amadey | eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12/09/2024, 10:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
Size 1.8MB
Sample240912-l4pgva1gph
SHA256 eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e
MD5 16eba1f939a7c8d10aa7a300cf48658a
SHA1 d291806bdd49d3016994f05834ed4100b042aa95
SHA512 a7c69ae67d0a53eb384f35f126f12a0e92937a900e5b7ce718746eeda0cfb4061f81ba34c68ac97de3f80ff6ef4a161cd8c6e629c69b76443d18bb0c9b89051b
SSDEEP 49152:WxmJVsjaD3cB0mYz0QAhpwlgqN/YkuNgC48MQ7nt:WxaijaD36Y09QlgEIyLhQ7nt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc c7817d rave discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

rave

http://185.215.113.103

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8abc3153b2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0b105d7042.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8abc3153b2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8abc3153b2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0b105d7042.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0b105d7042.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe

Executes dropped EXE 6 IoCs

pid	Process
2248	svoutse.exe
1372	8abc3153b2.exe
1688	0b105d7042.exe
2800	8f697a0b33.exe
4200	svoutse.exe
580	svoutse.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	8abc3153b2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	0b105d7042.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Wine	svoutse.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Windows\CurrentVersion\Run\0b105d7042.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\0b105d7042.exe"	svoutse.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Windows\CurrentVersion\Run\8f697a0b33.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000040001\\8f697a0b33.exe"	svoutse.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0006000000025bc5-67.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
5080	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
2248	svoutse.exe
1372	8abc3153b2.exe
1688	0b105d7042.exe
4200	svoutse.exe
580	svoutse.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8abc3153b2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b105d7042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f697a0b33.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5080	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
5080	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
2248	svoutse.exe
2248	svoutse.exe
1372	8abc3153b2.exe
1372	8abc3153b2.exe
1688	0b105d7042.exe
1688	0b105d7042.exe
424	msedge.exe
424	msedge.exe
3768	msedge.exe
3768	msedge.exe
4868	msedge.exe
4868	msedge.exe
1772	identity_helper.exe
1772	identity_helper.exe
4200	svoutse.exe
4200	svoutse.exe
580	svoutse.exe
580	svoutse.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2800	8f697a0b33.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5080	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
3768	msedge.exe
3768	msedge.exe
2800	8f697a0b33.exe
3768	msedge.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe
2800	8f697a0b33.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2248	5080	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe	81
PID 5080 wrote to memory of 2248	5080	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe	81
PID 5080 wrote to memory of 2248	5080	eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe	81
PID 2248 wrote to memory of 1372	2248	svoutse.exe	83
PID 2248 wrote to memory of 1372	2248	svoutse.exe	83
PID 2248 wrote to memory of 1372	2248	svoutse.exe	83
PID 2248 wrote to memory of 1688	2248	svoutse.exe	84
PID 2248 wrote to memory of 1688	2248	svoutse.exe	84
PID 2248 wrote to memory of 1688	2248	svoutse.exe	84
PID 2248 wrote to memory of 2800	2248	svoutse.exe	85
PID 2248 wrote to memory of 2800	2248	svoutse.exe	85
PID 2248 wrote to memory of 2800	2248	svoutse.exe	85
PID 2800 wrote to memory of 3768	2800	8f697a0b33.exe	86
PID 2800 wrote to memory of 3768	2800	8f697a0b33.exe	86
PID 3768 wrote to memory of 2420	3768	msedge.exe	87
PID 3768 wrote to memory of 2420	3768	msedge.exe	87
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 4296	3768	msedge.exe	88
PID 3768 wrote to memory of 424	3768	msedge.exe	89
PID 3768 wrote to memory of 424	3768	msedge.exe	89
PID 3768 wrote to memory of 3872	3768	msedge.exe	90
PID 3768 wrote to memory of 3872	3768	msedge.exe	90
PID 3768 wrote to memory of 3872	3768	msedge.exe	90
PID 3768 wrote to memory of 3872	3768	msedge.exe	90
PID 3768 wrote to memory of 3872	3768	msedge.exe	90
PID 3768 wrote to memory of 3872	3768	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe
"C:\Users\Admin\AppData\Local\Temp\eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Users\Admin\AppData\Roaming\1000026000\8abc3153b2.exe
    "C:\Users\Admin\AppData\Roaming\1000026000\8abc3153b2.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\1000030001\0b105d7042.exe
    "C:\Users\Admin\AppData\Local\Temp\1000030001\0b105d7042.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\1000040001\8f697a0b33.exe
    "C:\Users\Admin\AppData\Local\Temp\1000040001\8f697a0b33.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffc4c6b3cb8,0x7ffc4c6b3cc8,0x7ffc4c6b3cd8
        5⤵
        
        PID:2420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
        5⤵
        
        PID:4296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
        5⤵
        
        PID:3872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:2784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        
        PID:792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
        5⤵
        
        PID:3220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
        5⤵
        
        PID:5060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
        5⤵
        
        PID:3424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
        5⤵
        
        PID:1784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
        5⤵
        
        PID:4768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
        5⤵
        
        PID:3388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7604 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,8850689319369783268,4321742706480187639,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2952 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4200

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 e5d28ea6fdf692191dac3a0a82e7b7e2b7cd910191801b074fdddbe909a4db04
MD5 b4b040fff9bccb6963ab7ee0edbdd345
SHA1 73a35484d8b28d26158bcd6a820f2e80ac9c266d
SHA512 d30f624a9e5f3f10abaabae1d37e2055670a5cd3b91a69a3843ad1bac0dc0731d385352182a60f45706276d9865b228e80b7660ca580cc534d2d290761890a2d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 9fb10b962ee88e4730b0cc8b1164f31d4ad4a59b0d2176b97cc9427827e404fa
MD5 903dbe889234b6e2de406d1747e946c0
SHA1 94e03e5daf5c839abfe1da571d80a26670552669
SHA512 15ee70cf73ae35b740d283c7feeaea0300978e7e89faa712489dc701b72fd652250c5917f5e42e400698bd842e2513cace5676739cc98ca2515c5f60d0c29a7b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 7f603487cae0079b4c853110b29de920318e076bbd230c486fbf3f8017690e41
MD5 471b72fbbbc1c349a0bf9e8191cce188
SHA1 f06521b265083b90b0305e3810ef70b3f99e3756
SHA512 b10fee46bb4e24e478b2ad9ff732709ecb8f5b7c3645f31cc49d750cb53a2e1ce3ac5d0bb511415ea86d59f04f4a5869ba1fc88da318ac1159398be0693624f7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

138a231f-8364-44a0-940e-ec2ca69e614a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\138a231f-8364-44a0-940e-ec2ca69e614a.tmp
Size 4KB
SHA256 42343ef0e95cef620f9e86d35bf6e03d9095551f12b73547664375cbd6037c6c
MD5 61dd0578bbc84eca8842ac0277372686
SHA1 688be3bb012f891703c736f3d35e88426ae0949b
SHA512 75a73cc801883bfb1f3f2f5e8416c2fa6efe0b806d41d6380a002093c7ff11e710f44fee6c40305fcc9eca711ebd43703d2646f0b2978164eb9a46c39933e5fe
SSDEEP 96:nXv+j85g7kOj3Sf70MoiVmdYuuDN1jIIqUBPVpAiX3wI3:nXvrq7kSs70MpuuDNhIIVj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2877d2497bbc01ae2af0bb47b5b9d0b167d46859dc7ebb66147941d7d66c86e6
MD5 67c2dfe492b4880927b4ff82a0eb38c9
SHA1 e8d1ee59deb6a04b03b67ef169a73a44f878dcd7
SHA512 a06f1f28c0a66382b92b01b6068f923364d25639c3d30ff20104c8b44de66e02b126f0b2388f0a70c03fd5d3905e55094b7fd6abd40b7b425587bb263dacf4ae
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 1bbdcde3cdaa824e358fb278d6f9ec464c9a11ee77cb0c450aab10eb81fd41c6
MD5 8ef3dc3f629c42e9b594b6cf5b0f1062
SHA1 cc9fa995bd9b0f1257accbba15dbe553415e74de
SHA512 c515da7fb9ff9355cd034facb31f67dbf3ab7f6f54a251091215b44640d8f477b030e5864ed4307d4d0e0c8504210097e657a48afa2fe60621aa2ad836a3dccc
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 58d362c84c7935c37f0c0e3567bc71450555afb47961ef9a5242ad9c2f5c6b58
MD5 21295343096140281d33f6e54ec4737d
SHA1 996d90c8c9fca7c805fa37d10caebb6865105086
SHA512 8cf5ec90854f4517ce071c06fc5e24a091f04860618dc57a28d2d27de3729437bf59788e872dcb5875a7edcd45abe48865ddb867db6bc0ffa526684a85ca22e9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 74955574aea834010c335ae0208de78ce8f96cf5c8c7497bf7b2635b7f678d3e
MD5 ee730dd8ac91bd8b3232210251bd63cc
SHA1 bf2d697670471a739d293055041f4532a35c956a
SHA512 585f51429f5861c455076c17c565613ac8dfdf0a2005cc3b50fea5793fe849a9866c9e50b01997e6de2895dd2a6c2758cf37bdc2831a35aa0bd3fd7ac368de18
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 06303d487f7101823a57a98be4d34c461c1a5d566f7aa0f8b3c0138945250b76
MD5 dd4fcd5b226f8377a3f2f5c075d41cd0
SHA1 d03b10bb5a3325c65ea4101d8d956ca688f888ed
SHA512 1d5b35cff8f74d0ca5bdc4ecd6de3ccbf022247162f1f76d94ac45806c267454d127adc3d94686390f46296e576d899ad7c2b41a85d15c27602155c3e57b2b47
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 3KB
SHA256 967a3020cc95dfa11ba9cc78d5c7d8af9f7c0d5d201c2bf6d6f0f17b3c9128db
MD5 72f0db1d8f64e2edeb6262248657e16f
SHA1 80d6cc40c114b5014e56717e480f701648552fde
SHA512 6960ca845acf4cd63c07201089a62804a250e4c3e3ae92e9ff92ad6549039e5424aa674970fb7a863572c6bbab9d33bbb2631734c9a91d29f098709615d6b7ea
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 3KB
SHA256 66a6a99841b5506c9de5017b77eaeb554be13f1cd275b5c1648a3e21799b07ba
MD5 4ecff125d7ca31eb7a43c04ff4a643c7
SHA1 5a2b833193e1b26d356d07dd6551858894f332cb
SHA512 59b787efadd5697a322ae32d367b4e1f172193c388144da9936158479f31100da91243263a74610e0f5043defc5162fed078795bed79ef9b4833fce82e7c58a8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 a1e572750c74492a62460e4e42b6cc35a3587fed27045907274ad7b858cdd7c7
MD5 418b95e54eb1e9eae90136ed923cd055
SHA1 a02cd67bc1615760a80842c39a920d52bdb13db1
SHA512 e06aac3d3729624a7ae827829729eaa4623c27fd04865eb285292f6823e6254611e78c72a0d33eeb64ed0fd5aa9262f2ad9d6759c6d04cef5e23c94cbb168eca
SSDEEP 96:nXv+j85g7kOj3Sf70MoiVmdYuuDN1jIIVUBPVpAiX3wI3:nXvrq7kSs70MpuuDNhIIWj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 26KB
SHA256 94736b443a51ba7abfb1a2ab9cda5c0d5ae1924ac7c62813f2d1a83e030df2bd
MD5 3d4fe76eb3c535ab916f4839092d615a
SHA1 e399d74a1392e535bb6bdc1d93373a926f576077
SHA512 a211a43c3b25838c70a63526adec99db942facead786123b6d6e1762308383421267dbe57a0606f06c23ba572c11febd488548a44289fb3ab948495bf993b173
SSDEEP 768:n2D8F2lWRUQy8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3/Ll/s0obrUplt:n2D8F2lWRUQyu1jaK/Lp9oUplt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe58294d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe58294d.TMP
Size 25KB
SHA256 d9bf31b272d127d61e6fc8d7372a0387a95c0cafbbbb411f3e469ffecf8848e5
MD5 952e089da5b1aedbd667b0563e1da297
SHA1 74d2a8f8871d99b8f4badd8430b50a0d82cb7eaf
SHA512 c32c4d288cd1f507fb2ab1a940df2f7648a3216d59ccf8db26837cad7becfec3c2e2e81c8ee75c160ff3769dc94137f038a6f389f969fc5697c466d14c2342c0
SSDEEP 768:OD8F2lWRJQE8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3FLl/s0oPrUpcm:OD8F2lWRJQEu1jaKFLp9oopP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
Size 203B
SHA256 8de912f4aa3084354184d4a06fb9347c61e2976378535eae27b22e46f9739a9b
MD5 7204b95bf5f990cf56276b4893dc3780
SHA1 5b4808d510ca371535c43dacbd34196b33da2de3
SHA512 5840f9f16af0fdbaef9689b8a363710e5eb506d4fffad829f0aa697ba670eb129dd3c9c4cd79f2322d135974a3db4aa2beb5ae71fbd3e5e1d92388148d72b4cd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
Size 203B
SHA256 8600f8fc7ae29c6728ff48fdc06e50a3e57b977a7242788f6c5915d09071c26a
MD5 471913f6fef9f2c9eb55877c12b813a3
SHA1 9f266fafed75e80c98e38f00b9a4ae5aa36f7a6b
SHA512 c7eb654f35fb0fcfca6f0b0fd11373f70960c49068896382a764333ccf5e8cf0014703c7c0ac4f45356aa56604be9ddadd5953f89719ce955769027245030964
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5923e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe5923e9.TMP
Size 203B
SHA256 d1534ac8f25917c77e8d4dfccd5aae2081b99c028552960f33a3ebc6700a2fc0
MD5 87204e03406a56f4be9226b0d4a9be6d
SHA1 da6bd5e2068b63c225d3c0112e8a10c72a71c773
SHA512 436868b260bda766ec1a7e61b8f5c7176e3e6e9d498af9f88fec28234fc1519c8394362e9925a9256c57b89b06c08580e9615cc61841ea622c59e01443bee187
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

cbbaf926-3051-425d-b4ed-e082785dd3ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\cbbaf926-3051-425d-b4ed-e082785dd3ab.tmp
Size 9KB
SHA256 6a8398a8bcb5be1ca5fdbd4146a91a4de39db2d74fd998edfe59aa3c4e1a8bab
MD5 0a17d4606219272eabfb9a6639e3f0e1
SHA1 8c039bca301f51626ee9560a9d0173e1e3188781
SHA512 08264bc3fbfd2375170e1e84afea00c73962b2fe56697a71ca36a7f31d60b7d6a5796fd3d5c6b0d7609d06a94cb9c2b6ff1071ad59c5053a1273716001c84d90
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASxaeMRUn0YWfVea0BLX+xJ9dF:e9iIxuERzA83h09RZxASs0gfEa05Oz9D
MD5 SHA1 SHA512 SSDEEP

Submit Download

svoutse.exe

Path C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
Size 1.8MB
SHA256 eb2869650996d4e220e3fd063aa269bc83a5f0ca42125f3a8c1f7d5e62af9f4e
MD5 16eba1f939a7c8d10aa7a300cf48658a
SHA1 d291806bdd49d3016994f05834ed4100b042aa95
SHA512 a7c69ae67d0a53eb384f35f126f12a0e92937a900e5b7ce718746eeda0cfb4061f81ba34c68ac97de3f80ff6ef4a161cd8c6e629c69b76443d18bb0c9b89051b
SSDEEP 49152:WxmJVsjaD3cB0mYz0QAhpwlgqN/YkuNgC48MQ7nt:WxaijaD36Y09QlgEIyLhQ7nt
MD5 SHA1 SHA512 SSDEEP

Submit Download

8f697a0b33.exe

Path C:\Users\Admin\AppData\Local\Temp\1000040001\8f697a0b33.exe
Size 896KB
SHA256 656c621b640e591916a685e4fc7f3171bd756ff85aa98872557cf6b22b09db79
MD5 38164e376726862f321ff8405edbb017
SHA1 9369f0d472e9356375a90c770960283023f46746
SHA512 a2af12b16f5faa4d63c7b5b5399b03708172c998d3f83c088cb62feea1695c66aed1559f779bce1e6a223c5ea26e9c0e19690fd90cfadc03d2f8382e766fccd2
SSDEEP 12288:PqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaoTg:PqDEvCTbMWu7rQYlBQcBiT6rprG8awg
MD5 SHA1 SHA512 SSDEEP

Submit Download

8abc3153b2.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\8abc3153b2.exe
Size 1.7MB
SHA256 23413b888fbcb25c4b8fdd07b60c95402ea09d4b7d591e786c906c64690be46e
MD5 96191b63d5798d518923727a443b583a
SHA1 9d4ecfcca685c739f621d55628c74823cc31ff46
SHA512 e0ef6083166ea2752c10a43ef7ad3b73223124b1c38586f8032148d02f8883f40c5a111df1bcb7775d8e4b1b1994ac284b098e1f8da6ddbab82bc10712517875
SSDEEP 24576:8ZuxJareynrcqYVigUbRhYts5a/psGZAuAUpM4LYXU41b39x4cZb9VZNIrAyp:8ZIaKKlKUbfKsMeGZLL0XUSbNxnBCD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk
Size 1KB
SHA256 573a42bf5a607f6d926046869ecca40e82d78201b64d622ce9b7a4e5472dc35a
MD5 5fb153f04a999c145410a97df5bf8b7a
SHA1 bbf91915f6e0263c68f1759341123a41de4e30c3
SHA512 06a0cce68f0db60c356a02c331324fc2aefab5b437cac0ed5513a126c34dc22f2a34a9a66ca856a706395358e3f5240dc66ecfc99197d4a098bb0034904411bc
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 c3e8bb602d5811351618e1ebcf42d8afc668b212324b69f45ac2afdbbec936a9
MD5 5137b6f811aec4d73aae926cb86c443e
SHA1 56c8a2e77321f5ecbdece3a855b6edbdde6d98b4
SHA512 8c20b1613ea933cfd64f1d8267b2916ceaec983793f62716b936daa661dd1a1e82b6cbec29cba8b415e20e30e459bc7dc8f41ed7333dd114c7f002fa047cf291
MD5 SHA1 SHA512

Submit Download

memory/580-419-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/580-420-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/1372-48-0x0000000000F20000-0x0000000001599000-memory.dmp

Download

memory/1372-47-0x0000000000F21000-0x0000000000F35000-memory.dmp

Download

memory/1372-59-0x0000000000F20000-0x0000000001599000-memory.dmp

Download

memory/1372-37-0x0000000000F20000-0x0000000001599000-memory.dmp

Download

memory/1688-57-0x00000000002A0000-0x0000000000919000-memory.dmp

Download

memory/1688-61-0x00000000002A0000-0x0000000000919000-memory.dmp

Download

memory/2248-367-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-46-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-291-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-421-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-423-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-328-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-204-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-379-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-422-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-356-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-62-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-357-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-56-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-21-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-20-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-19-0x0000000000431000-0x000000000045F000-memory.dmp

Download

memory/2248-407-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-18-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-436-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-418-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/2248-426-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/4200-327-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/4200-326-0x0000000000430000-0x00000000008F2000-memory.dmp

Download

memory/5080-0-0x0000000000F10000-0x00000000013D2000-memory.dmp

Download

memory/5080-3-0x0000000000F10000-0x00000000013D2000-memory.dmp

Download

memory/5080-4-0x0000000000F10000-0x00000000013D2000-memory.dmp

Download

memory/5080-2-0x0000000000F11000-0x0000000000F3F000-memory.dmp

Download

memory/5080-17-0x0000000000F10000-0x00000000013D2000-memory.dmp

Download

memory/5080-1-0x0000000077416000-0x0000000077418000-memory.dmp

Download