Malware Analysis Report

2024-10-23 21:52

Sample ID 240909-vkbw3s1gpa
Target 07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4
SHA256 07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4
Tags
amadey stealc c7817d rave discovery evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4

Threat Level: Known bad

The file 07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4 was found to be: Known bad.

Malicious Activity Summary

amadey stealc c7817d rave discovery evasion persistence stealer trojan

Stealc

Amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Identifies Wine through registry keys

Loads dropped DLL

Checks BIOS information in registry

Adds Run key to start application

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-09 17:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-09 17:02

Reported

2024-09-09 17:05

Platform

win7-20240903-en

Max time kernel

149s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\e94896403d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\e94896403d.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2672 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2672 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2672 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2680 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe
PID 2680 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe
PID 2680 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe
PID 2680 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe
PID 2680 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe
PID 2680 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe
PID 2680 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe
PID 2680 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe
PID 2680 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe
PID 2680 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe
PID 2680 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe
PID 2680 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe

Processes

C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe

"C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe

"C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\e94896403d.exe"

C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe

"C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe"

Network

Country Destination Domain Proto
RU 31.41.244.10:80 31.41.244.10 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
RU 185.215.113.103:80 185.215.113.103 tcp
RU 185.215.113.103:80 185.215.113.103 tcp

Files

memory/2672-0-0x0000000001040000-0x00000000014ED000-memory.dmp

memory/2672-1-0x0000000077BC0000-0x0000000077BC2000-memory.dmp

memory/2672-2-0x0000000001041000-0x000000000106F000-memory.dmp

memory/2672-3-0x0000000001040000-0x00000000014ED000-memory.dmp

memory/2672-5-0x0000000001040000-0x00000000014ED000-memory.dmp

memory/2672-10-0x0000000001040000-0x00000000014ED000-memory.dmp

\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 30ac84841a731fa47a3ce25033db8449
SHA1 7c2c107362576bd653e0dc6f96be4d7295d70889
SHA256 07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4
SHA512 d56c10c8af777e516ed343544c7b17eb5b1a9553c283da53728013adf1e5d572cf290be6502d25b42f8b617b36a754c39a320dfa4eb545e382de3689a3547e9f

memory/2672-18-0x0000000001040000-0x00000000014ED000-memory.dmp

memory/2680-16-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2672-15-0x0000000006A00000-0x0000000006EAD000-memory.dmp

memory/2680-19-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-20-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-23-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-22-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-24-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-25-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-26-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-27-0x0000000000E10000-0x00000000012BD000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\9542106407.exe

MD5 110750350e3f833d4de59ed0c7dd1b08
SHA1 ff21c68dad2c4733ced39aabd130e0406a56ed58
SHA256 d89f747d96c84dcd1a704731dd4261f6eb69f1498a05cae00a4635169ce5ec20
SHA512 df963df25b627e0aa446c0170acbfd3589d0b243eae8c34d84cd77940ee1d58b90f4a4739c10053eedd3dc1036a20aaf8cf202c8ed991b487712137ec0d52493

memory/2680-44-0x0000000006890000-0x0000000006EF9000-memory.dmp

memory/2296-46-0x0000000001270000-0x00000000018D9000-memory.dmp

memory/2680-43-0x0000000006890000-0x0000000006EF9000-memory.dmp

memory/2680-62-0x0000000006890000-0x0000000006EF9000-memory.dmp

memory/2808-65-0x0000000000900000-0x0000000000F69000-memory.dmp

memory/2680-64-0x0000000006890000-0x0000000006EF9000-memory.dmp

memory/2296-66-0x0000000001270000-0x00000000018D9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000033001\e94896403d.exe

MD5 af850fd36ef4f28bd1c92fd30feec5d1
SHA1 5854cc232850fe8ce0d475c51ec14bf8e0f761ad
SHA256 7605e6672cf788c7e666ce3855dad7a0aa7f69cff512ff22105ea3f189c2c382
SHA512 dd4c84e6b632058596207a5fbe675765c638b6fb0cf2d274ab387936d581153247b6e1ed51e746f87895489cd9a6d43913d38aec24e338de27034604505239f6

memory/2680-75-0x0000000006890000-0x0000000006EF9000-memory.dmp

memory/2680-82-0x0000000006890000-0x0000000006EF9000-memory.dmp

memory/2808-84-0x0000000000900000-0x0000000000F69000-memory.dmp

memory/2680-85-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-86-0x0000000006890000-0x0000000006EF9000-memory.dmp

memory/2680-87-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-88-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-89-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-90-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-91-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-92-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-93-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-94-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-95-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-96-0x0000000000E10000-0x00000000012BD000-memory.dmp

memory/2680-97-0x0000000000E10000-0x00000000012BD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-09 17:02

Reported

2024-09-09 17:05

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\01745eeb65.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\01745eeb65.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4984 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 4984 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 4984 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 4832 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe
PID 4832 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe
PID 4832 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe
PID 4832 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe
PID 4832 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe
PID 4832 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe
PID 4832 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe
PID 4832 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe
PID 4832 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe
PID 4828 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4828 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2164 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 4144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 4144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 4144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 4144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 4144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 4144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe

"C:\Users\Admin\AppData\Local\Temp\07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe

"C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\01745eeb65.exe"

C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe

"C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff122546f8,0x7fff12254708,0x7fff12254718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7536 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7840 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7300 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7300 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3770771143997650306,16606634338508789043,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 31.41.244.10:80 31.41.244.10 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 10.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 103.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com tcp
US 8.8.8.8:53 84.102.250.142.in-addr.arpa udp
NL 142.250.102.84:443 accounts.google.com udp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 206.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

memory/4984-0-0x0000000000EE0000-0x000000000138D000-memory.dmp

memory/4984-1-0x0000000077094000-0x0000000077096000-memory.dmp

memory/4984-2-0x0000000000EE1000-0x0000000000F0F000-memory.dmp

memory/4984-3-0x0000000000EE0000-0x000000000138D000-memory.dmp

memory/4984-5-0x0000000000EE0000-0x000000000138D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 30ac84841a731fa47a3ce25033db8449
SHA1 7c2c107362576bd653e0dc6f96be4d7295d70889
SHA256 07669de4a752e210ee8066a04305d250ba526ff3581b5e3361f30821548dacb4
SHA512 d56c10c8af777e516ed343544c7b17eb5b1a9553c283da53728013adf1e5d572cf290be6502d25b42f8b617b36a754c39a320dfa4eb545e382de3689a3547e9f

memory/4832-18-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4984-17-0x0000000000EE0000-0x000000000138D000-memory.dmp

memory/4832-19-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-20-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-21-0x0000000000BF0000-0x000000000109D000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\fea1a3ad69.exe

MD5 110750350e3f833d4de59ed0c7dd1b08
SHA1 ff21c68dad2c4733ced39aabd130e0406a56ed58
SHA256 d89f747d96c84dcd1a704731dd4261f6eb69f1498a05cae00a4635169ce5ec20
SHA512 df963df25b627e0aa446c0170acbfd3589d0b243eae8c34d84cd77940ee1d58b90f4a4739c10053eedd3dc1036a20aaf8cf202c8ed991b487712137ec0d52493

memory/388-37-0x0000000000C70000-0x00000000012D9000-memory.dmp

memory/388-39-0x0000000000C70000-0x00000000012D9000-memory.dmp

memory/388-38-0x0000000000C71000-0x0000000000C85000-memory.dmp

memory/4832-40-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/1892-56-0x0000000000DC0000-0x0000000001429000-memory.dmp

memory/388-57-0x0000000000C70000-0x00000000012D9000-memory.dmp

memory/4832-58-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-59-0x0000000000BF0000-0x000000000109D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000033001\db1b7c8a58.exe

MD5 af850fd36ef4f28bd1c92fd30feec5d1
SHA1 5854cc232850fe8ce0d475c51ec14bf8e0f761ad
SHA256 7605e6672cf788c7e666ce3855dad7a0aa7f69cff512ff22105ea3f189c2c382
SHA512 dd4c84e6b632058596207a5fbe675765c638b6fb0cf2d274ab387936d581153247b6e1ed51e746f87895489cd9a6d43913d38aec24e338de27034604505239f6

memory/4832-68-0x0000000000BF0000-0x000000000109D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 34a1ca97e745e9e093301217e4b961d5
SHA1 11434215f317125b09b5d2eb49a65900b9380563
SHA256 b9318dcc888aeb20903067355ac0cd2d204520b37e32e32fd80cd0b5b506bc46
SHA512 e228da07cb1c252769b6aa4b70e07993561e009924c50700fdfd7b00c99146b4a3da5d9fa3b0a1f2ed76067d40b038b30e10f009b393d99ec5cb8e71af9457e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 5e33f94ef10c5956171919958bea096d
SHA1 13b082a62f8cd74e8c3f4022b33d7f0869e80464
SHA256 841b98b5771ad108607c0ebe599732ffc6e4ea66cb6758f4c79a9e76da3dcf02
SHA512 3a0a03bb35fc79f21c7bd7ab46ab43be908097690541ec9f6edaee1a26ece73ffe1d44096b046f32c44552439f7c55c422c1a5e61f8a1ff770b29117e1abfa7c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 e5ed3e68f0a89e35ca41c8cc5c39b3fa
SHA1 b0dfd49e9a6035397788290258db3403a4697752
SHA256 ebab32a824c84b58a7b2ee70dca890581366414dbb0052462cfc587886a4c036
SHA512 0daa448a9b85950fb127e3dd556518b3c1cec575cea5bb86ec9ccdbd342fb215e09119c9927fa857c15605ec50deaa42510414c192f71abfd91810a4642121cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57d34e.TMP

MD5 16de468e5ff55e0f5683b446d2caa833
SHA1 260d3c720f6891ac5a058f87386399d3f151deb9
SHA256 d03c2754556da23b792aa29dd15bb52387fdb52701d401ba5f74ba3e9ed1f3d9
SHA512 d10fbd104f3001ee42672f38049cd50c3b1e828fe2c8630512cb8e1fb5a186de9f82ee6301bb15468b45d67200836c2069924aac77ed50461f0fa7839bc10c76

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

MD5 521911fa322bef3154d15a7362e3f543
SHA1 c5997efbeb4f3b33252abc7ee43206bacb254ae8
SHA256 c4fd87f5c9ab07faa6d52ebc234f22aa61d400eef2fd58dd3bc60317feb0bab2
SHA512 587d1cd11afa6f8c3942df9aa7ab21c6eed093be5b8e40200380446802ebd532e2443e6848231940b352c5930f90793f01130b7c3c9178e64f6265999df4a22d

memory/1892-223-0x0000000000DC0000-0x0000000001429000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ADNYGQJ3M3GTFNDHKA7P.temp

MD5 f07751c0ef5120f26e4b57812afba768
SHA1 e2d47ff556e3d3cbcf46f9788a9b200b05c2eea7
SHA256 898c84d7f1836b6e59811ca5eeff357f9c705a34b836ab8ba23dd3e1974033e6
SHA512 fa72165966fd1f83dcc5ca090c8c7fdd5121613c895a01f78958e8a62200a0468f526e614fea92015439b828c40bc83d2e8a847c615a1862d58a55e1542c7b9e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/4832-259-0x0000000000BF0000-0x000000000109D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 2edf11698e732d3adc906a2588b44b55
SHA1 3d91d93229053e60cb25674a7d76b43b5f7f4649
SHA256 ba1452e35866ef2169fb2e1b183414d7516819e28c7fb1a6ab6bf6e180b2df4e
SHA512 cc9eebe0bb6b4a78e617c4bb25f77bc7bd79e7fb7db9955e9079957860d75f04d42193a2b5680fcd1a08aef058b632df74bb592bf76683145d613f3d42831fa4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

MD5 d951e411b8fe71a15422b7d512d8afdc
SHA1 849f5c9964741c6fd79b453b14d6b74d4bfbad70
SHA256 5357a4a3afa8399423361d02fba48a7b6ad0fb54399c2d7638cc493d36523a7f
SHA512 56acd9fc4ff32e1448b5ac7a6f341bddf4c0cede05a41b2e32adeafbda20a98b4b824e3ce608dac89809d60de93505cb50a9156c04286a8c678636eb211386c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57fd2c.TMP

MD5 c510878f8c8705e7c7b4457a0280e7ae
SHA1 5a445ee568b7512585bfdf7db84daeed1b3d3cc8
SHA256 5024a9020046204858d077520b9bfc997ef7936786966bd8fdfaeac86ab4bb96
SHA512 bf76038bb2b49b4c74d81ec348cf0c25ffb4f69e1f5c7963dde3e3f736b076781fec9e3053ed9588f10e7353d21f90bbfd5aafde38cfdc6a7e1bf0e119a45ac1

memory/6068-285-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/6068-286-0x0000000000BF0000-0x000000000109D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

memory/4832-339-0x0000000000BF0000-0x000000000109D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\10107ee9-e79a-472b-80ad-dd17e851c354.tmp

MD5 a979f84c22ce858ef217c0ad5e9d42db
SHA1 6a662aefcc591fd8f12e1a1fdfa67da653246335
SHA256 5f4d2de9c593394f7c68fd63057ff0f9b1b61efd75c44e68abc0434fb71ef1ad
SHA512 6635ce976835416b7d33f1858db3ee3d5de607b7323f36439947253c642e8aa3ce029c9c2401a44cd446d5736d35e449106042494c215bfd5276ffe11e2676bb

memory/4832-358-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-359-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-360-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-370-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-380-0x0000000000BF0000-0x000000000109D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 09bd631f34811276d423f53a53bb4c16
SHA1 7877a528c13a8e1e381931630284e27a5cc7052a
SHA256 6db40c17636f2e2c1c49830533e7ec9a32861ca26420e909f2cb9f7e1364e1ae
SHA512 2d748b9ff409f0dc786f75e5dce04170463d2abe6427880faeceb0c1697a11df85cdcb414f8c269bf99a18bffe35baa76abce720a819e4f2f75318753a9bb7b9

memory/1576-400-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-401-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-402-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-403-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-404-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-405-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/4832-408-0x0000000000BF0000-0x000000000109D000-memory.dmp

memory/3960-412-0x0000000000BF0000-0x000000000109D000-memory.dmp