Malware Analysis Report

2024-10-23 21:52

Sample ID 240910-dbesyatbqm
Target 454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b
SHA256 454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b
Tags
amadey stealc c7817d rave discovery evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b

Threat Level: Known bad

The file 454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b was found to be: Known bad.

Malicious Activity Summary

amadey stealc c7817d rave discovery evasion persistence stealer trojan

Amadey

Stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Checks computer location settings

Checks BIOS information in registry

Identifies Wine through registry keys

Executes dropped EXE

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Drops file in Windows directory

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-10 02:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-10 02:49

Reported

2024-09-10 02:52

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1b10d3e5c2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\1b10d3e5c2.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4c73158bbc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\4c73158bbc.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000026000\554d6e43a8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\1b10d3e5c2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4244 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 4244 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 4244 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 1044 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\554d6e43a8.exe
PID 1044 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\554d6e43a8.exe
PID 1044 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\554d6e43a8.exe
PID 1044 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\1b10d3e5c2.exe
PID 1044 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\1b10d3e5c2.exe
PID 1044 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\1b10d3e5c2.exe
PID 1044 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe
PID 1044 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe
PID 1044 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe
PID 4976 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4976 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1832 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1832 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe

"C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Roaming\1000026000\554d6e43a8.exe

"C:\Users\Admin\AppData\Roaming\1000026000\554d6e43a8.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\1b10d3e5c2.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\1b10d3e5c2.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2052 -ip 2052

C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb75446f8,0x7fffb7544708,0x7fffb7544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7228 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7228 /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1804 -ip 1804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1336

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10127160771928203688,2639699229367677757,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=908 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 31.41.244.10:80 31.41.244.10 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 10.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 103.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com tcp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 84.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 206.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 142.250.102.84:443 accounts.google.com udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
NL 142.250.102.84:443 accounts.google.com udp

Files

memory/4244-0-0x0000000000FF0000-0x00000000014AF000-memory.dmp

memory/4244-1-0x0000000077594000-0x0000000077596000-memory.dmp

memory/4244-2-0x0000000000FF1000-0x000000000101F000-memory.dmp

memory/4244-3-0x0000000000FF0000-0x00000000014AF000-memory.dmp

memory/4244-5-0x0000000000FF0000-0x00000000014AF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 82ddd34be23d13d4fe950d51df9f1a9a
SHA1 5518b021fa41c05fd6031ff377331c718c458ae3
SHA256 454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b
SHA512 29d277a18ce99b8a80a1cfb9ea880c7d3c30a399fdd0c9af6249435231c26d85f5b7160154d2033539b68a601bc302463a9ce659504eda76c6371f97710608a1

memory/4244-17-0x0000000000FF0000-0x00000000014AF000-memory.dmp

memory/1044-18-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-20-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-19-0x0000000000511000-0x000000000053F000-memory.dmp

memory/1044-21-0x0000000000510000-0x00000000009CF000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\554d6e43a8.exe

MD5 f47cc7dc355ae01926f6065316c3bd68
SHA1 6b575930185f216e4fa5116fdcc8906eb9f53af9
SHA256 25741e3975370f8b2c77513a0941ca4263a83ec08e1203c9dd7cfd5c18474794
SHA512 cf076a077130b8dd48f3e27a6aaba411a6c8833ab8b926c99fc3fb66130694db1ce668103c44aba6196705a9722b68da16287ea8a63ffed250bcf92bba68154e

C:\Users\Admin\AppData\Local\Temp\1000036001\4c73158bbc.exe

MD5 38f98be80e6670f46efc8544d762cfd4
SHA1 fcad2e65d0977f0ab297049d5c9c32450b230d2a
SHA256 fb5cdb8d0f5558d5544c7722e616fbb498b501484f6ad0d1e2a2fe8118574996
SHA512 60a0c8f5516b41faa57ec4010eaed39a255ad2c96e58d7ae1273d3ef44196ea50b4f64c52e8301a95e45139ccd52bd9b52d177121ad1c77289bed89ac49c04cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 cbf2a2b40a844338b467a236b9946674
SHA1 eb7a3732ad29a8b14e4c554d5a9d922865cd2060
SHA256 42d5513184a02cd4684060dddcbefd14dd0844c41552549f38d3375ffead7262
SHA512 3e64cd1bcaa028f3be6f1603417a4d99a3fe68dbbd8b77980739b6850e80dda24f86f83590ed8d73b77e1699e89895709f722f473ef28751bf58131f7033ed2e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 6c103d2a306e7716c61fff31263ae29f
SHA1 4ce8ac36b69c967bcfdd89328cc46943e9bdc38d
SHA256 cbbcd533d73d244e47cdc87b99d2af9a440a2534182271cf5452acffde7abf5f
SHA512 cbc35f5ada14d4ec3e1ccd16327d10f929c25210b882cf075892a6ca0edf4f2924c49fa8bbaaa4fadc4cd9dc93456c8c31b6852a515d002c767dbb050d4f78b8

\??\pipe\LOCAL\crashpad_4760_EILGAKIVGXMEFKLB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 9a5555745b4933e998eb75e221af320c
SHA1 04f88c55df765256d4d24cb73f529db0d9f0d6f5
SHA256 dbae89eab6ce7b8d137f5a12b44e81f6553c220173a54b1671d8c0b627dcf3a2
SHA512 b85fce579863c5c3d074e4172c2498d7dab607798d45853400e4e97f47717bdcdafa65e202cb9ddc7085b7d5e576bab0762cf66be2b61664f19d22c3c3a1298f

memory/2052-114-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0e1e2d4a-0165-43e1-8ad0-9d097fd1ae4b.tmp

MD5 612f3747d2de06ebef68b441b939a57a
SHA1 6ded54fe6d67a344e777d8281a67b0884ffa2a56
SHA256 269c50787603416afb52422282199bd83d896bb031fc888d70018daaff273567
SHA512 eb9d74f241d8cd9eed9a9dfe91c57fde3500338bb23392eb3925013522763368737f1de87dcb90ab37c7b0e98356cc8c0a8d20b0155881cf1cd280f4eca94227

memory/5572-173-0x0000000000510000-0x00000000009CF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

MD5 fea5d458ea0cb7971e87ee93fee4de23
SHA1 148177573182443216676f8cef3b24aa9bde912c
SHA256 4641277119bd85614923de1fa6de12f10325854bc60531658e2331051884c490
SHA512 8bd379479e23de3c52e7a8c2d57303bdf301f25496ffd088f2cbfffdc528864c3e5ffd0bc50220feff09aadca6b0711d25417f65a6bfe5c47fa2de2084326e7b

memory/5572-203-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-232-0x0000000000510000-0x00000000009CF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8G6W3TU34C4KBQZ7UEAP.temp

MD5 ce19d242460be7c111bd3d3f6328f565
SHA1 1516b11a654a51aa1b12b12200f517e58c1ab27f
SHA256 5bc66edfed69ddb0c095ebffd295bdca908d83cbc5dd70d270845fb13dccd1f6
SHA512 a87dfa0478396c32242b5b97bdac14b0201cf95e32013af99d19d49d0e4ef0e4f00f62e7cf1a25a91256748b8dac2b9513cee390933844f1c2e28d7122e79521

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/1044-269-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-268-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1804-270-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 282c892af7e876c74dcd8ca71b50dc2e
SHA1 b48e7a418ddaeb7eca4dacd53233e978a692dffe
SHA256 75d2468ee788d301e103bc3516318443e30818991775b7a50c03d24065e55b3f
SHA512 ed495b3e76d589762b2c5bc033320bd94c6537fccdaaf2a16ff17cc5417a6b54478a91f9b4ca9cf8390ee5c4a021345132af1cfc526abaa17296c1ad6cc90424

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

MD5 fddafa4953316d3acc55f480c2846703
SHA1 62ce5a9d16bfe0a4b99e51177948bc6a12c8b24a
SHA256 47d0c42ef63a6b35819f97af2b1ba496724c6e5f57df24a9e823f8db3932a554
SHA512 c19c0f11c4f09cdc215e6e5b8bf4d6aec2daefeda1016496c6527be060283a27077e3141d27b75e9cf74a09ed45b9131c18914828d43d1ca63eaa289b1cb9b16

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57d1a8.TMP

MD5 8c220cc06646c06ba159ec0b6ed2e196
SHA1 8f0e30c62d52a875af1626ee4f940ab350b86a7a
SHA256 1f5e5d8243ffd4c014ba099e5c482313db21162e2942508b9ca2368534a69b50
SHA512 3f9d9ae6323b9d711316c39aab1939ba98f6063592db064423e49b8bec3b02163eb9a6707c8764367b55d94f70e20063ee4544a82f6c5f408e6f36153b3a57e6

memory/1044-295-0x0000000000510000-0x00000000009CF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\546c36ed-6186-4222-be7d-5b24a42353ce.tmp

MD5 e4ddd2606894e792e7ddcec663c3647c
SHA1 66a3b8ff9533b83464ce4bad25c26e793ee5079e
SHA256 0f05e3dd9758c28a50581cf23cafe29debd6f5ae5d98e503c2e4d69e6795c815
SHA512 d02202d340fb82be743a1be18e1a2f6802b6059db77298a38d56c4fc210162a34c4bec540befc19448da509977a64d5c6ebab790e64a86865591b6094342ba6a

memory/1044-357-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-367-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-368-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-378-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/3472-389-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/3472-390-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-391-0x0000000000510000-0x00000000009CF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\5fe06d1c-c31a-4b69-97ba-3a117d4ffdb3.tmp

MD5 15b5ccca4e9cb068bc25743ca89dcda4
SHA1 61507cf60268d6a582df1841e032c6a7ecb3b9a0
SHA256 1311b04026d2a78d830ed00b11b46405e4c10a8571e66a9ee271eb1c0142c772
SHA512 409ae5603f7879248838961ae12cdf06b312cdd89decfe77dc743ba60e0a3df0a9b5fa4a76f1aa41fb9cb061a0f7d3d2b50bf1cf98398856401865f830a53604

memory/1044-410-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-411-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-412-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-413-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-414-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1028-418-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-419-0x0000000000510000-0x00000000009CF000-memory.dmp

memory/1044-422-0x0000000000510000-0x00000000009CF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-10 02:49

Reported

2024-09-10 02:52

Platform

win11-20240802-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\Run\6fb0303920.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\6fb0303920.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\Run\554d6e43a8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000036001\\554d6e43a8.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\6fb0303920.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000026000\ba0a7cc5f2.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3280 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 3280 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 3280 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 4004 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\ba0a7cc5f2.exe
PID 4004 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\ba0a7cc5f2.exe
PID 4004 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\ba0a7cc5f2.exe
PID 4004 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\6fb0303920.exe
PID 4004 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\6fb0303920.exe
PID 4004 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\6fb0303920.exe
PID 4004 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe
PID 4004 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe
PID 4004 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe
PID 2264 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2264 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 2088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 2088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 3436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 5028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 5028 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1620 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe

"C:\Users\Admin\AppData\Local\Temp\454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Roaming\1000026000\ba0a7cc5f2.exe

"C:\Users\Admin\AppData\Roaming\1000026000\ba0a7cc5f2.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\6fb0303920.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\6fb0303920.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1680 -ip 1680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1344

C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe

"C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcecc23cb8,0x7ffcecc23cc8,0x7ffcecc23cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1852 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4796 -ip 4796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7532 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,8906638343811455947,14756657382007409542,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2704 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

Network

Country Destination Domain Proto
RU 31.41.244.10:80 31.41.244.10 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 10.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
NL 142.250.102.84:443 accounts.google.com tcp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 84.102.250.142.in-addr.arpa udp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com udp
GB 142.250.178.4:443 www.google.com tcp
RU 185.215.113.103:80 185.215.113.103 tcp
N/A 224.0.0.251:5353 udp
NL 142.250.102.84:443 accounts.google.com udp

Files

memory/3280-0-0x0000000000710000-0x0000000000BCF000-memory.dmp

memory/3280-1-0x0000000077B46000-0x0000000077B48000-memory.dmp

memory/3280-2-0x0000000000711000-0x000000000073F000-memory.dmp

memory/3280-3-0x0000000000710000-0x0000000000BCF000-memory.dmp

memory/3280-4-0x0000000000710000-0x0000000000BCF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 82ddd34be23d13d4fe950d51df9f1a9a
SHA1 5518b021fa41c05fd6031ff377331c718c458ae3
SHA256 454d2b2bfbe877dc3aa9f026b81a46cf9c4a9166ce8c1ecf562e93b765faf74b
SHA512 29d277a18ce99b8a80a1cfb9ea880c7d3c30a399fdd0c9af6249435231c26d85f5b7160154d2033539b68a601bc302463a9ce659504eda76c6371f97710608a1

memory/4004-16-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/3280-18-0x0000000000710000-0x0000000000BCF000-memory.dmp

memory/4004-19-0x00000000009D1000-0x00000000009FF000-memory.dmp

memory/4004-20-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-21-0x00000000009D0000-0x0000000000E8F000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\ba0a7cc5f2.exe

MD5 f47cc7dc355ae01926f6065316c3bd68
SHA1 6b575930185f216e4fa5116fdcc8906eb9f53af9
SHA256 25741e3975370f8b2c77513a0941ca4263a83ec08e1203c9dd7cfd5c18474794
SHA512 cf076a077130b8dd48f3e27a6aaba411a6c8833ab8b926c99fc3fb66130694db1ce668103c44aba6196705a9722b68da16287ea8a63ffed250bcf92bba68154e

memory/1680-54-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000036001\554d6e43a8.exe

MD5 38f98be80e6670f46efc8544d762cfd4
SHA1 fcad2e65d0977f0ab297049d5c9c32450b230d2a
SHA256 fb5cdb8d0f5558d5544c7722e616fbb498b501484f6ad0d1e2a2fe8118574996
SHA512 60a0c8f5516b41faa57ec4010eaed39a255ad2c96e58d7ae1273d3ef44196ea50b4f64c52e8301a95e45139ccd52bd9b52d177121ad1c77289bed89ac49c04cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 c8ebae0d158927a65c3ab4c33ccd076b
SHA1 6f3869bfdca95a2624e534672c4e57592b3fb722
SHA256 9ca71767d09a84caf3257b5db738dcc5553b78c9f905ab8af80ae84b0c630348
SHA512 ef8e3f13e310278384245e88b5193229fa01ffdb083f5ed1a3e0d5dcbf9a407f3ff0c7c2d2b4b84fe587f027ab05ed72ed41c520a823c6f24aab33d20096f6ea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 3d10393f6d93b445fb1c9ae14169d583
SHA1 69afc0640a0fa8175c3a866147dba8d5cbd3d462
SHA256 c020a8faf5b3bbe89876b14360076825d44c24aff732b13617890df5c005f29c
SHA512 2de011bc39e0b809ad464d973898d9d70e5afc93fd0348f1c1ea607ca41caf9d3333923a1ff5748bec827d7752f08cc79ca6d240cf91477d59183424b3e95fbf

\??\pipe\LOCAL\crashpad_1620_FUCDSVZQHIJXVJEP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 f4c9c7c2aec64b1262c119ad671b9b06
SHA1 5a0350c4acd51dd8e57eb71ceafe7e00de3f2b34
SHA256 0e7b06527302fdd099e9094cae5a32debf6434fc994cd837e4c72edaab30a1a3
SHA512 f06c5200ca3f570b424b14c1209aef1891030d189c0484246e94dff564696e3701612e0a0af96d0a2950fcde6689bdb04fa86b2ad00647bc40427f736d81f9de

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

MD5 42da7ab8686c7bda7ce2d3676c3b4c9b
SHA1 7531220b5b7ea01fe0e3829edf71b0823af472a5
SHA256 36435312186bb1b770e489f4cebcb29cadded4456423ba3aa10bf4624e1d08da
SHA512 236b0ba44b8d01ecc02dd3bd727e0d9e2235f3d665e6e641ca06e8112140ac634787f675e8ea719b9ce32331658233687a333517f9f7d6c6094952c083827182

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 f3f0eb22797e0758ffe5da5a232a02c7
SHA1 b1af664628c64e7379c364685090b893c23a2bd0
SHA256 9ecfde16814e390937daa53d9fcdd2163b28d1ae8640e6370adaaf3c791c205a
SHA512 8b948db17603bd7a13e190db3003494755dba7cbd4bf1c3063fac875759da29d4594f6cd05611cce070aff5e06a85d79a1f990f3f49dc97f0560be402a8f5add

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe5789c1.TMP

MD5 baa9b7adb109f0b77339d4746e20330e
SHA1 fecabb50e8e2f409735d043dd2e0087706c2cd70
SHA256 0b0b83275cb2bebf680b47184028bb26524e3f79b8e739fdef95e9015cb42982
SHA512 662da597f75894ac9fccdb7d8ee440e5dcb3aa1ac241d81c82a8e7a352dfc4c5e554d2a23c2a1b96d28dea69aa6035b87486cf072f4d067b5423566af1677e42

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

MD5 d08202250d2b968beca22bb48efd21d5
SHA1 4924fa50115ad289ddd13e177072f9b288a34ea9
SHA256 feaf670ddfcee1e88700d368d95f6323f978625cbf83c95c6e8bac9be39a3a94
SHA512 8ef4d3a8d7c101aa2548bc2ef67a67bdd59026fd39d4a45f667916a58f20970183c8ec22389e05be81a38c414a30376ecab4629ecd15a8b12ed3fe14e2ab1f88

memory/4004-213-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/1268-215-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/1268-216-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-217-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4796-218-0x0000000000400000-0x000000000247A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 9694f985afa18b0f8be68f57a7d1e9a1
SHA1 9cbd8d67c8b530027d19c4d2afe4db713ebcfa9f
SHA256 abfa6c5628a42ab35abcfbf31832d6f1b88c641b687a0bb0c20080ba66122aa8
SHA512 d688955f5d2f82efb6b12cd80a1a3441c36f3cbbe3e2ddffaa99c178cce1165ac3074ba767cd05966f857d65f4e792f60343b337a7dba6957df64f875f8b323a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

MD5 300c823cb1bac25ab383e8a65c6eca81
SHA1 b862ad6bb92dc1efdfb34ad690598bf909a84208
SHA256 ce6d93f929e1a0b72f5e43726b63a027ea166055d5d3814b59fb627878bfcfd2
SHA512 ceea4d42894d9bb38c7cf4bed52632002d38229c8e6725276cb851f2ae2b57ad3de0b5f80b2dbe12f0e2586d09d322faebb9e0cd42e7f4ba4f0d3f90594684d7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57b0b2.TMP

MD5 591e0b5ff5de3ecfd54e521cd9c2c966
SHA1 df9dafc81a67ed47ba9a2f134e5f896d2db82776
SHA256 6f156357693b619593f805c4519187570b405525e38dada8b8230f8ea6f1d4dd
SHA512 214117a39bcc1b909b6a72abe84b873f2deeb2e8062a3fc47519ce857978a6aacf2cd91f711b7f1b4e0135156ba04732a66f2cab055f559ff8232ea8c00fe418

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/4004-285-0x00000000009D0000-0x0000000000E8F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State

MD5 6645b40349c96d919fb230bfe2e9f1c2
SHA1 2244728d79eb63e6fcc079195c5df34553869c4d
SHA256 fa2d9a255d45475f13a91f97ee37983136edf79c98f2fce1c1514f0d6220aa9d
SHA512 a1bd7175e1b782fb9c6edd1268b6e07868a61d3e32b5979708131cf9c3372a5199b19213ff0b8ea3dc55a38f825f710e1ab75591ee1ede985030fe3f8b1d4f1a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RFe57de89.TMP

MD5 45e288b31940727806840d8ab9253be8
SHA1 4dee7fe5f3b6fe8478766dafc246bd3832eb016b
SHA256 0d9e0dc20aeda830a5a9deef610c87d94301de560f69923a448956c2a3affd23
SHA512 38606da94273b9c49a71bf397615e84d2b823761d16e7a7576ee54f7ef7089fc57bd099aa622d3e3903d220c763bacf50f5865a754fc57ad6b022a8254b9b178

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

MD5 ad4afac00d0ff7794b3c34dc1c00e5b3
SHA1 af62248a00add685d43a45f59653e77698da1e30
SHA256 b7aaaae6bf536fdbb0b740b029e636d3194e3092a737e3341fdff612a4d766dc
SHA512 ce1a0bfd79efb47157a9ae9bd6ad49d537f2aac6eb29bd8fafb113e91ec51d68073c404c5e8079c649ca27a83c5ae419816d420e1c6a5366cd29553d9a4f3a78

memory/4004-345-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-355-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-356-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-366-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-379-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/1556-380-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/1556-382-0x00000000009D0000-0x0000000000E8F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 d0ad7b3ffca50cb98b40268908e77b96
SHA1 37e7863196c0f7c299ca829e1ff302784f5670c5
SHA256 99f5f06036933415c479a4fc62d166e3475625026452bd09bcb9d0e0379fa6b3
SHA512 7d1862771589eaebaf110854865522be796162ef91d9f52b4654531c242b2fe0c072fd7308868096b10ee7f1ca42e5503be86a06c7361ccd04f08d70769d3daf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

MD5 29613bc380c916a7426e05c5da48d84a
SHA1 85989b31585507a1886b901f0b11111f2e297fe8
SHA256 20e2e4dded7891642c908f40f0a0bb8095f2bc1087f4a9edb168443203196190
SHA512 c555050816e0ca23b7493117b1bd5b4e34acce510b79d4952d632bb6f6e01be0ec0e90e7c4acf9ad6ef338a230789011ec5a4724f65ad6a85fcf507731ca6461

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

MD5 83807bbb66f86e631f03a7cbf8ba4018
SHA1 6883125cd1b79c9df2adffab51dd4509e77e623f
SHA256 4b627660a3469e840a9ad53c07bc210a432c0db87ef485c9fb943f3339703fa1
SHA512 955010d30e77f96a97c3517541fa50bb4aa82bbedfc9fadf42415debd988c47120bb07d6149aa7dcce26457013c06ec016f34d4795b1267f272e2e4f9a7aed93

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58a15c.TMP

MD5 279701e8371b9a8c6b66f799f81a82f0
SHA1 2c81da22a097c3a3d22bb8ba94eed000000a7a8f
SHA256 d7ecba722668907d316ed2a58b59b273aba33e8c0a092e7cb93c0c16cd68e106
SHA512 aaf268c294382c1f4ac9a4cafe8f5fcdf4a53a7c57e3ee69a25c0064bcf93ce037ebf48c6b5e2b9fff4dcb04047805658f0fb5f9f6f2138c9c31cfa861b0910f

memory/4004-419-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-420-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-421-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-422-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-423-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/1048-429-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/4004-428-0x00000000009D0000-0x0000000000E8F000-memory.dmp

memory/1048-430-0x00000000009D0000-0x0000000000E8F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

MD5 5441b0eed93ba378f301fbf85e984e84
SHA1 9d5dbbe692b9256e4d7e8b7622912b4c56caaafd
SHA256 46c1fd3de75f0ed97d0cd7b2dac968fcedfb3fc0889bd796f514335c3e704998
SHA512 70a13f36485fb86d0b1a593219a377887f684c4cef4e49005d82dcb0c1091b5cb7efb47a743e015ae702421475f16b7bf5d1eec5bc58c543799b3097fee1da7b

memory/4004-440-0x00000000009D0000-0x0000000000E8F000-memory.dmp