Malware Analysis Report

2024-10-23 21:50

Sample ID 240909-12am8svcke
Target aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5
SHA256 aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5
Tags
amadey stealc c7817d rave discovery evasion persistence stealer trojan credential_access spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5

Threat Level: Known bad

The file aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5 was found to be: Known bad.

Malicious Activity Summary

amadey stealc c7817d rave discovery evasion persistence stealer trojan credential_access spyware

Amadey

Stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Reads user/profile data of web browsers

Identifies Wine through registry keys

Reads data files stored by FTP clients

Checks BIOS information in registry

Executes dropped EXE

Unsecured Credentials: Credentials In Files

Loads dropped DLL

Checks computer location settings

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: GetForegroundWindowSpam

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-09 22:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-09 22:08

Reported

2024-09-09 22:10

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e517595cf1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\e517595cf1.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000026000\4285acae8b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 468 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 468 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 468 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2920 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\4285acae8b.exe
PID 2920 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\4285acae8b.exe
PID 2920 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\4285acae8b.exe
PID 2920 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe
PID 2920 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe
PID 2920 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe
PID 2920 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe
PID 2920 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe
PID 2920 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe
PID 3968 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3968 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 3540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 4356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 4356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 4356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 4356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 4356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2440 wrote to memory of 4356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe

"C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Roaming\1000026000\4285acae8b.exe

"C:\Users\Admin\AppData\Roaming\1000026000\4285acae8b.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1680 -ip 1680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1012

C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe

"C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdaeb846f8,0x7ffdaeb84708,0x7ffdaeb84718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4784 -ip 4784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 1268

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2816882306360542453,16693682042508934166,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6924 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 31.41.244.10:80 31.41.244.10 tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 10.244.41.31.in-addr.arpa udp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 103.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com tcp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 84.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
US 8.8.8.8:53 206.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 142.250.102.84:443 accounts.google.com udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/468-0-0x00000000006D0000-0x0000000000B8E000-memory.dmp

memory/468-1-0x0000000077C84000-0x0000000077C86000-memory.dmp

memory/468-2-0x00000000006D1000-0x00000000006FF000-memory.dmp

memory/468-3-0x00000000006D0000-0x0000000000B8E000-memory.dmp

memory/468-4-0x00000000006D0000-0x0000000000B8E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 f645fa36f7935209df0b4b98bf3e8b95
SHA1 97eab88b378f08e14be341069bd069c8e2fd27e4
SHA256 aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5
SHA512 386457e610b392df6c298bd57d46b317d19d8af5b0821e3988ad28316cf7a6c370e6c7132c51563b6889ae6bbae552efa8f26aa31dce992c4557bff32f26189f

memory/468-16-0x00000000006D0000-0x0000000000B8E000-memory.dmp

memory/2920-18-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-19-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-20-0x0000000000380000-0x000000000083E000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\4285acae8b.exe

MD5 f47cc7dc355ae01926f6065316c3bd68
SHA1 6b575930185f216e4fa5116fdcc8906eb9f53af9
SHA256 25741e3975370f8b2c77513a0941ca4263a83ec08e1203c9dd7cfd5c18474794
SHA512 cf076a077130b8dd48f3e27a6aaba411a6c8833ab8b926c99fc3fb66130694db1ce668103c44aba6196705a9722b68da16287ea8a63ffed250bcf92bba68154e

memory/1680-53-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe

MD5 333582f7841dd7d701b7c6ac8ee4ebe6
SHA1 7bbb42817dc444a8f88ab735f63d1722bccc5255
SHA256 78f4bcd5439f72e13af6e96ac3722fee9e5373dae844da088226158c9e81a078
SHA512 4ae6e1bb724080ec7eb86b848a1b78a3d40f11c5de90cfffd4917892d9823167a2ce14986c066aeb72edaab41dec8b8a4306a0580bface974ad4846cbc73eff2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 976ee4fe4bdb7c16e915911d7613ed0a
SHA1 d8ffbf3e73d21d255de5c2e71cbc47a5a37240f4
SHA256 5f025e4e91dc2ddeee3a921679071467e9322f2bcc3555fbb1ba11c70bb28c0a
SHA512 046043c6ad755bf12de126e0584ff9940276f643054add9e7d4642a3a7d0eac0ab41649677821f85d5eca7ac471eb406132d44d96d0ac26c9ad2156608a6c32c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 94ced6298ce56dc2b66e268a5b36ae57
SHA1 1204a8532abaf7f571ef7367c1e997325b15f6cd
SHA256 86a244a9b297f5e539ef183d609c35141572101e847657efa3f34187f562834b
SHA512 0c71b9dfc3421ff3c60b37ed2e837076398d7e76d8fe036a1f2f291a2ffa43d7d457717705367d01b32cefa4519691931d5438315e0261a8604d37764f408b01

\??\pipe\LOCAL\crashpad_2440_LZWXHSYNEOCKOTOZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 d5849a69dbdd05c941ec0383efcdde8b
SHA1 62fa718323a25cbb6e612ab226bf19de11f7bee9
SHA256 55790df3a0384a3b6d65e74e8ad190aa76230a4c0ffe9b517e4a31273fe30583
SHA512 58860a3610b96e245fd8f9ef6b4099e3cf21797376c00d1bf18015ce0a31cd7ae673e74db1b4d11cacd5010caac1533332b3734040eb7330f5021d741ee769f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\c98d432c-77e3-4601-ad81-814c483d9f43.tmp

MD5 425283c4cede92b0fca8c95a8b1384a5
SHA1 52b663022f89b13cc1731425627847fa15877266
SHA256 94fba3f59b09c6a48820f1fbe8fc3d708c5eb26ee29ac4e62adc4b6b7bbda755
SHA512 81401f4c47848474b87ab6590849433fa394aff6fa2d6b76885f6062bd9223eb14cf905c18f341ea6bd33fc54b72b01630eb1c8616d36ad5673dc191ab7386f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

MD5 9d459f1dd4fbca7691328e049571dd7f
SHA1 efa726c2aaadaa8815d68e9754a443105d7bc023
SHA256 898bbdbea23409a39b6670d76ac5eeb019a04cb726e137af32d33f24e6470b75
SHA512 a77a21dfb9287f6789009e133c67a63fd20a728a4e7ecdc871d1d1d8650be3e7ed9345d46b66bb72aaec3f188b5daf282ae322e2c0665ac6a10f6e41ddb89795

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\19VU53RW2MBL9QQVHGJE.temp

MD5 e87314b0159375033ca59f8264e9b251
SHA1 6bf1656d127c2dd7a4931a80ecde9577d235c4d9
SHA256 e505be0dce220385f12ea34c9564dfa1894953285329292b311fa386a7545909
SHA512 40bf47e7fec8bca2e44619170d9b22e0b7459077bdfc485cf07e6b2097f301d347c685967803b49a54b1c6902902e556e7c061de8a9f7ef8e1a08bee7e959dcb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\000002.dbtmp

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/2920-251-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-263-0x0000000000380000-0x000000000083E000-memory.dmp

memory/4784-265-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 07f4b13fe0ddc81d78134d9f161e9b9c
SHA1 da89d8dc835bfdf436957c57bbc35b2748990065
SHA256 e7093504ebcc2872fc419965d1191c6166d1e2817fa8ed1ba8f3a7def14be315
SHA512 956176d25003d15365034d5d9da3ceebe9749e767357f3201a4d6943b535de0e0b8164cfebc9f6dbaae447052510eab5100e896f56485e013124b394b2ca19ee

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57cf56.TMP

MD5 c245faaf03f6df6c73c71efec93b8a6d
SHA1 4510d3ffce2580b8577adc741fda8771f7df353d
SHA256 7da7bb501db57afcd102a49b83fb6a75d6d7115746fcb960cbadad855d455eab
SHA512 7c33147669beff47b87536332e07b95c53eabb9e790b92bb421174caa9b98d266f6aed9998ee848a4124793a9f92425a9a58a22964772ac2cb1fdfae3417862f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

MD5 0db2976844a08474ac4825b9a3c6749e
SHA1 49edc9f4bf981c177f6adb9a39bb16142e32c331
SHA256 0d0510eda4af5543ba89e887d95fa7c5668bf084b43f497082b87244e72733cb
SHA512 b9ce0dd98f7f52b7e2213a66993b871368a091fb727b3aeea857927aaee6ebb5e7444f9173f32648f3cdcc83921c770680a6630591ab8aab4072db8b630d825f

memory/2920-290-0x0000000000380000-0x000000000083E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

memory/2920-343-0x0000000000380000-0x000000000083E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\a9e01f34-9947-4dc7-b1f8-549a4fcf8c4e.tmp

MD5 031de5e4176adb1d335c1ef0f65d02b5
SHA1 3a7c3abc0914cc52c30b100d475f0db438cb1cc7
SHA256 d72c5e32d40dd13c79d38ee1fbb99f26319fab4bc3a407585374b5ec8b4f03c9
SHA512 73206d9a7a7d3c5201625e60b0bcb528fb7a2ced0308c5c8cad48efc5a576c90af984d6ec2c6b6d891e6faebfa2b5a2061fec0d58cb8c3990c620dddde80cec5

memory/2920-362-0x0000000000380000-0x000000000083E000-memory.dmp

memory/1344-364-0x0000000000380000-0x000000000083E000-memory.dmp

memory/1344-365-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-366-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-376-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-386-0x0000000000380000-0x000000000083E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 9f78396e56b1dab39d6d977876959984
SHA1 34c2d51146f24ce4c4fd57da45189bc05da999e7
SHA256 eba19a098c4ab51e9750271a72622af06d3d3f5e3a96dadd83372bb2aa1d9472
SHA512 b761b82e869a94338170a1802e9e9c7fb7a1aca28e34c85c08a75dd66b855601bf90bb79c9c272d7a0a8960717aa63cc80f93386f66512b585ba716c42b6cd2c

memory/2920-405-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-406-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-407-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2104-409-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2104-410-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-411-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-412-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-415-0x0000000000380000-0x000000000083E000-memory.dmp

memory/2920-418-0x0000000000380000-0x000000000083E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-09 22:08

Reported

2024-09-09 22:10

Platform

win11-20240802-en

Max time kernel

149s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\KFCBAEHCAE.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\KFCBAEHCAE.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\KFCBAEHCAE.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Wine C:\ProgramData\KFCBAEHCAE.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\e517595cf1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\e517595cf1.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Checks installed software on the system

discovery

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\KFCBAEHCAE.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\ProgramData\KFCBAEHCAE.exe N/A
N/A N/A C:\ProgramData\KFCBAEHCAE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3472 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 3472 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 3472 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2208 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe
PID 2208 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe
PID 2208 wrote to memory of 360 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe
PID 2208 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe
PID 2208 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe
PID 2208 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe
PID 2208 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe
PID 2208 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe
PID 2208 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe
PID 4504 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4504 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 4316 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 4316 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 3128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 4840 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 4840 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 4840 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 4840 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 4840 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2108 wrote to memory of 4840 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe

"C:\Users\Admin\AppData\Local\Temp\aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe

"C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\e517595cf1.exe"

C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe

"C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcde453cb8,0x7ffcde453cc8,0x7ffcde453cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7320 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\KFCBAEHCAE.exe"

C:\ProgramData\KFCBAEHCAE.exe

"C:\ProgramData\KFCBAEHCAE.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 360 -ip 360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 360 -s 2440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4072 -ip 4072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1368

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,10750140737437128856,2283613823942730776,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3996 /prefetch:2

Network

Country Destination Domain Proto
RU 31.41.244.10:80 31.41.244.10 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 10.244.41.31.in-addr.arpa udp
NL 142.250.102.84:443 accounts.google.com tcp
NL 142.250.102.84:443 accounts.google.com tcp
NL 142.250.102.84:443 accounts.google.com udp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com udp
GB 142.250.178.4:443 www.google.com tcp
N/A 224.0.0.251:5353 udp
RU 31.41.244.11:80 31.41.244.11 tcp
RU 185.215.113.103:80 185.215.113.103 tcp
NL 142.250.102.84:443 accounts.google.com udp

Files

memory/3472-0-0x0000000000900000-0x0000000000DBE000-memory.dmp

memory/3472-1-0x0000000077986000-0x0000000077988000-memory.dmp

memory/3472-2-0x0000000000901000-0x000000000092F000-memory.dmp

memory/3472-3-0x0000000000900000-0x0000000000DBE000-memory.dmp

memory/3472-4-0x0000000000900000-0x0000000000DBE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 f645fa36f7935209df0b4b98bf3e8b95
SHA1 97eab88b378f08e14be341069bd069c8e2fd27e4
SHA256 aa0306be10a9a2d84b64d6b6d36b917266c8bdf577411a9de60962579576cee5
SHA512 386457e610b392df6c298bd57d46b317d19d8af5b0821e3988ad28316cf7a6c370e6c7132c51563b6889ae6bbae552efa8f26aa31dce992c4557bff32f26189f

memory/3472-18-0x0000000000900000-0x0000000000DBE000-memory.dmp

memory/2208-16-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/2208-19-0x0000000000B51000-0x0000000000B7F000-memory.dmp

memory/2208-20-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/2208-21-0x0000000000B50000-0x000000000100E000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\b60349b782.exe

MD5 f47cc7dc355ae01926f6065316c3bd68
SHA1 6b575930185f216e4fa5116fdcc8906eb9f53af9
SHA256 25741e3975370f8b2c77513a0941ca4263a83ec08e1203c9dd7cfd5c18474794
SHA512 cf076a077130b8dd48f3e27a6aaba411a6c8833ab8b926c99fc3fb66130694db1ce668103c44aba6196705a9722b68da16287ea8a63ffed250bcf92bba68154e

C:\Users\Admin\AppData\Local\Temp\1000033001\dfc09ceb09.exe

MD5 333582f7841dd7d701b7c6ac8ee4ebe6
SHA1 7bbb42817dc444a8f88ab735f63d1722bccc5255
SHA256 78f4bcd5439f72e13af6e96ac3722fee9e5373dae844da088226158c9e81a078
SHA512 4ae6e1bb724080ec7eb86b848a1b78a3d40f11c5de90cfffd4917892d9823167a2ce14986c066aeb72edaab41dec8b8a4306a0580bface974ad4846cbc73eff2

memory/360-64-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 b8245f0525316f4756a7db9cd46d5fb1
SHA1 cfab0b2f557329f293cb4ca566de312f7987ce52
SHA256 211f1fddd0878ff32aa4d50feba8d7c1bbec79093d9bd86a4364402150a4f377
SHA512 202df0149f2e716d0fa8131f9ff27daf87f982bd6674b1809c8e6e55f84208fa380debf5bba3bb057caa99706cedeb3b29a53bbec82ef6eab587bc78847edf8d

memory/2208-95-0x0000000000B50000-0x000000000100E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 c6f71849b68404c695258ffe565567c0
SHA1 800eb258f3322c6e135e6c54a42f6a078a25392d
SHA256 f9f1327f8889d993994755376e08206f408fdacdb02323ff5abc6d750cbb65e6
SHA512 83665c8dbe8ef0f1e7703179bd8337216ffaaf6e686e9597b26d007736384618c95220ba7d25e4701096a7a40906f048a38db171e94e2d543528375e090d75a5

\??\pipe\LOCAL\crashpad_2108_CLLEKAUMZUQJPWJR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 30c4b91d643972ce05e5a4f5958d5828
SHA1 66d510e22027c0b9f407a60fc80704a343272b25
SHA256 eeb14b29cca9285b64a6291ca92548a323068568a0df54ee0343069305d0f981
SHA512 4f14829facb58d7e6633525256ea191d6395c0fc4964499d5aed725338268be8da5aea0e7ea9972559e7202972a16506d0bd67c8326e50d127dfec962a7c5126

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 b5456521ab010abba899a3cbb495f4a7
SHA1 efd2bdb146906a1e1e2ef4783f825490ad99b5d6
SHA256 cbb9931e784fc3c760305bf4423bce8d33be3b434978de05f489859bde4ae2b9
SHA512 5f2a03342c48f39279ac3be1aa787471686ac7b08125b5dac2404834eea57f22d6f79e1329985f5f4517bf4e2594778d6f1866d36894480b2ab725653ece14fc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57b9ea.TMP

MD5 23191b1a1386c68ecf99893cdca46c76
SHA1 1ca74fee8049722d440bf13b398a1777e4e8b5b3
SHA256 e3ba15a5fc44cced22620e83b720c4f407bbfeb187fd23a7f5ae269b0033c52a
SHA512 cadbd44da8f509640ee0756c16392b9ec4e7767a5b57c14523d8976611f532f5bec4046ddfc60ffed604f022db294a3896e1daa11ada4071dd51982e5b0782e0

memory/2208-205-0x0000000000B50000-0x000000000100E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

MD5 f7d8b659cfe25820c8420bba489d1ed1
SHA1 9bfed6c43eed4f532f6a30526862237677a5f88c
SHA256 328b39a2729250ba577d9b2595fee546ecfb95299748afa5a527cc3ac645769e
SHA512 5749254b9ee879417153ccda47e88228cf03b0f17dbd7da9c68a6b0cd712d975045c9e7ed2db32005420b83bf33322127943f9ecff0d523397c69bb4632cc923

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

memory/2208-232-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/2208-258-0x0000000000B50000-0x000000000100E000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/360-280-0x0000000000400000-0x000000000247A000-memory.dmp

memory/4072-286-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

MD5 657374c9488ed435c950106d1f459eb8
SHA1 b78ffa5828cb71dc6d62242923cb83df18dfb997
SHA256 f6d3a55329eccbdc3b2c2eb4f7702ece3c0c6c2d1a08600a3c0a49370502ee61
SHA512 ecb83967fc82bfcba1a3f4618c05dae149c7183394e64257ea1e443605d20738bb11d8b3f80f4a9b9207c4f0c73550992f70f9c13eb5f1cde7be95b552486632

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 cd165914ec350e44f99219ddce8df3df
SHA1 93c17703503df475bfa97ac10b992491f5699432
SHA256 36e61fe03940b7fe37de6ed062726b30b42be77c85106bd16f6f380ce2a43091
SHA512 4b68cbc0ebec9012975b553eabea31f8ffe2eaaa8d09e8453dced3ed1be1b48647690c24456bf646418fd49140b5a96652f6e55039c480849f24278886decfd2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/5020-333-0x00000000003F0000-0x00000000008AE000-memory.dmp

memory/5020-336-0x00000000003F0000-0x00000000008AE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 42da59aab1f583ac821ebdbd43e8d28a
SHA1 c5e3fd15295fc090fb4137775b8f9e618b18f277
SHA256 406e8887b0c61c1e0e64753c92a559a086854ccab7ce85aa30c446885523fda0
SHA512 5d4af2281d838dc699e75c8ce4e14313448ccf13274fdcddeb0381e79e6b0cc7bb6d455cf27e753ba594388d2bd7d8a043df1755cd9126918398eaa7288092a2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

MD5 f5058bf512ece2bf597c7524d750668e
SHA1 2b6e6334aa7323fe7ae415211a2429dbb7d1ce17
SHA256 985a152cebe1f2d49097d5a0a4f5b8c183f807372d2c70285add522c115443a3
SHA512 b528f91c6bc4fb08c2c65a0f9f4ed064bff00bc1ca1fcd1eeab846daea1da5f574eea1bcc6cd39c85b68e62ee4267b324e8017fd8aa44640a734a72660ef1cb1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57e148.TMP

MD5 0d390fd879ca00d7544bcdb173fdc796
SHA1 d777a60274f34b13329d7a19a852e8e77c536fe3
SHA256 eaab121ef396742c5eeeb6d9166453ee97a1dfc8df504cb0c1aa306eaa557b34
SHA512 6730c19f71056403c1e54a1fd800941babf174ff1f5145bd9513ad71d2297eb3cd272659e4908b76660a4928306f76470750a3f0a4f70ed54229af607d71e3d8

memory/360-350-0x0000000000400000-0x000000000247A000-memory.dmp

memory/2208-362-0x0000000000B50000-0x000000000100E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

memory/4072-395-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

MD5 977691b86906f50c1112a4aa5897b658
SHA1 f304f15b579536b83985559cee101c45c31cd4c5
SHA256 3e4c86f67dabaff675322c7704f131e691c51d5def0d545b904a94a4b5861f2c
SHA512 372f250f90da684746d9c7b89c6dfb87f24a1a1b1056121a78b0a004b6421e2ad3f7b615992cb78e4684f6d3d85a672beaf807c812304102df3f98437ab53f1f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

MD5 5da49ae72abc78505938b9047853fe9f
SHA1 7bc61ff35c191fb4e52f7521411414852395e866
SHA256 f24a7ae6b2a9db93fbefaacfe0fc86b3b1747bc696553f9258d90245d9a4f85c
SHA512 554bbbb9310e960f6084ee6e3ff33b99cea8efe09fd7a8a118c7b5e66d8ed3249f03d35a003497f1c9257eb2e398baa176d731413903d333ab05648f5099b1fe

memory/2208-405-0x0000000000B50000-0x000000000100E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\66e6f312-e05b-4110-bf35-56e5b319c096.tmp

MD5 c854a925a06227deeaf4ab8d7bca72af
SHA1 544d51fffc2c8a9db88a8a7fa1b0889c73e94208
SHA256 a5a16281dac7673b322e32366401c3090f13e28e79e5785b8eafe4f83a936316
SHA512 24088fe31c5785b0d07d0b2c527c9be2cd664d819a1fe81d3da64bf0537bc2e05408f0b72248770907e3b6a4ff28e9f0c99b3f680c3ae3c5d260bcfb8936b48e

memory/2208-424-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/5800-426-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/5800-428-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/2208-429-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/2208-439-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/2208-451-0x0000000000B50000-0x000000000100E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 f58ce133308b0ea7c4036baeddca34f5
SHA1 6ddcf43baf3bf47071162436f38230f4eb13f933
SHA256 981f49132aaa7dd654aa998dff8fb5deef2136ad074f4fe1db3b275bc02bd006
SHA512 4a7e9b8d94d819d940f32725ef902072ebd4ee699af8903e4ee67058a95b6e03d506ac4fb22dca297c4e3ef2c8d7ba07794690d314e54fba1c7defe908b3da46

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

MD5 0ba432d0d960aeae01914191085d514a
SHA1 b55599689bba60b7be078b325a2f06a62ab42381
SHA256 9f861c3ab39c05bf74bb039342b5464a7f5da197f7f917a2b9bb3e388dd541d5
SHA512 f28b26cc52813db9f069140c9e579bef45d582fc6e74a923efa90e24885dff447b598e408c0129ec279bbe9a3754c6ad9df3684d2b396db0de82ce19e5df817e

memory/2208-479-0x0000000000B50000-0x000000000100E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58dda9.TMP

MD5 44a8f17cb43c50b7d8fb1c489b579e2e
SHA1 dd205a28f76fec66e26fb624280d004dd70f0b51
SHA256 b8d7a189fb202845ffe9e5966d33db173b9304568b569716fc628ab8c0dc1913
SHA512 97f61e2cfa7df14d989c6b17ba42f7b3b29ba3757d38dddb78b8e15ba6a609d0b40bde36931288ab5e67f6ed6d727b51e84f6a3fedfd510c60e7f580b74fbddc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

MD5 ba0e79935436373b8a7e5858e0bb5583
SHA1 fce5b9585166342b5ccf768ebbf4182caffe9d1a
SHA256 1bbd9337f2da0599701bac000f160267f25c4b42f4007d23103bb016044ce0f1
SHA512 81c828f9371697326ca881177ee3ac9edfe5c2f75967f3584a4b92cf4776a6ebff73a5e5930459a447af848f63ca25920dcfa5f3c9b5e419924b9e727c1c6a28

memory/2208-489-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/2208-490-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/5348-492-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/5348-493-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/2208-494-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/2208-495-0x0000000000B50000-0x000000000100E000-memory.dmp

memory/2208-498-0x0000000000B50000-0x000000000100E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

MD5 8e9c0c98a3106740a076795a6ec9b9bf
SHA1 3726276789db85342506ecb2bba3d0b7e184839d
SHA256 26ce491391ed9883dcc1964d5838f7780c9b556cfe4b7044a33a9ce8faffef58
SHA512 b574b66c08b4bb98b3edfd623edaeb1a24a324c4486dff6b7fce69c87f65354e83afa2a333f9852890627d415299ca943b09806eb760d81be4e8c7e4f940c447

memory/2208-510-0x0000000000B50000-0x000000000100E000-memory.dmp