Malware Analysis Report

2024-10-23 21:51

Sample ID 240910-cneg9stdqf
Target c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe
SHA256 c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d
Tags
amadey stealc c7817d rave discovery evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d

Threat Level: Known bad

The file c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe was found to be: Known bad.

Malicious Activity Summary

amadey stealc c7817d rave discovery evasion persistence stealer trojan

Stealc

Amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Checks computer location settings

Loads dropped DLL

Identifies Wine through registry keys

Checks BIOS information in registry

Executes dropped EXE

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Drops file in Windows directory

Program crash

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-10 02:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-10 02:13

Reported

2024-09-10 02:15

Platform

win7-20240903-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\c31a627e9f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\c31a627e9f.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\759b53f3ac.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\759b53f3ac.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\c31a627e9f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3020 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 3020 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 3020 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 3020 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2336 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\c31a627e9f.exe
PID 2336 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\c31a627e9f.exe
PID 2336 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\c31a627e9f.exe
PID 2336 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\c31a627e9f.exe
PID 2336 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe
PID 2336 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe
PID 2336 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe
PID 2336 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe

"C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\c31a627e9f.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\c31a627e9f.exe"

C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe"

Network

Country Destination Domain Proto
RU 31.41.244.10:80 31.41.244.10 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
RU 185.215.113.103:80 185.215.113.103 tcp
RU 185.215.113.16:80 185.215.113.16 tcp

Files

memory/3020-0-0x0000000000980000-0x0000000000E29000-memory.dmp

memory/3020-1-0x0000000077270000-0x0000000077272000-memory.dmp

memory/3020-2-0x0000000000981000-0x00000000009AF000-memory.dmp

memory/3020-3-0x0000000000980000-0x0000000000E29000-memory.dmp

memory/3020-4-0x0000000000980000-0x0000000000E29000-memory.dmp

\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 d5fcf8cf3ca99a694ee9b8a97776e64a
SHA1 07542ce45f902bdc773702e17621cc600d3df50b
SHA256 c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d
SHA512 90da999cc41cef8a44a3b0186b2de606567414024a60e1467f970e39d64f67af254067e11ac19c7f8f7e1e270c3a71cd9214de4773044e68616dfb053c058e2e

memory/2336-17-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/3020-15-0x00000000072F0000-0x0000000007799000-memory.dmp

memory/3020-14-0x0000000000980000-0x0000000000E29000-memory.dmp

memory/2336-18-0x0000000000BF1000-0x0000000000C1F000-memory.dmp

memory/2336-19-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-21-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-22-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-23-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-24-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-25-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-26-0x0000000000BF0000-0x0000000001099000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\af0a748888.exe

MD5 89de2271395cf03d243a477da4278b01
SHA1 da2b50fd12429b35a00f791811610684dfaa466b
SHA256 37a89d7f97064569f9fb537ac04b66bbb9ec4e959711c4f3c5837b78b492cafa
SHA512 baeacb60248ef4d85acc25a284a237964f43433e5a59bbbfc4aef449bc5b71830bc3cf5d77d374d2a3b85afb8833e4a83f139a396ac111e9009285bea5ffb77a

\Users\Admin\AppData\Local\Temp\1000030001\c31a627e9f.exe

MD5 f47cc7dc355ae01926f6065316c3bd68
SHA1 6b575930185f216e4fa5116fdcc8906eb9f53af9
SHA256 25741e3975370f8b2c77513a0941ca4263a83ec08e1203c9dd7cfd5c18474794
SHA512 cf076a077130b8dd48f3e27a6aaba411a6c8833ab8b926c99fc3fb66130694db1ce668103c44aba6196705a9722b68da16287ea8a63ffed250bcf92bba68154e

memory/2336-55-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/772-56-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\759b53f3ac.exe

MD5 38f98be80e6670f46efc8544d762cfd4
SHA1 fcad2e65d0977f0ab297049d5c9c32450b230d2a
SHA256 fb5cdb8d0f5558d5544c7722e616fbb498b501484f6ad0d1e2a2fe8118574996
SHA512 60a0c8f5516b41faa57ec4010eaed39a255ad2c96e58d7ae1273d3ef44196ea50b4f64c52e8301a95e45139ccd52bd9b52d177121ad1c77289bed89ac49c04cf

memory/2336-71-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-72-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-73-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-74-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-75-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-76-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-77-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-78-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-79-0x0000000000BF0000-0x0000000001099000-memory.dmp

memory/2336-80-0x0000000000BF0000-0x0000000001099000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-10 02:13

Reported

2024-09-10 02:15

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0276563435.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\0276563435.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c31a627e9f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\c31a627e9f.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000026000\849dfb91a9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\0276563435.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1068 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 1068 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 1068 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2688 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\849dfb91a9.exe
PID 2688 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\849dfb91a9.exe
PID 2688 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\849dfb91a9.exe
PID 2688 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\0276563435.exe
PID 2688 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\0276563435.exe
PID 2688 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\0276563435.exe
PID 2688 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe
PID 2688 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe
PID 2688 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe
PID 1228 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1228 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 3340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 5000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 5000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 2216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 2216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 2216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 2216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 2216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1956 wrote to memory of 2216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe

"C:\Users\Admin\AppData\Local\Temp\c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Roaming\1000026000\849dfb91a9.exe

"C:\Users\Admin\AppData\Roaming\1000026000\849dfb91a9.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\0276563435.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\0276563435.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4400 -ip 4400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1316

C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8c2d46f8,0x7ffd8c2d4708,0x7ffd8c2d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14523827421273959762,5699411985927939650,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3108 -ip 3108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 1252

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
RU 31.41.244.10:80 31.41.244.10 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 10.244.41.31.in-addr.arpa udp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 103.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com tcp
NL 142.250.102.84:443 accounts.google.com tcp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 84.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.212.206:443 play.google.com udp
GB 142.250.178.4:443 www.google.com tcp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 206.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
NL 142.250.102.84:443 accounts.google.com udp

Files

memory/1068-0-0x0000000000550000-0x00000000009F9000-memory.dmp

memory/1068-1-0x0000000077084000-0x0000000077086000-memory.dmp

memory/1068-2-0x0000000000551000-0x000000000057F000-memory.dmp

memory/1068-3-0x0000000000550000-0x00000000009F9000-memory.dmp

memory/1068-4-0x0000000000550000-0x00000000009F9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 d5fcf8cf3ca99a694ee9b8a97776e64a
SHA1 07542ce45f902bdc773702e17621cc600d3df50b
SHA256 c583d2baee3ad40a8ce2f25b2427f20e9a6a95d811ca1deef408d6a238278b8d
SHA512 90da999cc41cef8a44a3b0186b2de606567414024a60e1467f970e39d64f67af254067e11ac19c7f8f7e1e270c3a71cd9214de4773044e68616dfb053c058e2e

memory/2688-18-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/1068-17-0x0000000000550000-0x00000000009F9000-memory.dmp

memory/2688-19-0x0000000000B11000-0x0000000000B3F000-memory.dmp

memory/2688-20-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-21-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-22-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-23-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-24-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-25-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-26-0x0000000000B10000-0x0000000000FB9000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\849dfb91a9.exe

MD5 f47cc7dc355ae01926f6065316c3bd68
SHA1 6b575930185f216e4fa5116fdcc8906eb9f53af9
SHA256 25741e3975370f8b2c77513a0941ca4263a83ec08e1203c9dd7cfd5c18474794
SHA512 cf076a077130b8dd48f3e27a6aaba411a6c8833ab8b926c99fc3fb66130694db1ce668103c44aba6196705a9722b68da16287ea8a63ffed250bcf92bba68154e

memory/4400-59-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\c31a627e9f.exe

MD5 38f98be80e6670f46efc8544d762cfd4
SHA1 fcad2e65d0977f0ab297049d5c9c32450b230d2a
SHA256 fb5cdb8d0f5558d5544c7722e616fbb498b501484f6ad0d1e2a2fe8118574996
SHA512 60a0c8f5516b41faa57ec4010eaed39a255ad2c96e58d7ae1273d3ef44196ea50b4f64c52e8301a95e45139ccd52bd9b52d177121ad1c77289bed89ac49c04cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 8e05c52718a60f540b080554782b149e
SHA1 cfa9977b266437b3bc2a5ad5c4df24271c89b993
SHA256 89c92d022d7d642365df6aba16a168f908a47926df0f55e03e91ee209e58e64d
SHA512 8ed54166e13b9243787083e036ed50c03d821cfb6b65825c6a9e4023e1088cfc90a23f6678356ca2f881f0c5a9a62e564fca836b91a81a48e14789cda91b4c91

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 3ad8a27da35eb82373bc02eb4be412c6
SHA1 d837e841be817de0466deeb3e4283455a8d0207d
SHA256 6ed24bd721ac1dc6a54e43a8fb5992c91457e7368d2215bfe1cf5b71add76017
SHA512 33a9dc431e266da1832071250a31170649962cebb77a62a397b2e44fd2838f69d0498b95c171d760865bc161c649cf9363c596f32f7570cf54e0cdc10865e5c0

\??\pipe\LOCAL\crashpad_1956_HZPNWIXNINJDUIQZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 731a968bdd7f24f2ec5cdc0c02506e34
SHA1 f885767610335c00b856259967b9233cfeaeff61
SHA256 07c18bb39ff36df5711d8dce391f8b32b8a0410c3962a0185c1411703a0219d2
SHA512 850d4f7827510776f3d576d69edf86157ba52c00ab5f74940715dc548226e1e9c9f49fbdc96e516d95743650708a83b7326da283416eb90bf08cdfd308a4c0ad

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

MD5 b4a347e35e4ef55f9a9281b1f25f19fb
SHA1 4945cdd04fb768337018420f41ebcc11f36e7bfa
SHA256 7430899a16a5d8ea6f4adf03f90fb2fb5bc4a1d20252fcc87844f486bf7b1a3c
SHA512 c29f2e6dad51afb0bed06a74c5d3e5aa8da92b5918c9c4cce56069298e609609cdb410a2d0b1825e3d94722e4c6b1ad51f6397ba395c5accdc6c5313b431a9ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 53375d03300e831b9286fb0af5cde394
SHA1 1c564bea363342cff2e43c1688d0615b4171a6be
SHA256 f869f08ca1b621bf9b2ea8553987399f1edde3ac069dfe74d9b4e89434a291f5
SHA512 e0e88c25206cb37c31bc83e2d28ecbf8b354fc74aea581823e1e9597e7d44646347704a83bc02850ff1524343b1c9f5a3aff19211aa89553e3a8a03ded24b678

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe58248a.TMP

MD5 f77f3a340b1258b20a97a12741d0cd6c
SHA1 28d3a612681717fcd78b8c54e36df2b5d910848d
SHA256 25455eae28c50e35ef44da855030736f718696d7453fc23f5282a78d1c0fb53a
SHA512 e0727b4c9aa99de21db760ed12a0cc5a2cbb3b909e6806092059db170a8786f240b6b8727334b47637ff5d401508f56159927bfbd73d3d83f77fcea9a33a95f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

MD5 54b9c0e51458520a40ab6a0e5ab3e93d
SHA1 5f4b340780442b1127e2d897f170391d19bd8bf9
SHA256 e5e632909e287c1ee65aed7a59d81c1c5bc3aee8da203db259f83888b65408be
SHA512 134c9ea680d6052c9e63dac8ce8e71cfd09bd892c742baace29f19dd2aecdf8976b5eb8ed935ef5f2c033cb1b5c4ac7d7d026598347217cbf7acbd68c6546bc3

memory/2688-225-0x0000000000B10000-0x0000000000FB9000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JB5E1G4IX28V9DO22QRY.temp

MD5 74dfc467194bccae484552184fd060a3
SHA1 50b29292e785dd9cd433a3d65e4caa18d1dd0b77
SHA256 82de0f9c351315341610f40bb363496648c40b2073e05e424a2e0aebfe96e61f
SHA512 537f143f1ad59f1e135e3da58af16e642d846b21632de57ad499bcd17e7bb9dd22c6c4624f37735c6fb87f6c3ce1598155b17190b32188fbfb3741abaaca8191

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/3108-261-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 737e48088bdf6283ef87f4fe94ef96cf
SHA1 0be40c096e997acd1bdc2aa58cd0af79c8a302e2
SHA256 46680276a57873b77959f8bf46061eb050d6d771c6bbad3345885b0c1cb8093b
SHA512 68d311b88d3cab3c71f215a49491b05077c42d881819f1414bd0ce373ecc9ea220cf12e8e3455d67626e7962df5fff081839699700f0b0566063a1fa9df22df7

memory/2688-273-0x0000000000B10000-0x0000000000FB9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

MD5 f0a73c081f63ee4951dd774113888735
SHA1 26551173d876977fe5df9a4b8013fb4ece375beb
SHA256 43cbe179846bb828b4edd986cb052f375dac4a7a5f022eee60c919685517d6eb
SHA512 0b20f4c6492e99f18cca96251a9e84cd8fd876de90616c26454355cff42d1b3d960fe552c15cc9eef3696fa991926e77a939d43c82f9b3cbe65018e3bb401043

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe584e69.TMP

MD5 844aaf065c2a929826502fa0e8af8bf0
SHA1 8c24de7f8032a16c24ad581b6e0e1263dcd5f81c
SHA256 89fb2517d09da32e6da05a890ec07c7a05a8d8da26d6a3ea713247ea45705398
SHA512 33993e0d9637d80e909d5a59493ab18517890d35a3c5f62a3c9ec1b9f38ae02f41b5d3d9d5c23f92058c4e2d0d5beb56a122c3248b6d1369fe87e00bd9b3782b

memory/5768-288-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/5768-289-0x0000000000B10000-0x0000000000FB9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

memory/2688-342-0x0000000000B10000-0x0000000000FB9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\fed57a9d-54c5-47fe-b7c1-2d5672aefa82.tmp

MD5 8d17e8ef09e72c1c5e698d2ead2df80d
SHA1 38b947a3ac28c6d0f3d9c333a45c00c861134eee
SHA256 02f74b7dd49bef04f12c91527bfc1f0bc5f4f145381cf17cb9eff336941b6ca5
SHA512 4f09e67e68291a339969bba5755b4e07060b40b1309159b025394e7fb40b16992e74fa5761f9a02ce77bfb862f03def9aa3646f9cc474ed0898256f129acabe0

memory/2688-361-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-362-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-372-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-382-0x0000000000B10000-0x0000000000FB9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\4c8866bc-c52b-4d5b-8de8-98c517e37c89.tmp

MD5 7389218355ff04ec7f27dc54486d8ac6
SHA1 fe7cfce89768952b5ade3dcd7898dfd445ee6355
SHA256 07a6a7215aeec63c06212ac5b1dcf1ce563711a2ce0280e67ca6814536e01afd
SHA512 dc41e32d778e3d8eb8237c349e9315f4e2801da8f39479173f094abcdb95c87fa5d892380344bf3be651a2a45b7dd35b54b8f92d8f89cb100402f9bafc45effd

memory/2688-401-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/232-403-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-404-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-405-0x0000000000B10000-0x0000000000FB9000-memory.dmp

memory/2688-406-0x0000000000B10000-0x0000000000FB9000-memory.dmp