Malware Analysis Report

2024-10-19 09:08

Sample ID 240912-fj6bzascpf
Target eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2
SHA256 eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2
Tags
amadey stealc c7817d rave discovery evasion persistence stealer trojan credential_access spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2

Threat Level: Known bad

The file eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2 was found to be: Known bad.

Malicious Activity Summary

amadey stealc c7817d rave discovery evasion persistence stealer trojan credential_access spyware

Stealc

Amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Reads user/profile data of web browsers

Checks computer location settings

Reads data files stored by FTP clients

Checks BIOS information in registry

Loads dropped DLL

Identifies Wine through registry keys

Unsecured Credentials: Credentials In Files

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Adds Run key to start application

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-12 04:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-12 04:55

Reported

2024-09-12 04:57

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4f995f50e0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000040001\\4f995f50e0.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8263262aca.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\8263262aca.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4544 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 4544 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 4544 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 2340 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe
PID 2340 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe
PID 2340 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe
PID 2340 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe
PID 2340 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe
PID 2340 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe
PID 2340 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe
PID 2340 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe
PID 2340 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe
PID 4424 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4424 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 4716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 1720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 1720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 3280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 3280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 3280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 3280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 3280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1044 wrote to memory of 3280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe

"C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe

"C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\8263262aca.exe"

C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe

"C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89f2e46f8,0x7ff89f2e4708,0x7ff89f2e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1722732680439376826,14670070723721461814,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
RU 31.41.244.10:80 31.41.244.10 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 10.244.41.31.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 103.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com tcp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 84.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.212.206:443 play.google.com udp
GB 142.250.178.4:443 www.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 206.212.58.216.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
NL 142.250.102.84:443 accounts.google.com udp

Files

memory/4544-0-0x0000000000180000-0x0000000000630000-memory.dmp

memory/4544-1-0x0000000077A44000-0x0000000077A46000-memory.dmp

memory/4544-2-0x0000000000181000-0x00000000001AF000-memory.dmp

memory/4544-3-0x0000000000180000-0x0000000000630000-memory.dmp

memory/4544-4-0x0000000000180000-0x0000000000630000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 1ee73753a0b72f8626580ad785e1838c
SHA1 472801cbedda05c4ebfd13c44941ebabde085100
SHA256 eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2
SHA512 1efdc2c3de948d3203916a68c1eec289f1332c05b1345f84a61df48f074b4bdd7fad1811ec3944bf63e43ba8cffc0ea9ff334ff90421b24c2623ab4f0ff12023

memory/2340-18-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/4544-17-0x0000000000180000-0x0000000000630000-memory.dmp

memory/2340-19-0x0000000000D71000-0x0000000000D9F000-memory.dmp

memory/2340-20-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-21-0x0000000000D70000-0x0000000001220000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\20292134b8.exe

MD5 b3a239beeb5dedb7629a68e9ed216d4c
SHA1 f8092284123f59a72267611ef31fb60759eafbdb
SHA256 f539c6ebab703708ab993bacab000fd97274d49364bf0d58a2df6857d7d5d1d7
SHA512 05fcdb1089cf89b6cce19f6535a4e42adf8b2feefb6a273ab082180a3c43cbb55e0ab60a23bc00717e423228144a8825497b62dfecb469d142558148f6455459

memory/4608-36-0x00000000003A0000-0x0000000000A12000-memory.dmp

memory/4608-46-0x00000000003A1000-0x00000000003B5000-memory.dmp

memory/4608-47-0x00000000003A0000-0x0000000000A12000-memory.dmp

memory/2340-54-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2136-56-0x0000000000E30000-0x00000000014A2000-memory.dmp

memory/4608-58-0x00000000003A0000-0x0000000000A12000-memory.dmp

memory/2340-59-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-60-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-61-0x0000000000D70000-0x0000000001220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000040001\4f995f50e0.exe

MD5 e2ab2436433949f8959e5e5ff74e4e8a
SHA1 cee3a8c173207a0ee04dc07e66378c80528f93dd
SHA256 ba0c008b44599da07ba9545833d4184d9b17b980fd38963fcd25e1d6d312f99b
SHA512 2d69fae0fc6af7cef780b89999f4a952609d95e630167e5d39ad6d393a04cf031cae28e39a6d987e44ed6d3abcecb066cd5fd899b0a6e49c15887fb366eeb39e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 57d58123b22ac30b5f2383e803be95ac
SHA1 a486859d24137bb2b67ddd2c4b142ba62344c1b4
SHA256 d04b802858f801509da23ab43dd1b752c66676c17b44b93dc1370d64223c60a1
SHA512 6e5b36864dd6d9874234ae045d9eb124b04839a6d1213797f1cf057063d9865d789dd693c578a4a9803ae908ea43b6ff3840a198d8d79474796cc62787f5364b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 17272052ac9c4311979b9cce8556fad9
SHA1 187893fe72d37c34c3c1166a73deea7578139ede
SHA256 02f775784aa08811b56071ed31678b941ae4ccf0a0b8fcd41fd5d7459ab1f6cf
SHA512 6af4b7ea3e283505e38d72c1ac3632a03933a4b2129c30a6a1e8e0a7abedf265552dda9f48a82e49bcf95f2303c451f06de62cf94f645ee2335c335b870d1e7f

\??\pipe\LOCAL\crashpad_1044_WRXULLFIYCUOFMYD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 de2aa2b022db2c48285ab0a7ff0ec0d1
SHA1 9f23d70455c7eb8dda50d594a2730a9327b76343
SHA256 27269271497c40547e047cc8166295e89e8224752a61b521724343f4a55ce642
SHA512 dab90b5314773d7946bbe2669a0c131e8f969f205b58a286e5678ffec60da57a518ee010ee057fef3c9d4e1589ea7c3eeb3b81831e2192e89505524a97118c76

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ef0b488c-96bd-4218-8b3c-cd7144d65694.tmp

MD5 61c1431dec17db2475b8f97dea088c29
SHA1 b9f57876e226a14ae4e991ba22051d7e4da22943
SHA256 cc22decad7e3d5e26fe7fd1f31f3b3c410c04df9bb827ef252c70972fdea511d
SHA512 3e08c0281f92a66ba258ae6ea4d1011cf7acb11fde2af7c343a17d141b5957b0d40c4dd98c25706e4d29d524bcb442c3cd45e20ad0246acc4a781e370ad320a6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

MD5 caadc0430ea14254be9b2a51f87a96e2
SHA1 a777bcc1936204f2318f54d4f716148129e9729b
SHA256 e4be0cf31badee0c9432738355502e68cd01c1017f7b784b1860e2dc3924e0df
SHA512 41275f46703df042be1a5601d49e86387bb62f86b57a0c530c0caab011b8851ace1ba0201cf36df87d6e1b51353683172981cf6d02258de9c50be08df388417e

memory/2340-231-0x0000000000D70000-0x0000000001220000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PRG2H2KEQGPDIYAAOY06.temp

MD5 10b7e277ff4b4e9d0c2036f6dfa0552c
SHA1 8d3cb2be01ef6d541503de09e6bd1a2178c2bffb
SHA256 5d0645631cceb313923f2acd1658e0fe0088d6f70ce194ad094c4f81b984e04e
SHA512 75bfb9c13b74f1a593821146b9d408c2bafc09220e5dda9448630dd7b416276392b3df39ae3adb0b5a7f49d15af65b80cc8e0cfaa9465eb285242693db390af4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/2136-267-0x0000000000E30000-0x00000000014A2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 b7fc29d4c528d460a3eae5e992b3cb04
SHA1 c3a6bf56d5893876b0936393e19ea77b96842b3a
SHA256 82072374e7e9df12f7cd1c7bff35a1ce1129531b0970d2affe7f7e2759e9c038
SHA512 fbad9ae8cf31d1961b87fb5bfde4b173c7d493ba4735c9f10a01911068bba965c485697333b55c904c602827eaee37237bf02157105a23519a100dfa8d282040

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

MD5 09d3962962625e92dd14a2b6415eddd3
SHA1 da20b1f13fb15c38ab2afa5bdda733f25bc39b07
SHA256 919421fb060b65952cc0e4a32447f61ec32af8eddf7fbe360a79007c5047b7f4
SHA512 28e84386b7072081600d3f19b589fc912b1f1aca12b064b314ee9ed595eae01628e8a179ce12bbeb588318b30709a2573ee7c80e9fc1f410d13e723cb0b58cd8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57d419.TMP

MD5 dee5857d7579968b4d2034e7cf5aac23
SHA1 dce0340c6bc03869160bab8f3e280366e89710ea
SHA256 9d5f9c04eadf3fad95bc3002483705f1f06c7d1a67f57f6ae55e7e945c1c3967
SHA512 cdbf56c3d75e3c1983051f8827e8f361e18e82babd0426865149d5a1596ba1a3e0a7444d64028c2df746496ff792522baa861ddd0f1ad0d3ad8ae7ca6297041e

memory/2340-292-0x0000000000D70000-0x0000000001220000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

memory/2340-345-0x0000000000D70000-0x0000000001220000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State

MD5 bdc9d785e7a67d0aa244a1c7e90eda6f
SHA1 3446ed750a7cf82114fe1b2c3d983ff23baa5f76
SHA256 7b607d1ef7720e24736325a9ed3c875f5f38bd2b7125168828403bb7bd9567f0
SHA512 9c2eb8dfe9bac02185a9e7e163e1336e3bc65ff91ae0049636cc59985e07cae377646cfd1778cd1eeaf389014b65e0fffac80de0c6e7f482a9484e57c45b5d19

memory/2340-364-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/4492-366-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/4492-367-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-368-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-378-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-388-0x0000000000D70000-0x0000000001220000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 85edca8321ae1dc17406c12d9a355672
SHA1 bcbeb7ad948bdd517fb85e0e6f3598d6b734357f
SHA256 599e58129a76780c813c075514a5b182b23ed74954cb02dfd29aff45bf96dc3a
SHA512 0afd708c126f04037625a2149f932abfa7ea0fe3fcd246be10e9c1075e2e9d9aa8760f65e3aca1223f108464ea9b7fadd8a782b6caf0d4988b8430c6a04882d4

memory/2340-407-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-408-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-409-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/5180-411-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/5180-412-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-413-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-414-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-417-0x0000000000D70000-0x0000000001220000-memory.dmp

memory/2340-420-0x0000000000D70000-0x0000000001220000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-12 04:55

Reported

2024-09-12 04:57

Platform

win11-20240802-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe"

Signatures

Amadey

trojan amadey

Stealc

stealer stealc

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Wine C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Windows\CurrentVersion\Run\8263262aca.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000040001\\8263262aca.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Windows\CurrentVersion\Run\6ff4d8a01b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\6ff4d8a01b.exe" C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A

Checks installed software on the system

discovery

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\svoutse.job C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1976 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 1976 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 1976 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
PID 3848 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe
PID 3848 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe
PID 3848 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe
PID 3848 wrote to memory of 248 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe
PID 3848 wrote to memory of 248 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe
PID 3848 wrote to memory of 248 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe
PID 3848 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe
PID 3848 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe
PID 3848 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe
PID 1936 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1936 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 4124 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 4124 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 1004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 1004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1332 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe

"C:\Users\Admin\AppData\Local\Temp\eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2.exe"

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

"C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"

C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe

"C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe"

C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe

"C:\Users\Admin\AppData\Local\Temp\1000030001\6ff4d8a01b.exe"

C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe

"C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb50193cb8,0x7ffb50193cc8,0x7ffb50193cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7272 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7572 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,15600399932949602857,18409265568004148592,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4552 /prefetch:2

Network

Country Destination Domain Proto
RU 31.41.244.10:80 31.41.244.10 tcp
US 8.8.8.8:53 10.244.41.31.in-addr.arpa udp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
RU 185.215.113.103:80 185.215.113.103 tcp
NL 142.250.102.84:443 accounts.google.com tcp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com udp
GB 142.250.178.4:443 www.google.com tcp
N/A 224.0.0.251:5353 udp
RU 185.215.113.103:80 185.215.113.103 tcp
NL 142.250.102.84:443 accounts.google.com udp

Files

memory/1976-0-0x0000000000660000-0x0000000000B10000-memory.dmp

memory/1976-1-0x0000000077966000-0x0000000077968000-memory.dmp

memory/1976-2-0x0000000000661000-0x000000000068F000-memory.dmp

memory/1976-3-0x0000000000660000-0x0000000000B10000-memory.dmp

memory/1976-5-0x0000000000660000-0x0000000000B10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

MD5 1ee73753a0b72f8626580ad785e1838c
SHA1 472801cbedda05c4ebfd13c44941ebabde085100
SHA256 eca7816a34fc9b047403ee624e1b3c7ef168afcd3de33399b8f22556c5d490a2
SHA512 1efdc2c3de948d3203916a68c1eec289f1332c05b1345f84a61df48f074b4bdd7fad1811ec3944bf63e43ba8cffc0ea9ff334ff90421b24c2623ab4f0ff12023

memory/1976-18-0x0000000000660000-0x0000000000B10000-memory.dmp

memory/3848-16-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-19-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-20-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-21-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-22-0x00000000004E0000-0x0000000000990000-memory.dmp

C:\Users\Admin\AppData\Roaming\1000026000\064375b234.exe

MD5 b3a239beeb5dedb7629a68e9ed216d4c
SHA1 f8092284123f59a72267611ef31fb60759eafbdb
SHA256 f539c6ebab703708ab993bacab000fd97274d49364bf0d58a2df6857d7d5d1d7
SHA512 05fcdb1089cf89b6cce19f6535a4e42adf8b2feefb6a273ab082180a3c43cbb55e0ab60a23bc00717e423228144a8825497b62dfecb469d142558148f6455459

memory/3444-38-0x0000000000680000-0x0000000000CF2000-memory.dmp

memory/3444-51-0x0000000000681000-0x0000000000695000-memory.dmp

memory/3444-54-0x0000000000680000-0x0000000000CF2000-memory.dmp

memory/248-56-0x0000000000850000-0x0000000000EC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000040001\8263262aca.exe

MD5 e2ab2436433949f8959e5e5ff74e4e8a
SHA1 cee3a8c173207a0ee04dc07e66378c80528f93dd
SHA256 ba0c008b44599da07ba9545833d4184d9b17b980fd38963fcd25e1d6d312f99b
SHA512 2d69fae0fc6af7cef780b89999f4a952609d95e630167e5d39ad6d393a04cf031cae28e39a6d987e44ed6d3abcecb066cd5fd899b0a6e49c15887fb366eeb39e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 b44d917907c60a9e56586bffdde3a705
SHA1 7522805bbf7c03c3458348a5558b3c55fa2538b4
SHA256 8b2112afc4477c14179a065bf2e60c099f47691b315a8c77dc1f269502541b2c
SHA512 21bf74bfb046655b09ab75ae1d46bb4c823c2fe15c05e1aa6adfa9af16aef5787926eccca6b2f2ab0c2b3aa212051e4e301551f35bbf8edad205f01853e4ccca

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 12352c0bf8923a856075654e800e919c
SHA1 58aa48ea507e3980078575c4b661a54251e857ea
SHA256 fcaf742435636963ddc5dad1380de6a03c11fa56f94bf1c9269db70b5a26673b
SHA512 274c374a3c208244e46a7f7b6b7d5acfea15ac8229f42a959b711ee666f40be36582320fe080fd00bd9360970ac3b787f1540c0ee1c493b4ba31f72a0188595d

\??\pipe\LOCAL\crashpad_1332_XSXCAQCDOUYDXYSX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3848-105-0x00000000004E0000-0x0000000000990000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

MD5 95883d76d2c5ad3bd6a44e018cab1112
SHA1 654052d8d94664de1f0ba31858c5f16528c4ebb1
SHA256 e27326b1de0951f47acac242a4e34ec9ea6d382af040994ef54169a641d60e6c
SHA512 ba6641921605f53ba937962677c3fc738919835171a200c5f34b11db3455826335e31775f7ed55f61b9fe14e2f6c820edef6a26c55ede2c0ada038f8bc228200

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index

MD5 0e1e16d186532c62e800ac401b5014e6
SHA1 24b53066880aab36dcb20d173426c1c5940ffc08
SHA256 180c015318105e1823aaeff1bdef91e4a897e3ea587ac3a53b7090bc3593979f
SHA512 9cbab1ca631a4f672589f08570f25559ccae3d9004cab7ed265d04d180b112e9b67fb6e10f86fe4b5bafef1078a75c59e03c76d5367fca39ef1acf6dee2a8de6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 2dde31d3340876a58ac507dc3a40151d
SHA1 d27806154e0be5ff23461353a48ecf3419bd6fef
SHA256 2f6f224e69636f94ce04b2dcb1293212813f7c33e3af03ce4dedf0266d2d59d4
SHA512 2a1dd3be1fb9a6de43a82421dae3f0cc8bf390b7e86a7c2bfcca44cb2e1a9e52b940168aef58e267a0baaf2f5c8c25ae7605b9796ff1a054a89039d932c78891

memory/3444-166-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57cb20.TMP

MD5 4652dffabcb69db4306ad4b99363921c
SHA1 f4c3a310a265c744b55ba05c15c76221886c6a40
SHA256 dbc608e074023d00c833c61f33eb365cf82658c8d3d81d5d9b1f8bfd8f93720b
SHA512 c1d911bdf21e6dc2bd7da5a6b0bbdb4530f7573def86642231ef6db38491b1f7af1b246deddfc3c6a6a3fc14d502a906e4392751e96f55cb92a059d6515a1dba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

MD5 c6e1e3976d596a0b69133fc7eb673fac
SHA1 ed9eebc350e8dad2c9e306ea3eb9ebb7718ecc51
SHA256 2a42b1c8d0e22ccd472311bbb9d9d2777c879a9d433b5daf30c86c1228330664
SHA512 ee66ff1fcded0ef7494d9615e0f00208f369dc2fb4eadd014ddd62bc3d75b623c3b99776e51ec55b107aca9ef22b23028bff943ee003a469718843a8be0acba9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

memory/3848-209-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-234-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-257-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3444-261-0x0000000000680000-0x0000000000CF2000-memory.dmp

memory/3444-262-0x0000000000680000-0x0000000000CF2000-memory.dmp

memory/3444-272-0x0000000000680000-0x0000000000CF2000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/248-310-0x0000000000850000-0x0000000000EC2000-memory.dmp

memory/248-309-0x0000000000850000-0x0000000000EC2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 3d64dd18a77bc05b7cafbda171ef7e16
SHA1 53cb9767039ad17556d65c9a1e9a48fd2a50c7f4
SHA256 86178ebd4b9f0410a6e86ba63a7eaecf7ff1f2e14703964b8befc810613fdd61
SHA512 7495c7e28a35f56bd505be5023279f839839aa25451bad3b80d1b10ca4766f36e76d090bd0d2109b7fb9d7d6068f008b6e35eab6d58fdb1c7a31e6db03e1ece2

memory/3444-342-0x0000000000680000-0x0000000000CF2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

MD5 6eeaa4af4bb31cd560a16378db6cbc2c
SHA1 c188b7e5d17d81ae256a3f4dfda5f49c82bee56a
SHA256 ffab28e8bc54eeba258b7875c23e79a49f40205d48323f5c91fd004b8ca6a0ff
SHA512 b2a01726d506699f450831cf237c8f489a83525ff49e4f7c5bd6baa26150500afd45d1d179763eb2bc000cbe14ac00b7e1ac460afd4c80dbe45def4ed71d155c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57f2cc.TMP

MD5 02b7662d542929ef6a41ea340b09f74e
SHA1 1cb35adf9e1bc04ff645f36b4ecb2bc05820123e
SHA256 ff71b5b89a2d35bac2859e9f1f4585531bcdaf46b23c097e7da112187d7461a0
SHA512 68e14262be2e92617a172ec544b9816c61e99fcc595cea0ee59bf554a3b189d6dafdc9be170e410a84ee196a96972ace5da1722102123100f0114cf48202c3a4

memory/3848-358-0x00000000004E0000-0x0000000000990000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

memory/248-391-0x0000000000850000-0x0000000000EC2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index

MD5 cacadc7e7bd23d153c9f5668a18772a1
SHA1 efda606e49734f0c264e66d089e869bcd5b4562d
SHA256 a2a694a06fec7475d0268ae6bc76be42cd19c67ca812b83440fc18c4d18d9328
SHA512 89fae2d99c8729a9fd5c1cc8081986da3780c307340f55dfb2ecd05c654fdca0d42b0d1b66dd23a77977e6f98953df61249c112ab3947b9738884ee7cd4d7aea

memory/3848-401-0x00000000004E0000-0x0000000000990000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\a0cb652c-a556-49f8-ac5e-2ea9da0ef957.tmp

MD5 c659160a642445e2c444685771622399
SHA1 dc51ae9943dcf5369ee3718f0d4d45b6a2e1d12c
SHA256 3b701bb826efaa1945429034d60904811a454391feb83089519daf9ed0383158
SHA512 3651222f3f75149157e92cab46f3d0aa05b4535ba60a3ffefb8c2d14856858691a2a3065ae6d5a66e14539b116557af634886f2b44507f371ca265b10ea40e31

memory/3848-420-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/1836-422-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/1836-423-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-424-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-434-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-446-0x00000000004E0000-0x0000000000990000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

MD5 38196c236c320de5304f822b56ffa12a
SHA1 52e3c43ccadfd7776edef5e80446bec97f1a43c5
SHA256 98b77997e8cbe80afc6cc94c22d6736f83ee303caae67f17b85ae98539f1f8f5
SHA512 e10e8097357a5a64c2c7e6fcf2e506024836be6768c702dc11d2bc468940637c6d5f4e66673e58fb756481848126337a416c5c1293d52462954df09b3e18fb5b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

MD5 d606382c71c01fdbdd82c50e3b2379a6
SHA1 bf6854c291a6a3c426ff700cf7df92ae8f1e0109
SHA256 87662743821bcf8060d2af153b59be907a019c6feae1b432bfa1deb44067ab90
SHA512 6641f7221f53a73824573d090486d1b7968f9ecec66343691452f0c17f9c4a043fc6e71fe1e6d8b487dee24d25a6be0a88db619897aa5b052b667fee8705f214

memory/3848-474-0x00000000004E0000-0x0000000000990000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity

MD5 2ea0c71301e5305832bb9f72fa81b998
SHA1 a1b2368d351ba44689e0e97f5b1a2630ba78fd4d
SHA256 3c9424f4fb700d440fa13b45f36366052993b54876172b0570b34acbf64bdcbf
SHA512 a87f4bade7f30c12a1fb68b883270a7b42493572cf43857ff4072797f9b2eb10f6bca9050b4231d1dbf2be48ff1fa2c8048bf5d1dc8bcde28b009773e57527e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58efaa.TMP

MD5 2af9014ec43ae463112e3cda7f1439e4
SHA1 b685d890a55de0c973e7d5f6d6ca573c1bf01d6f
SHA256 85eacdc882892b8128b9857cf867909b24990f7206dd327d2a271a9f5843cd0b
SHA512 3455a1c2952e1e8021ac01ce93cac816e3c77d9471c8611de743d82f713a7257d0b6ebd7a1366fb6f24565e6bac54f75f752771fadbbc6e8873f49a0c7f0e377

memory/3848-484-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-485-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/4624-488-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-489-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-490-0x00000000004E0000-0x0000000000990000-memory.dmp

memory/3848-493-0x00000000004E0000-0x0000000000990000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State

MD5 1911f7344ea5bcc0a1e73cb19b8b5da2
SHA1 951f062c277471166101e65f10ef8612c9d75e3e
SHA256 99d3ea1b6dbb5c2c99cc21622ce9c283e2b4c733fa81af4207cfb5beed0afe0c
SHA512 2000407871ebaa15893509f6763d03ae4e729a774d72245188e9b794ee281723cd95741046d2751fa09b7b668fca2d6e3dfad56400d3cf67355cb03973b9cc07

memory/3848-505-0x00000000004E0000-0x0000000000990000-memory.dmp