Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-09-2024 10:05

General

  • Target

    eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe

  • Size

    1.8MB

  • MD5

    16eba1f939a7c8d10aa7a300cf48658a

  • SHA1

    d291806bdd49d3016994f05834ed4100b042aa95

  • SHA256

    eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e

  • SHA512

    a7c69ae67d0a53eb384f35f126f12a0e92937a900e5b7ce718746eeda0cfb4061f81ba34c68ac97de3f80ff6ef4a161cd8c6e629c69b76443d18bb0c9b89051b

  • SSDEEP

    49152:WxmJVsjaD3cB0mYz0QAhpwlgqN/YkuNgC48MQ7nt:WxaijaD36Y09QlgEIyLhQ7nt

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
    "C:\Users\Admin\AppData\Local\Temp\eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Users\Admin\AppData\Roaming\1000026000\8abc3153b2.exe
        "C:\Users\Admin\AppData\Roaming\1000026000\8abc3153b2.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1372
      • C:\Users\Admin\AppData\Local\Temp\1000030001\0b105d7042.exe
        "C:\Users\Admin\AppData\Local\Temp\1000030001\0b105d7042.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1688
      • C:\Users\Admin\AppData\Local\Temp\1000040001\8f697a0b33.exe
        "C:\Users\Admin\AppData\Local\Temp\1000040001\8f697a0b33.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
          4⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3768
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffc4c6b3cb8,0x7ffc4c6b3cc8,0x7ffc4c6b3cd8
            5⤵
              PID:2420
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
              5⤵
                PID:4296
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:424
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
                5⤵
                  PID:3872
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                  5⤵
                    PID:2784
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                    5⤵
                      PID:792
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
                      5⤵
                        PID:3220
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
                        5⤵
                          PID:5060
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
                          5⤵
                            PID:3424
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
                            5⤵
                              PID:1784
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
                              5⤵
                                PID:4768
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
                                5⤵
                                  PID:3388
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4868
                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7604 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1772
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2952 /prefetch:2
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4272
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4652
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4344
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4200
                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:580

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              b4b040fff9bccb6963ab7ee0edbdd345

                              SHA1

                              73a35484d8b28d26158bcd6a820f2e80ac9c266d

                              SHA256

                              e5d28ea6fdf692191dac3a0a82e7b7e2b7cd910191801b074fdddbe909a4db04

                              SHA512

                              d30f624a9e5f3f10abaabae1d37e2055670a5cd3b91a69a3843ad1bac0dc0731d385352182a60f45706276d9865b228e80b7660ca580cc534d2d290761890a2d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              903dbe889234b6e2de406d1747e946c0

                              SHA1

                              94e03e5daf5c839abfe1da571d80a26670552669

                              SHA256

                              9fb10b962ee88e4730b0cc8b1164f31d4ad4a59b0d2176b97cc9427827e404fa

                              SHA512

                              15ee70cf73ae35b740d283c7feeaea0300978e7e89faa712489dc701b72fd652250c5917f5e42e400698bd842e2513cace5676739cc98ca2515c5f60d0c29a7b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              471b72fbbbc1c349a0bf9e8191cce188

                              SHA1

                              f06521b265083b90b0305e3810ef70b3f99e3756

                              SHA256

                              7f603487cae0079b4c853110b29de920318e076bbd230c486fbf3f8017690e41

                              SHA512

                              b10fee46bb4e24e478b2ad9ff732709ecb8f5b7c3645f31cc49d750cb53a2e1ce3ac5d0bb511415ea86d59f04f4a5869ba1fc88da318ac1159398be0693624f7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

                              Filesize

                              20B

                              MD5

                              9e4e94633b73f4a7680240a0ffd6cd2c

                              SHA1

                              e68e02453ce22736169a56fdb59043d33668368f

                              SHA256

                              41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                              SHA512

                              193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\138a231f-8364-44a0-940e-ec2ca69e614a.tmp

                              Filesize

                              4KB

                              MD5

                              61dd0578bbc84eca8842ac0277372686

                              SHA1

                              688be3bb012f891703c736f3d35e88426ae0949b

                              SHA256

                              42343ef0e95cef620f9e86d35bf6e03d9095551f12b73547664375cbd6037c6c

                              SHA512

                              75a73cc801883bfb1f3f2f5e8416c2fa6efe0b806d41d6380a002093c7ff11e710f44fee6c40305fcc9eca711ebd43703d2646f0b2978164eb9a46c39933e5fe

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\data_2

                              Filesize

                              8KB

                              MD5

                              0962291d6d367570bee5454721c17e11

                              SHA1

                              59d10a893ef321a706a9255176761366115bedcb

                              SHA256

                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                              SHA512

                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\data_3

                              Filesize

                              8KB

                              MD5

                              41876349cb12d6db992f1309f22df3f0

                              SHA1

                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                              SHA256

                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                              SHA512

                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              48B

                              MD5

                              67c2dfe492b4880927b4ff82a0eb38c9

                              SHA1

                              e8d1ee59deb6a04b03b67ef169a73a44f878dcd7

                              SHA256

                              2877d2497bbc01ae2af0bb47b5b9d0b167d46859dc7ebb66147941d7d66c86e6

                              SHA512

                              a06f1f28c0a66382b92b01b6068f923364d25639c3d30ff20104c8b44de66e02b126f0b2388f0a70c03fd5d3905e55094b7fd6abd40b7b425587bb263dacf4ae

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              336B

                              MD5

                              8ef3dc3f629c42e9b594b6cf5b0f1062

                              SHA1

                              cc9fa995bd9b0f1257accbba15dbe553415e74de

                              SHA256

                              1bbdcde3cdaa824e358fb278d6f9ec464c9a11ee77cb0c450aab10eb81fd41c6

                              SHA512

                              c515da7fb9ff9355cd034facb31f67dbf3ab7f6f54a251091215b44640d8f477b030e5864ed4307d4d0e0c8504210097e657a48afa2fe60621aa2ad836a3dccc

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

                              Filesize

                              41B

                              MD5

                              5af87dfd673ba2115e2fcf5cfdb727ab

                              SHA1

                              d5b5bbf396dc291274584ef71f444f420b6056f1

                              SHA256

                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                              SHA512

                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

                              Filesize

                              1KB

                              MD5

                              21295343096140281d33f6e54ec4737d

                              SHA1

                              996d90c8c9fca7c805fa37d10caebb6865105086

                              SHA256

                              58d362c84c7935c37f0c0e3567bc71450555afb47961ef9a5242ad9c2f5c6b58

                              SHA512

                              8cf5ec90854f4517ce071c06fc5e24a091f04860618dc57a28d2d27de3729437bf59788e872dcb5875a7edcd45abe48865ddb867db6bc0ffa526684a85ca22e9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              59B

                              MD5

                              2800881c775077e1c4b6e06bf4676de4

                              SHA1

                              2873631068c8b3b9495638c865915be822442c8b

                              SHA256

                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                              SHA512

                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              ee730dd8ac91bd8b3232210251bd63cc

                              SHA1

                              bf2d697670471a739d293055041f4532a35c956a

                              SHA256

                              74955574aea834010c335ae0208de78ce8f96cf5c8c7497bf7b2635b7f678d3e

                              SHA512

                              585f51429f5861c455076c17c565613ac8dfdf0a2005cc3b50fea5793fe849a9866c9e50b01997e6de2895dd2a6c2758cf37bdc2831a35aa0bd3fd7ac368de18

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              dd4fcd5b226f8377a3f2f5c075d41cd0

                              SHA1

                              d03b10bb5a3325c65ea4101d8d956ca688f888ed

                              SHA256

                              06303d487f7101823a57a98be4d34c461c1a5d566f7aa0f8b3c0138945250b76

                              SHA512

                              1d5b35cff8f74d0ca5bdc4ecd6de3ccbf022247162f1f76d94ac45806c267454d127adc3d94686390f46296e576d899ad7c2b41a85d15c27602155c3e57b2b47

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              3KB

                              MD5

                              72f0db1d8f64e2edeb6262248657e16f

                              SHA1

                              80d6cc40c114b5014e56717e480f701648552fde

                              SHA256

                              967a3020cc95dfa11ba9cc78d5c7d8af9f7c0d5d201c2bf6d6f0f17b3c9128db

                              SHA512

                              6960ca845acf4cd63c07201089a62804a250e4c3e3ae92e9ff92ad6549039e5424aa674970fb7a863572c6bbab9d33bbb2631734c9a91d29f098709615d6b7ea

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              3KB

                              MD5

                              4ecff125d7ca31eb7a43c04ff4a643c7

                              SHA1

                              5a2b833193e1b26d356d07dd6551858894f332cb

                              SHA256

                              66a6a99841b5506c9de5017b77eaeb554be13f1cd275b5c1648a3e21799b07ba

                              SHA512

                              59b787efadd5697a322ae32d367b4e1f172193c388144da9936158479f31100da91243263a74610e0f5043defc5162fed078795bed79ef9b4833fce82e7c58a8

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              418b95e54eb1e9eae90136ed923cd055

                              SHA1

                              a02cd67bc1615760a80842c39a920d52bdb13db1

                              SHA256

                              a1e572750c74492a62460e4e42b6cc35a3587fed27045907274ad7b858cdd7c7

                              SHA512

                              e06aac3d3729624a7ae827829729eaa4623c27fd04865eb285292f6823e6254611e78c72a0d33eeb64ed0fd5aa9262f2ad9d6759c6d04cef5e23c94cbb168eca

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

                              Filesize

                              26KB

                              MD5

                              3d4fe76eb3c535ab916f4839092d615a

                              SHA1

                              e399d74a1392e535bb6bdc1d93373a926f576077

                              SHA256

                              94736b443a51ba7abfb1a2ab9cda5c0d5ae1924ac7c62813f2d1a83e030df2bd

                              SHA512

                              a211a43c3b25838c70a63526adec99db942facead786123b6d6e1762308383421267dbe57a0606f06c23ba572c11febd488548a44289fb3ab948495bf993b173

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe58294d.TMP

                              Filesize

                              25KB

                              MD5

                              952e089da5b1aedbd667b0563e1da297

                              SHA1

                              74d2a8f8871d99b8f4badd8430b50a0d82cb7eaf

                              SHA256

                              d9bf31b272d127d61e6fc8d7372a0387a95c0cafbbbb411f3e469ffecf8848e5

                              SHA512

                              c32c4d288cd1f507fb2ab1a940df2f7648a3216d59ccf8db26837cad7becfec3c2e2e81c8ee75c160ff3769dc94137f038a6f389f969fc5697c466d14c2342c0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

                              Filesize

                              8KB

                              MD5

                              cf89d16bb9107c631daabf0c0ee58efb

                              SHA1

                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                              SHA256

                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                              SHA512

                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

                              Filesize

                              203B

                              MD5

                              7204b95bf5f990cf56276b4893dc3780

                              SHA1

                              5b4808d510ca371535c43dacbd34196b33da2de3

                              SHA256

                              8de912f4aa3084354184d4a06fb9347c61e2976378535eae27b22e46f9739a9b

                              SHA512

                              5840f9f16af0fdbaef9689b8a363710e5eb506d4fffad829f0aa697ba670eb129dd3c9c4cd79f2322d135974a3db4aa2beb5ae71fbd3e5e1d92388148d72b4cd

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

                              Filesize

                              203B

                              MD5

                              471913f6fef9f2c9eb55877c12b813a3

                              SHA1

                              9f266fafed75e80c98e38f00b9a4ae5aa36f7a6b

                              SHA256

                              8600f8fc7ae29c6728ff48fdc06e50a3e57b977a7242788f6c5915d09071c26a

                              SHA512

                              c7eb654f35fb0fcfca6f0b0fd11373f70960c49068896382a764333ccf5e8cf0014703c7c0ac4f45356aa56604be9ddadd5953f89719ce955769027245030964

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe5923e9.TMP

                              Filesize

                              203B

                              MD5

                              87204e03406a56f4be9226b0d4a9be6d

                              SHA1

                              da6bd5e2068b63c225d3c0112e8a10c72a71c773

                              SHA256

                              d1534ac8f25917c77e8d4dfccd5aae2081b99c028552960f33a3ebc6700a2fc0

                              SHA512

                              436868b260bda766ec1a7e61b8f5c7176e3e6e9d498af9f88fec28234fc1519c8394362e9925a9256c57b89b06c08580e9615cc61841ea622c59e01443bee187

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\cbbaf926-3051-425d-b4ed-e082785dd3ab.tmp

                              Filesize

                              9KB

                              MD5

                              0a17d4606219272eabfb9a6639e3f0e1

                              SHA1

                              8c039bca301f51626ee9560a9d0173e1e3188781

                              SHA256

                              6a8398a8bcb5be1ca5fdbd4146a91a4de39db2d74fd998edfe59aa3c4e1a8bab

                              SHA512

                              08264bc3fbfd2375170e1e84afea00c73962b2fe56697a71ca36a7f31d60b7d6a5796fd3d5c6b0d7609d06a94cb9c2b6ff1071ad59c5053a1273716001c84d90

                            • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                              Filesize

                              1.8MB

                              MD5

                              16eba1f939a7c8d10aa7a300cf48658a

                              SHA1

                              d291806bdd49d3016994f05834ed4100b042aa95

                              SHA256

                              eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e

                              SHA512

                              a7c69ae67d0a53eb384f35f126f12a0e92937a900e5b7ce718746eeda0cfb4061f81ba34c68ac97de3f80ff6ef4a161cd8c6e629c69b76443d18bb0c9b89051b

                            • C:\Users\Admin\AppData\Local\Temp\1000040001\8f697a0b33.exe

                              Filesize

                              896KB

                              MD5

                              38164e376726862f321ff8405edbb017

                              SHA1

                              9369f0d472e9356375a90c770960283023f46746

                              SHA256

                              656c621b640e591916a685e4fc7f3171bd756ff85aa98872557cf6b22b09db79

                              SHA512

                              a2af12b16f5faa4d63c7b5b5399b03708172c998d3f83c088cb62feea1695c66aed1559f779bce1e6a223c5ea26e9c0e19690fd90cfadc03d2f8382e766fccd2

                            • C:\Users\Admin\AppData\Roaming\1000026000\8abc3153b2.exe

                              Filesize

                              1.7MB

                              MD5

                              96191b63d5798d518923727a443b583a

                              SHA1

                              9d4ecfcca685c739f621d55628c74823cc31ff46

                              SHA256

                              23413b888fbcb25c4b8fdd07b60c95402ea09d4b7d591e786c906c64690be46e

                              SHA512

                              e0ef6083166ea2752c10a43ef7ad3b73223124b1c38586f8032148d02f8883f40c5a111df1bcb7775d8e4b1b1994ac284b098e1f8da6ddbab82bc10712517875

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

                              Filesize

                              1KB

                              MD5

                              5fb153f04a999c145410a97df5bf8b7a

                              SHA1

                              bbf91915f6e0263c68f1759341123a41de4e30c3

                              SHA256

                              573a42bf5a607f6d926046869ecca40e82d78201b64d622ce9b7a4e5472dc35a

                              SHA512

                              06a0cce68f0db60c356a02c331324fc2aefab5b437cac0ed5513a126c34dc22f2a34a9a66ca856a706395358e3f5240dc66ecfc99197d4a098bb0034904411bc

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                              Filesize

                              3KB

                              MD5

                              5137b6f811aec4d73aae926cb86c443e

                              SHA1

                              56c8a2e77321f5ecbdece3a855b6edbdde6d98b4

                              SHA256

                              c3e8bb602d5811351618e1ebcf42d8afc668b212324b69f45ac2afdbbec936a9

                              SHA512

                              8c20b1613ea933cfd64f1d8267b2916ceaec983793f62716b936daa661dd1a1e82b6cbec29cba8b415e20e30e459bc7dc8f41ed7333dd114c7f002fa047cf291

                            • \??\pipe\LOCAL\crashpad_3768_YVPWDILPSNHJNFWV

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            • memory/580-419-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/580-420-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/1372-48-0x0000000000F20000-0x0000000001599000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/1372-47-0x0000000000F21000-0x0000000000F35000-memory.dmp

                              Filesize

                              80KB

                            • memory/1372-59-0x0000000000F20000-0x0000000001599000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/1372-37-0x0000000000F20000-0x0000000001599000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/1688-57-0x00000000002A0000-0x0000000000919000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/1688-61-0x00000000002A0000-0x0000000000919000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/2248-367-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-421-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-357-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-422-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-423-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-328-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-204-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-56-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-46-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-379-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-291-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-62-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-356-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-21-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-20-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-19-0x0000000000431000-0x000000000045F000-memory.dmp

                              Filesize

                              184KB

                            • memory/2248-407-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-18-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-436-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-418-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/2248-426-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/4200-327-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/4200-326-0x0000000000430000-0x00000000008F2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/5080-0-0x0000000000F10000-0x00000000013D2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/5080-3-0x0000000000F10000-0x00000000013D2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/5080-4-0x0000000000F10000-0x00000000013D2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/5080-2-0x0000000000F11000-0x0000000000F3F000-memory.dmp

                              Filesize

                              184KB

                            • memory/5080-17-0x0000000000F10000-0x00000000013D2000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/5080-1-0x0000000077416000-0x0000000077418000-memory.dmp

                              Filesize

                              8KB