Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-09-2024 08:33

General

  • Target

    d5bb00a8a963b74b9db3ea39e270713ff9bf3cba4b1c70a7495381c945f779e5.exe

  • Size

    1.8MB

  • MD5

    2dc5b1c2a0728e55da15ca822725e1c7

  • SHA1

    482947a5e11b281838a2427b08311b29b4c63b88

  • SHA256

    d5bb00a8a963b74b9db3ea39e270713ff9bf3cba4b1c70a7495381c945f779e5

  • SHA512

    0d2e2b2ccad99c7dfb9b40de3d03064e7661919a1810fb383e86cd9d61d8ca37663df139f8357dd38883bd5c9112a63c95ccb187ea460c4c4dda41a438e6e93b

  • SSDEEP

    24576:LDr1u4CdhUAJ8JfZ3iamHB6Q6bUEFDa164cdSdpfMKmNUMsa1nFi9ikpNs5hph:zk4Cdhi3iasBrsPDa1PP3O1r1qk5hp

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5bb00a8a963b74b9db3ea39e270713ff9bf3cba4b1c70a7495381c945f779e5.exe
    "C:\Users\Admin\AppData\Local\Temp\d5bb00a8a963b74b9db3ea39e270713ff9bf3cba4b1c70a7495381c945f779e5.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4000
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\Roaming\1000026000\26d081364b.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\26d081364b.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3068
      • C:\Users\Admin\AppData\Local\Temp\1000030001\77daf73cc1.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\77daf73cc1.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3508
      • C:\Users\Admin\AppData\Local\Temp\1000040001\dfe4c41411.exe
        "C:\Users\Admin\AppData\Local\Temp\1000040001\dfe4c41411.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4316
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
          4⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4672
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ffbb5b43cb8,0x7ffbb5b43cc8,0x7ffbb5b43cd8
            5⤵
              PID:4760
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
              5⤵
                PID:2800
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2012
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
                5⤵
                  PID:4088
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                  5⤵
                    PID:4392
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
                    5⤵
                      PID:3864
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
                      5⤵
                        PID:4956
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
                        5⤵
                          PID:4636
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
                          5⤵
                            PID:4816
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
                            5⤵
                              PID:1368
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
                              5⤵
                                PID:5028
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
                                5⤵
                                  PID:3024
                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7584 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:112
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6992 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1784
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,13002552273969118712,4078044500502858522,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4984 /prefetch:2
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2656
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4952
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3836
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2832
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4452

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\79fc9854-4d45-4955-aa30-9ede789da388.tmp

                              Filesize

                              9KB

                              MD5

                              e6b2a56c9606cd22264e0a9de62f44e0

                              SHA1

                              e3f3d39aceb785d4b0f6f9ee7e62580bf0f33ebc

                              SHA256

                              ecd98f153ad99d235c2cbcc13638a2c2d606593f53f59c2ef9ced100eb61e1d4

                              SHA512

                              d9e1c413cac65c9d862475765d9ae1b4d156c89d755a40e672d03350c74b92a6b80766bd1d35cd4ca6ae04cf615b1a1f4872ad725a11cf857a12a7e860e73b26

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              374fb9cd5103040ad856dda2aac7c8b4

                              SHA1

                              8da7b068faddba48dd3a846557f43f3156b424c9

                              SHA256

                              0aa6db4b846225f407e3ef1022b243135eb18f13016ba1214d9ef827912aec76

                              SHA512

                              01482ec5465780111f478d688ed02ffe97274e812231fd19b457bab83272fccbe2faba9228ff2aad4989a94aa43f93e08767f3f6f81b64540dec8d3487e4f30a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              4c7e2562f8f91026569f1d59650a488a

                              SHA1

                              2376c8ceed97ec638ca3043f9911ac9ff5966e98

                              SHA256

                              6e6dbc5a70d751b3968c195429bfbf06fe964f632d73c169553e8ea980372a47

                              SHA512

                              74e72f1dfbbe6ea6b72f3462abb5e6d0983e297a928539cff0092a31d83e01005f444ee4b04ebb7f77b06ac9d1d158d71c4ac8988d01d2b7d7dfb1a9317abc0c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              7dfc1d63a3742f488a05ecbbd5bbda43

                              SHA1

                              8eff67b829db776423ab2b17c903f26662e8698d

                              SHA256

                              e561e8a036dfef552d92d9236cf8980195d3637a137fe0d2ff95f95d3f533707

                              SHA512

                              c816e030db930874c7f0654f65729c22a10d9c63dd108dadde377baec97049a4ba46cf8398e4990c03734b95ec3298317dc93d524b5d795a7cd2aad70331e5cd

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

                              Filesize

                              20B

                              MD5

                              9e4e94633b73f4a7680240a0ffd6cd2c

                              SHA1

                              e68e02453ce22736169a56fdb59043d33668368f

                              SHA256

                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                              SHA512

                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              336B

                              MD5

                              c0a3b9a0b89ae07de64b0f2a7fdac0e7

                              SHA1

                              6ddbd641c6aebe25239921fc29c9b98dc69833d4

                              SHA256

                              5c4adab128b2de126ccd5b1f3695de189adf0295aaa1031562db618f07371b79

                              SHA512

                              f3fd14456301124df23e8a7803b01eea784de17bd325edf66913ad7557bc55a51c037d09562d27bac26e6c5e1a23da30f7fc91ab7488f35056f517116b6f4a3d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

                              Filesize

                              41B

                              MD5

                              5af87dfd673ba2115e2fcf5cfdb727ab

                              SHA1

                              d5b5bbf396dc291274584ef71f444f420b6056f1

                              SHA256

                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                              SHA512

                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

                              Filesize

                              1KB

                              MD5

                              c9b4530e5af31f7e01ea7304e072e1c9

                              SHA1

                              073436087928551ad832bc4d0f0746344af31dcf

                              SHA256

                              213e7f2929805290c33d88d7c8d1e752d20219fc306186c2b3aea547aab5f352

                              SHA512

                              235678fe237f102d89394e99d48d3c6b57f71db391823921c7d61d758ada7c8c23aa07459e7fdcf2a95b5a4daf5e2df2f4ed64ee4f5cf5dd0de33d12f32ec8d8

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              59B

                              MD5

                              2800881c775077e1c4b6e06bf4676de4

                              SHA1

                              2873631068c8b3b9495638c865915be822442c8b

                              SHA256

                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                              SHA512

                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              5eaa22dff3a3156effc7e567694d4e0a

                              SHA1

                              2308d9a221aa1a7fa98f907057ab51ba42586c66

                              SHA256

                              64883fddb86052f511ad5983c5157b8077c64e36cfeb6972330911a7b48d9430

                              SHA512

                              66e0c5c3cfa4664ccec584626d6f4d29be50ca3de9d57efa5d4f8e7fb1d151435c2c0ca974af4bb33201381f7b504013fc6cf33816524ce3c87368b228876729

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              7acc67b2d0feee3d9648ad5cf962f839

                              SHA1

                              e89c5107fbd0ab0f5272935da86a3d1ed5f3abfa

                              SHA256

                              427c7eb7a8b49b6983a064db6b6569356a1113b30a4cbce8436e31e241d8c8b4

                              SHA512

                              6343f907913994408a4bb7118ffb1fccb069bc981dc0f6050b2e1664b673c703a311ca49a30a4ab579be4c67ac44aac64e149cbb6b9439a53c2b6b422577794e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              3KB

                              MD5

                              84b9e6053ed35f6cbc45c3254f8122bf

                              SHA1

                              05e6363282d64e650d57292da1932a14f4ed9181

                              SHA256

                              a33f6f21e83bebe85c55d0c02af6110840dbc6cfbad1e40c1847f48a96e21775

                              SHA512

                              d22c1eb9cd8a8214861e43834b518696bd8c443dee98b9d3051e200f0af3fa328195f2f4de1262e9d5c45f6b58419a7fb061af25ef250c26a114c0fed80a021a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              f31929bb0242bb030ddf3baa9b94872c

                              SHA1

                              5983ff57c03d47b4a1183b05a713e0854c236f6f

                              SHA256

                              458530f2aaaeed391ee6f7f2bfbc030c598547e7faf5b43a524a6b03ee6f44ce

                              SHA512

                              0928c62e648dfad96113f8398fdb10f5ff914092d8a60253a9c5c3f37e38e6e29d201f0d201072e0d251f664793c48733702a79e53a5c4c26e94cbbcf2a95689

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              c17674dc228fe84db69b1cb0f4cf811c

                              SHA1

                              0dca15786a6b6357670f76a2a811cff4be7e4dd7

                              SHA256

                              5bd440fbd7864fdb3463823547525b77cd19c037284dcf112de8d79c8eb608cb

                              SHA512

                              a1e28cda78e55a2e7da2b17c7d6da422769389e731d1908f4de76491f4bd2fd5eef9a6aa7b5c4cabad7dc439698fd42fcf43f0bb71fa9230e81635167ab10a89

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57b46b.TMP

                              Filesize

                              3KB

                              MD5

                              8afc497687a825054622ad3661ce7a03

                              SHA1

                              9a3537e29645d4e578bc608762f67503b4548394

                              SHA256

                              4cf89ee6054422f8c4d71a9fd76e37a0671d05d73c98ddad1bea76de7c3590b1

                              SHA512

                              3ab3433e59155250d756267de91eb0e81b62977f6eeb531f4915aa73e728ac0c9d82acac136117980c10b3242989cacf9cfe0eb69f6798ebf2196cb969383c8a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

                              Filesize

                              26KB

                              MD5

                              b3d00acd7d09c1c18cd6927a494825d9

                              SHA1

                              02d0be77d54e187fab2dc146d78880a670dc672d

                              SHA256

                              2d56e649a2cfe303d43ddd5413bac4ff53f8709b5e0a54938e35f25e766200a7

                              SHA512

                              8537ea208c176db8b11cd4321f91d4386e67f91f1318cc313c009396680d88230b94816e25e8df1d3d8e1b456985312df1b986f33ae901da3c943de523a04b1c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57dc27.TMP

                              Filesize

                              25KB

                              MD5

                              f5247046280b5396ccc12fe39bd9056f

                              SHA1

                              00221e84e0a3e6c1912a556d9362d6c60b5eb906

                              SHA256

                              32f3b9a9c6355348670a4d9b0b5de9b1003058c0be9c04d0e3d10cdd52d3f0f6

                              SHA512

                              7c58f995032d470c5026f0bdd02bc3c95f14a3a96d664d720755aa4b264010441db80ec9a8a4436e318ef237f7246d4ded63c5d575683bb120c0d12ffaff5581

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

                              Filesize

                              48B

                              MD5

                              b383098af3d0e2d0dac57f1e67f67f7d

                              SHA1

                              51b59adc69187d739cdf7b03336fb2f86a4f282f

                              SHA256

                              71dd3d63517705fd06965ce3cbbbdaf5ed5e13c548764e3cf441af9303f005da

                              SHA512

                              37d2d56bfb96473e78642cc9ed211847d595027b49bd7f1f292e7013f70adc26dd7fe586a940c0c55a0ff470032a76fc06975db798600b867cf0364ea5af1080

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

                              Filesize

                              8KB

                              MD5

                              cf89d16bb9107c631daabf0c0ee58efb

                              SHA1

                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                              SHA256

                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                              SHA512

                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

                              Filesize

                              8KB

                              MD5

                              41876349cb12d6db992f1309f22df3f0

                              SHA1

                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                              SHA256

                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                              SHA512

                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

                              Filesize

                              203B

                              MD5

                              fec72dcda007795b0565ea72b3ff2bad

                              SHA1

                              b01820ec5afbe3b25f37eaf7c99b2e44bc716eb4

                              SHA256

                              d34052ff6ad27c0e92ad2cf02485d9d2e9ca125f403695c229d6a6e846868bca

                              SHA512

                              ceb486b4a66ae654edb8637a5deb48bfad3c4f14ad22690d4b4a4ad316fc1ccb30c48edea9f98579800d3820d8f21da06a06b44dcc3a04f2c76a84bd6c5bb2b3

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58d879.TMP

                              Filesize

                              203B

                              MD5

                              54458783a408c9ff7bf9dc4c37007f00

                              SHA1

                              ad4bcd50adfc66aeda758507f3da5b231f053d59

                              SHA256

                              b9960f3af5521ed400f7d5e18df0d1de4f689fd0d82f8be5c4e5dcf3282766a0

                              SHA512

                              db8952925a16e58d6f1dbe642ca79631491f5a0bf1fe3063440210e5364050fef6ef67bf04c28f601cfed5816796fe28a37c4713d6c97cfd936d09cc6978f44c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2

                              Filesize

                              8KB

                              MD5

                              0962291d6d367570bee5454721c17e11

                              SHA1

                              59d10a893ef321a706a9255176761366115bedcb

                              SHA256

                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                              SHA512

                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                              Filesize

                              1.8MB

                              MD5

                              2dc5b1c2a0728e55da15ca822725e1c7

                              SHA1

                              482947a5e11b281838a2427b08311b29b4c63b88

                              SHA256

                              d5bb00a8a963b74b9db3ea39e270713ff9bf3cba4b1c70a7495381c945f779e5

                              SHA512

                              0d2e2b2ccad99c7dfb9b40de3d03064e7661919a1810fb383e86cd9d61d8ca37663df139f8357dd38883bd5c9112a63c95ccb187ea460c4c4dda41a438e6e93b

                            • C:\Users\Admin\AppData\Local\Temp\1000040001\dfe4c41411.exe

                              Filesize

                              896KB

                              MD5

                              aeb3199842bd01689c760b56f68ddfbe

                              SHA1

                              6977fa5ec8c7d0908dcfce3202ba5ca5905c75e5

                              SHA256

                              a6d9dfa485815059b536ad37b38717e89688e28b59209bc41599372836175bf0

                              SHA512

                              8b0e6ed3e7be9c309431bca91bd7282afcbbb0aa725645e24ab5cd311490e61d9ade6d40375085659e08218ecba516e5ea0bd68eb4fb9d82c6e83d23751c9951

                            • C:\Users\Admin\AppData\Roaming\1000026000\26d081364b.exe

                              Filesize

                              1.7MB

                              MD5

                              96191b63d5798d518923727a443b583a

                              SHA1

                              9d4ecfcca685c739f621d55628c74823cc31ff46

                              SHA256

                              23413b888fbcb25c4b8fdd07b60c95402ea09d4b7d591e786c906c64690be46e

                              SHA512

                              e0ef6083166ea2752c10a43ef7ad3b73223124b1c38586f8032148d02f8883f40c5a111df1bcb7775d8e4b1b1994ac284b098e1f8da6ddbab82bc10712517875

                            • \??\pipe\LOCAL\crashpad_4672_UVZPMTLYSZAMWOJQ

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            • memory/2660-20-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-327-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-419-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-410-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-113-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-411-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-285-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-215-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-21-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-409-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-19-0x0000000000EE1000-0x0000000000F0F000-memory.dmp

                              Filesize

                              184KB

                            • memory/2660-431-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-416-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-346-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-347-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-412-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-212-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-360-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-372-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2660-18-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2832-350-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2832-349-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/3068-36-0x0000000000F30000-0x00000000015A9000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/3068-54-0x0000000000F30000-0x00000000015A9000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/3508-53-0x0000000000530000-0x0000000000BA9000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/3508-218-0x0000000000530000-0x0000000000BA9000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/4000-2-0x0000000000B91000-0x0000000000BBF000-memory.dmp

                              Filesize

                              184KB

                            • memory/4000-3-0x0000000000B90000-0x000000000105B000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/4000-5-0x0000000000B90000-0x000000000105B000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/4000-17-0x0000000000B90000-0x000000000105B000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/4000-0-0x0000000000B90000-0x000000000105B000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/4000-1-0x0000000077296000-0x0000000077298000-memory.dmp

                              Filesize

                              8KB

                            • memory/4452-414-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/4452-415-0x0000000000EE0000-0x00000000013AB000-memory.dmp

                              Filesize

                              4.8MB