Malware Analysis Report

2024-10-23 21:52

Sample ID 240909-qzt9ra1ckr
Target 490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3
SHA256 490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3
Tags
amadey stealc c7817d rave discovery evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3

Threat Level: Known bad

The file 490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3 was found to be: Known bad.

Malicious Activity Summary

amadey stealc c7817d rave discovery evasion persistence stealer trojan

Stealc

Amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Loads dropped DLL

Executes dropped EXE

Checks BIOS information in registry

Identifies Wine through registry keys

Checks computer location settings

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-09 13:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-09 13:42

Reported

2024-09-09 13:44

Platform

win7-20240903-en

Max time kernel

149s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\67ca6fcd1a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\67ca6fcd1a.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1680 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 1680 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 1680 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 1680 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2812 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe
PID 2812 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe
PID 2812 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe
PID 2812 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe
PID 2812 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe
PID 2812 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe
PID 2812 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe
PID 2812 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe
PID 2812 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe
PID 2812 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe
PID 2812 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe
PID 2812 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe

"C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe

"C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\67ca6fcd1a.exe"

C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe

"C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe"

Network

Country Destination Domain Proto
RU 31.41.244.10:80 31.41.244.10 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
RU 31.41.244.10:80 31.41.244.10 tcp
RU 185.215.113.103:80 185.215.113.103 tcp
RU 185.215.113.103:80 185.215.113.103 tcp

Files

memory/1680-0-0x00000000002B0000-0x000000000076D000-memory.dmp

memory/1680-1-0x0000000077E80000-0x0000000077E82000-memory.dmp

memory/1680-2-0x00000000002B1000-0x00000000002DF000-memory.dmp

memory/1680-3-0x00000000002B0000-0x000000000076D000-memory.dmp

memory/1680-5-0x00000000002B0000-0x000000000076D000-memory.dmp

memory/1680-9-0x00000000002B0000-0x000000000076D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 b6a1d5e330810ef9470b06cf58a9ff36
SHA1 386658f0a415ef445052be60c8af53b1a8f06bbe
SHA256 490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3
SHA512 fba6477b755051530f85b62767d37e818bfd74ae5614d44d572d7d10d15cfeb468b994383b13e2099222d2b193943327da07a613c305cdb94763ace30b6610a8

memory/1680-16-0x00000000002B0000-0x000000000076D000-memory.dmp

memory/2812-17-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-18-0x0000000000BB1000-0x0000000000BDF000-memory.dmp

memory/2812-19-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-21-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-22-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-23-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-24-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-25-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-26-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-27-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-28-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-29-0x0000000000BB0000-0x000000000106D000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\d1abf106e8.exe

MD5 c06c4e6ed6f4c67541e9cdacb508f653
SHA1 0a587b8151e8634a48dd686157b45a2e0477093c
SHA256 75406b44f46f30aed814150ed323b10f34d6e68b585a75b6e9796f556f1cd691
SHA512 93f7d6ee59b28bf72d1bfe16c5482d9fa0e1eb0f8ce9b901dc31a66b07e2e65cf21972723c90d5f86826d2cad53d126f18f1ae085416cc203059fa3c13d71440

memory/2812-46-0x00000000069D0000-0x0000000007058000-memory.dmp

memory/2712-48-0x0000000001230000-0x00000000018B8000-memory.dmp

memory/2812-47-0x00000000069D0000-0x0000000007058000-memory.dmp

memory/2712-58-0x0000000001230000-0x00000000018B8000-memory.dmp

memory/952-68-0x0000000000D40000-0x00000000013C8000-memory.dmp

memory/2812-66-0x00000000069D0000-0x0000000007058000-memory.dmp

memory/2812-65-0x00000000069D0000-0x0000000007058000-memory.dmp

memory/952-70-0x0000000000D40000-0x00000000013C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000033001\6fecfc73f1.exe

MD5 0df4978ab22502c7ae122ab13a255448
SHA1 845169633a45d0bc64c4799c0b5118ce6148131f
SHA256 e2a03fd46d56cb79ec4c0cbef9e6fe2bd3067418f81f77355c908cfeae03ee76
SHA512 d1b2a6ac51348f698f4d06ba62be48150fc7e1c0fdb1a99853caf555c3afcf76eea26a5862768c54a113bef2d5ee84d8c5f49c1903fecc7e15ee0282b903a69a

memory/2812-85-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-86-0x00000000069D0000-0x0000000007058000-memory.dmp

memory/2812-87-0x00000000069D0000-0x0000000007058000-memory.dmp

memory/2812-88-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-89-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-90-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-91-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-92-0x0000000000BB0000-0x000000000106D000-memory.dmp

memory/2812-93-0x0000000000BB0000-0x000000000106D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-09 13:42

Reported

2024-09-09 13:44

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0867091607.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\0867091607.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2660 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2660 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2660 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 568 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe
PID 568 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe
PID 568 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe
PID 568 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe
PID 568 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe
PID 568 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe
PID 1760 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1760 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1616 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 1616 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4268 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe

"C:\Users\Admin\AppData\Local\Temp\490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe"

C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe

"C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaae7946f8,0x7ffaae794708,0x7ffaae794718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8088 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7924 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1250577323233430008,4929074517066757070,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7924 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
RU 31.41.244.10:80 31.41.244.10 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 10.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 103.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com tcp
US 8.8.8.8:53 20.177.190.20.in-addr.arpa udp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 84.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.238:443 play.google.com tcp
GB 216.58.212.238:443 play.google.com tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.212.238:443 play.google.com udp
GB 142.250.178.4:443 www.google.com tcp
US 8.8.8.8:53 238.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp

Files

memory/2660-0-0x0000000000670000-0x0000000000B2D000-memory.dmp

memory/2660-1-0x0000000077CB4000-0x0000000077CB6000-memory.dmp

memory/2660-2-0x0000000000671000-0x000000000069F000-memory.dmp

memory/2660-3-0x0000000000670000-0x0000000000B2D000-memory.dmp

memory/2660-4-0x0000000000670000-0x0000000000B2D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 b6a1d5e330810ef9470b06cf58a9ff36
SHA1 386658f0a415ef445052be60c8af53b1a8f06bbe
SHA256 490c24efe5ee7485a135c0f185fdd9f44ecc0403a20cba3970adddd5f2d973a3
SHA512 fba6477b755051530f85b62767d37e818bfd74ae5614d44d572d7d10d15cfeb468b994383b13e2099222d2b193943327da07a613c305cdb94763ace30b6610a8

memory/2660-16-0x0000000000670000-0x0000000000B2D000-memory.dmp

memory/568-17-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-19-0x0000000000C51000-0x0000000000C7F000-memory.dmp

memory/568-20-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-21-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-22-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-23-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-24-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-25-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/3396-27-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/3396-28-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/3396-30-0x0000000000C50000-0x000000000110D000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\0d5916eb57.exe

MD5 f2a4919a6e3c68422063903dc2b56d46
SHA1 e5d0037eb770cbcad72a31ecc06bbf60f7dc7ed9
SHA256 adac0372e1067bf8344df9f34647ee6c6fc6383aa4892e340b888ad89bdfe933
SHA512 de7453a56a48687f5d3470773c0f5a1b8a3d6a029e44d85c4871fd41be69d50367cdf0663737284cf26f75832818f7291c435c46ae51f28e2feda51c8aeeed5b

memory/568-45-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-46-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-47-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-48-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-49-0x0000000000C50000-0x000000000110D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000030001\0867091607.exe

MD5 c06c4e6ed6f4c67541e9cdacb508f653
SHA1 0a587b8151e8634a48dd686157b45a2e0477093c
SHA256 75406b44f46f30aed814150ed323b10f34d6e68b585a75b6e9796f556f1cd691
SHA512 93f7d6ee59b28bf72d1bfe16c5482d9fa0e1eb0f8ce9b901dc31a66b07e2e65cf21972723c90d5f86826d2cad53d126f18f1ae085416cc203059fa3c13d71440

memory/4752-66-0x0000000000A40000-0x00000000010C8000-memory.dmp

memory/4752-67-0x0000000000A40000-0x00000000010C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000033001\450ca52a0b.exe

MD5 0df4978ab22502c7ae122ab13a255448
SHA1 845169633a45d0bc64c4799c0b5118ce6148131f
SHA256 e2a03fd46d56cb79ec4c0cbef9e6fe2bd3067418f81f77355c908cfeae03ee76
SHA512 d1b2a6ac51348f698f4d06ba62be48150fc7e1c0fdb1a99853caf555c3afcf76eea26a5862768c54a113bef2d5ee84d8c5f49c1903fecc7e15ee0282b903a69a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 88830e3ff0714a54773a1d1140afb408
SHA1 8bee7c44f578bc9bdc0ea47e7d48f7a96cbe43c0
SHA256 355f3405c7fb8ef754890443e689695cf9c0666b62831ac2e289c37d05405f97
SHA512 b2b9a7b50bc1721be64f456c4b504dc5ae438d46f8d838ddd9b2735fea3b9a10945a66b3f726cfd446a079a662f97720e00d65de627d1f73c989eef67b17ba6a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 0c78855721cd9176a6353dfae8aab6a3
SHA1 f2cda18a4bf3793b36492f83d58e24edacc1c804
SHA256 371b1c331065f7031378cbdf4f186b97fcbb93da50f6f392f9e8fc88085cf33f
SHA512 b616dbf08786f38cce03e59d68ae34c7e19e7f58d91fea01fcffd2afc8f52bd97e2c6869a641d68bedd46c53c7f694bfa6ae645419803fbd339058006893e33f

\??\pipe\LOCAL\crashpad_4268_XKBFBBKSPLOIUKDI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/568-114-0x0000000000C50000-0x000000000110D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 745fa39ae864edf7de96c16cbd211118
SHA1 a38b198644fbc597c493fbd9666ecba1652575e9
SHA256 662146b8e7487fdf46f7f97e00fdce989ceb89e2c4fb466ab1c676b561846be4
SHA512 aaec3715111b155eee9b073a35458c2e583fdf2faed4fe1501103632b9b377b000a69ccb5abe602edb6809a1d4d2a9c398470606b04d9a15a7bee0bc88c5c954

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\b89b8892-c66e-40dd-ae57-8ff10c9706af.tmp

MD5 af0da33f429a9b5901b045180d4e23b1
SHA1 26592f792365d30fef70b407ab683b6556084235
SHA256 c3e0f3a6107eb1852ad98d3ce554afb2de705f3a12ec782eb95359850efea3e2
SHA512 38dbdfd62de6535dabdf3506843ad6e69ac374cde90476643b90f91fee6b4004214f16a43c629a021ded7e3b94baa10b6e7b44cd9adc97dc2e0b98617147f4c6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

MD5 ca171551927cf8b695361e585af9d0e4
SHA1 d26b90cf4260f5e923b917d6d6226e5313d1128e
SHA256 a46f9cd1664864e0fd0929c2ad1db981402a631b0eea38ce7e204dcf5b00d94e
SHA512 1ef2043e4137c6ad0628972042eed91e4a9d596a7a62570eb3f987d03d4a533bca106ebaf14a987d3cbe18264e0580b0a919fa40a98faf4151caaddd648a2b1f

memory/6128-243-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/6128-245-0x0000000000C50000-0x000000000110D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PYYXZ9R2K43FZVN1CWX5.temp

MD5 6fae1e58a155fa8de46b6fce3a65501b
SHA1 3b2db8d25b8817bd780d77bc05260bbaee007b4f
SHA256 be6437eabe7fb4a3a4d66fe0d3eb40452f271b555bf0114738e3d305e03bc528
SHA512 c47b11c6b20e8558c498a22a317e59ea6bcdf1a0d7b5d94fe239d6330f5e715ae50894bcd1e7a6d2ff1f00e9c67245b9fcec6eed3368e8a3584229e6b9cb8b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 9a1591128f3bc64a6ec42c42118a19a3
SHA1 fe9e67233b02b9eafef01e7181afad5028d6ad5b
SHA256 82d84088a96d3d41cb9d0f57dd696238550f68fa8599928084e16a0f05593529
SHA512 eedd92e72c410932bc5e240d4f14547f76315131a396adb3ab35c2637160169fc45d6203bea4948db61dc0512308241102290496b82268c9e464bce4b62d0f2c

memory/568-292-0x0000000000C50000-0x000000000110D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe595097.TMP

MD5 7ab050c88bd3f2061c0508942fb09d0c
SHA1 d4e01672bca0f943a4a02f822fff85bba59c4e41
SHA256 39a1a990a8ddd47fbbf5c8676c20d3d45c172ecd8942fdb18514cd71946e29cd
SHA512 87197d9d0716f018b52f32bd881b4d0d2753e05669c9735e2b6d65acc1f8527fbc7fbd0b49ecbed099f938b869d12553ad8ca024e1026e2dce053d45421624d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

MD5 ab3299e5be13f04798822f72baeb1cb9
SHA1 3374e0d0bd2e22915e0bec28be798f8a2004c9e0
SHA256 34593ff1f0326265c21b33d7e60070ff5bc702f809a7f1b38d224ed1850ca9b1
SHA512 76eaffd125f1e58e29f24e316cbac1575fdf6f724bc2d66b8e86b8f19165013642effc533fbebbcd384665d91336d9b15c3219b5bbfe219bfa84dd5d07c77268

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

memory/568-358-0x0000000000C50000-0x000000000110D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\f82c2f8f-1659-4e27-94f7-8fd3041a84ce.tmp

MD5 a35f25ac22784b4beca2234c85a32c71
SHA1 d118c97b6495c3ad44daf569428d1df94e3efe0e
SHA256 95f54c3870aa0744fef0c720753256d8b1df6750a04fa7771ec8fbf07a73b0e7
SHA512 b45e53d69a84d2979f198deee508540198e4420785c4b6fae026cc51fff7437fd9964a1aceed0088a3748861bb8491a4ac715a1312c6b7215ecd8cf719d5f90a

memory/568-377-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-378-0x0000000000C50000-0x000000000110D000-memory.dmp

memory/568-388-0x0000000000C50000-0x000000000110D000-memory.dmp