

                              13c44d615820ebfab8808ef61b2a0c814e091587

                              SHA256

                              dcfe0bc2635bdebc5dcb9bd0791bd313bcb200c464ca0144d1abe3acf916158f

                              SHA512

                              fde0037beadf44cb11f3579dbd35c441c436a1cefc0be969a98b49ca0403175a6a76879758dc6b92c1244a6c484f47c7da55238abaefd7fa6eafc48c991172e4

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57c841.TMP

                              Filesize

                              3KB

                              MD5

                              16204473ea3c7089444412993afbe0cd

                              SHA1

                              cc07e2899ca7e373881544535c7bf6dac210129d

                              SHA256

                              1f2f1cc6615ee3b31761362a2b036be2bc61065f597beb1cefc1fb3bd047b989

                              SHA512

                              9d1b04abb2762e96253da1f0b122ea47f3c34c7b99982c7389a9ec10089c12ed8b707269b05525693414ebe3e74cb3ca3c2a867456ef178232de8401e53ca7fd

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

                              Filesize

                              26KB

                              MD5

                              edcaa901a8123bfcb1ceab7d1d19ee1d

                              SHA1

                              282fb6d927b57f727e78dd12508404db9c1d4ec0

                              SHA256

                              f84e5342190efce3a77a4d89e71dadf8744fcc972a147e1fd7df767a58c77092

                              SHA512

                              5ae828ec07f626c6a42d6dd2f138edbeb3375496db93ce33a2f1dd8d114a7fe99aebef7c7a265e7d0ebbb73096338e76ea97eb99080a4f358dda398b3239c23a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57ef90.TMP

                              Filesize

                              25KB

                              MD5

                              98fb7f314a633d04d1704a2396a21803

                              SHA1

                              92349cf81577cde31d9548c1fa5129230dd0226f

                              SHA256

                              06e6c01df66f8cbd254ddc9c7533eb1045d8de95905ec4025eed6b9e1cac4b76

                              SHA512

                              0fc6f58b0fad5b111a9c904e41eb48d9c52719cf6c898ddd79b9ecbae4ff81f7c74bc7d4cf2479f6be51e5779356acc9e18f4bbbd82cfc6f484bc6ba433f37af

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

                              Filesize

                              41B

                              MD5

                              5af87dfd673ba2115e2fcf5cfdb727ab

                              SHA1

                              d5b5bbf396dc291274584ef71f444f420b6056f1

                              SHA256

                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                              SHA512

                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

                              Filesize

                              8KB

                              MD5

                              cf89d16bb9107c631daabf0c0ee58efb

                              SHA1

                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                              SHA256

                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                              SHA512

                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

                              Filesize

                              203B

                              MD5

                              c2ea926f807535cb3dc6a6de2808fed3

                              SHA1

                              8fddd0c959a8d5234ffa76e9dc2915b3f57dc17b

                              SHA256

                              3bcee583417f568cf35762341816681e26b695eacf1bbbb29adbce384e783ba1

                              SHA512

                              fef911d8d1ec750d3e2ef2a5e251fa8f93b922d6da1d47f8f73109048c1b1c76fa892e37ce89af58927fccfea10eb3f7b1ff99a78727e0678488e9522e6460de

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

                              Filesize

                              203B

                              MD5

                              093868ed9728cfa09a50a517846d2f1f

                              SHA1

                              d9682fd394e8676519435bb5aeaf06c431cfc375

                              SHA256

                              4c04faf4cdc62466079c88e197e152dfef44a5b841d5a035f46e55413b2c0ebe

                              SHA512

                              448ec589db5a6193a0223cd3b01f8e6642f9aa5f919aed4a40bfed4b941a46db6a14e19bb588ee535afd8b28be4be42f2733657671ca23d92c629f73aa03b4a2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58ebf1.TMP

                              Filesize

                              203B

                              MD5

                              a8640c31661f37f479613ad9033b9994

                              SHA1

                              f83d1295140ec3b9b0667de3b5909b67da0b5ffa

                              SHA256

                              ae0328c49f0374007d04899eb6e1c1be554877f04a8c8f485542adaf58d57425

                              SHA512

                              0b2c0d309f31d4d78c59add2aafdef219c4f0acd6e01b46412fa0583386d659a395c273c9593e12a5823545e6982281aa402771bb453e2955d69af88fc162401

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2

                              Filesize

                              8KB

                              MD5

                              0962291d6d367570bee5454721c17e11

                              SHA1

                              59d10a893ef321a706a9255176761366115bedcb

                              SHA256

                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                              SHA512

                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_3

                              Filesize

                              4.0MB

                              MD5

                              2b02a61508b5857937745e7b5a87cb9c

                              SHA1

                              1dd21e40002ec6199751dee6fddd2fe0d79f31c2

                              SHA256

                              25f6019b7563053b4796dda357d96d106a98aae48b732a9a4b7e598f9aa5e6a8

                              SHA512

                              c8beda8d2c35632700fd719fd656e5d204518ef0568221ce07e4520e0ce1e2d2ac9136f1ddf3e21fddbd7dbd2fc55dd0e71a417cbb6b7bc1182d739b02710b0d

                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                              Filesize

                              1.8MB

                              MD5

                              3bdc7e756889b37a74b5004d7c07be4f

                              SHA1

                              521d481d6e8f8bbb9b9e73270fb574e32651cb53

                              SHA256

                              d3d9c29e91ab395b758f67c897c209b2f64ad2de6f8a2ef2b62965a995cbbf16

                              SHA512

                              5c17e749b2c4aad764d143fc1e489eb7e5241a6d01c7a5d0e35b8ea815b62f9a95dcdc35638b782888922af2011963f199a9a9dd66d890317957829f56dd8c5d

                            • C:\Users\Admin\AppData\Local\Temp\1000040001\ddca894545.exe

                              Filesize

                              896KB

                              MD5

                              050d26eeffe6efea8fede3819008d0ec

                              SHA1

                              ff47f67781789840950a438ca17e9ff5ab90c2f1

                              SHA256

                              6010ea1717d7d8686b599dc76f56ba73200d7a468fdf8ac15f62c93d7474ca6d

                              SHA512

                              da160342c781f44a0c632b62c795b5ddb917c1a213bc36bd481d84ef1ac72300b92724ff802b1fad1525728238ef692a049289c913ca3c1fc04450ffcc67e259

                            • C:\Users\Admin\AppData\Roaming\1000026000\48b653eb59.exe

                              Filesize

                              1.7MB

                              MD5

                              57c6e06abd1cc20c23a17b53710c0443

                              SHA1

                              758a300c82d765a895f14552977e491884eaf7dc

                              SHA256

                              bf2775113aa41adedc67907cfbeb8bc1372cc00b39b65841dff1ab604f3f9c99

                              SHA512

                              17c898f97990267afba851ccf4125b74f4a965469d1c73d26b501474acafee64e41f1863a438115ec705f3927b298c30050cef4571900f89a01e736f0eda1e23

                            • \??\pipe\LOCAL\crashpad_2112_LWMBMBBVRLLQFYNN

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            • memory/748-421-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/900-56-0x00000000000F0000-0x000000000077C000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/900-37-0x00000000000F0000-0x000000000077C000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/900-46-0x00000000000F1000-0x0000000000105000-memory.dmp

                              Filesize

                              80KB

                            • memory/900-47-0x00000000000F0000-0x000000000077C000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/2004-2-0x0000000000681000-0x00000000006AF000-memory.dmp

                              Filesize

                              184KB

                            • memory/2004-0-0x0000000000680000-0x0000000000B37000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2004-3-0x0000000000680000-0x0000000000B37000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2004-1-0x00000000771D6000-0x00000000771D8000-memory.dmp

                              Filesize

                              8KB

                            • memory/2004-16-0x0000000000680000-0x0000000000B37000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2004-5-0x0000000000680000-0x0000000000B37000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/2888-219-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-193-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-57-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-330-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-442-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-349-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-350-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-360-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-372-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-17-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-220-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-215-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-288-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-402-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-19-0x0000000000CF1000-0x0000000000D1F000-memory.dmp

                              Filesize

                              184KB

                            • memory/4388-21-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-412-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-413-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-414-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-415-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-418-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4388-20-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB

                            • memory/4696-55-0x0000000000130000-0x00000000007BC000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/4696-221-0x0000000000130000-0x00000000007BC000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/4800-374-0x0000000000CF0000-0x00000000011A7000-memory.dmp

                              Filesize

                              4.7MB