Malware Analysis Report

2024-12-07 19:32

Sample ID 241114-khqx4szmar
Target 4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa
SHA256 4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa
Tags
amadey cryptbot 9c9aa5 credential_access discovery evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa

Threat Level: Known bad

The file 4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa was found to be: Known bad.

Malicious Activity Summary

amadey cryptbot 9c9aa5 credential_access discovery evasion persistence spyware stealer trojan

Detects CryptBot payload

Amadey

CryptBot

Cryptbot family

Modifies Windows Defender Real-time Protection settings

Amadey family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Uses browser remote debugging

Reads user/profile data of web browsers

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Windows security modification

Loads dropped DLL

Identifies Wine through registry keys

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

System Location Discovery: System Language Discovery

Browser Information Discovery

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 08:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 08:36

Reported

2024-11-14 08:38

Platform

win7-20240903-en

Max time kernel

142s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

CryptBot

spyware stealer cryptbot

Cryptbot family

cryptbot

Detects CryptBot payload

spyware stealer
Description Indicator Process Target
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\c5dda29e29.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006161001\\c5dda29e29.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\e17e5b3279.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006162001\\e17e5b3279.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\dec3197b02.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006164001\\dec3197b02.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1924 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1924 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1924 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 1924 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2716 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe
PID 2716 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe
PID 2716 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe
PID 2716 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe
PID 2716 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe
PID 2716 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe
PID 2716 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe
PID 2716 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe
PID 2716 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe
PID 2716 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe
PID 2716 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe
PID 2716 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe
PID 2716 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe
PID 2716 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe
PID 2716 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe
PID 2716 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe
PID 2716 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe
PID 2716 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe
PID 2716 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe
PID 2716 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe
PID 2716 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2716 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2716 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2716 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 2716 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe
PID 2716 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe
PID 2716 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe
PID 2716 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe
PID 2968 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2968 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2968 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2968 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 2148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 2148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 2148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 2240 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 1828 wrote to memory of 2240 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 1828 wrote to memory of 2240 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1828 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe

"C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe

"C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe"

C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

"C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe"

C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe

"C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe"

C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe

"C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1220

C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe

"C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 1196

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe

"C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66f9758,0x7fef66f9768,0x7fef66f9778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1248,i,7813653813196851070,12128385256405096381,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1248,i,7813653813196851070,12128385256405096381,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1248,i,7813653813196851070,12128385256405096381,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2184 --field-trial-handle=1248,i,7813653813196851070,12128385256405096381,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2192 --field-trial-handle=1248,i,7813653813196851070,12128385256405096381,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1484 --field-trial-handle=1248,i,7813653813196851070,12128385256405096381,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1348 --field-trial-handle=1248,i,7813653813196851070,12128385256405096381,131072 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 940

C:\Windows\system32\taskeng.exe

taskeng.exe {0A6032E5-3ED0-46F4-8F14-53232BF9A023} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\service123.exe

C:\Users\Admin\AppData\Local\Temp\/service123.exe

Network

Country Destination Domain Proto
RU 185.215.113.43:80 185.215.113.43 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 home.fvteja5sb.top udp
RU 141.8.199.217:80 home.fvteja5sb.top tcp
US 8.8.8.8:53 frogmen-smell.sbs udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
RU 185.215.113.206:80 185.215.113.206 tcp
US 8.8.8.8:53 fvteja5sb.top udp
RU 141.8.199.217:80 fvteja5sb.top tcp
US 8.8.8.8:53 fvteja5sb.top udp
RU 141.8.199.217:80 fvteja5sb.top tcp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 fvteja5sb.top udp
RU 141.8.199.217:80 fvteja5sb.top tcp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:60024 udp
N/A 127.0.0.1:9222 tcp

Files

memory/1924-0-0x0000000000FE0000-0x00000000012F8000-memory.dmp

memory/1924-1-0x0000000077100000-0x0000000077102000-memory.dmp

memory/1924-2-0x0000000000FE1000-0x0000000001049000-memory.dmp

memory/1924-3-0x0000000000FE0000-0x00000000012F8000-memory.dmp

memory/1924-5-0x0000000000FE0000-0x00000000012F8000-memory.dmp

memory/1924-14-0x0000000000FE0000-0x00000000012F8000-memory.dmp

memory/2716-17-0x0000000000230000-0x0000000000548000-memory.dmp

memory/1924-16-0x0000000000FE1000-0x0000000001049000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

MD5 36186abad1b6621bfa6a2910dc005972
SHA1 3ab630f001cf69137f8391ddbbec30a6211a94b0
SHA256 4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa
SHA512 9d3695f5f2314725ac237b819823b1898152b6c0611a119d583cdcff9dc808fa9ae6819b7723046be7b910142f88735921641a93042b7872b5af45784693d0d5

memory/2716-18-0x0000000000231000-0x0000000000299000-memory.dmp

memory/2716-19-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-22-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-21-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-23-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-24-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-25-0x0000000000231000-0x0000000000299000-memory.dmp

memory/2716-26-0x0000000000230000-0x0000000000548000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1005956001\945129f759.exe

MD5 a7e41df2cb4730c2e9b4cc777e99df77
SHA1 20e33d9967a4b927692bc5b1809c1aad790542eb
SHA256 5713f57c3f457cb7bc70b6495bc94737c1d6a608dbfd4411bcc7437246eb66cf
SHA512 c38a2591fb36e56b06ee983e9df5e90f9354dce860dabd3561d6358476284bb4de74e29f84cd2db11ec026bd901abc4c923ee18b39f596de9db7798e6da42439

memory/2716-42-0x0000000006850000-0x000000000740E000-memory.dmp

memory/2716-45-0x0000000006850000-0x000000000740E000-memory.dmp

memory/2968-44-0x0000000001380000-0x0000000001F3E000-memory.dmp

memory/2716-46-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-47-0x0000000006850000-0x000000000740E000-memory.dmp

memory/2968-48-0x0000000001380000-0x0000000001F3E000-memory.dmp

memory/2968-49-0x0000000001380000-0x0000000001F3E000-memory.dmp

memory/2716-50-0x0000000006850000-0x000000000740E000-memory.dmp

memory/2716-51-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2968-52-0x0000000001380000-0x0000000001F3E000-memory.dmp

memory/2716-53-0x0000000000230000-0x0000000000548000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

MD5 8fb77810c61e160a657298815346996e
SHA1 4268420571bb1a858bc6a9744c0742d6fd738a83
SHA256 a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66
SHA512 b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe

MD5 5b015748645c5df44a771f9fc6e136c3
SHA1 bf34d4e66f4210904be094e256bd42af8cb69a13
SHA256 622c5cb9a11085da8240c94262f596b687b3ecc2bc805b7f5a01cc335f7df909
SHA512 026a32a969f973f91f6e848ce3509546ef70bddfdb39ed08c177c2cd1eddeb1297a2d722fa8542a9a09a3d0b9d4c8df0d35139b1c7ae0beba1b964a6b8003302

memory/2968-77-0x0000000001380000-0x0000000001F3E000-memory.dmp

memory/1020-85-0x0000000001150000-0x00000000015F7000-memory.dmp

memory/2716-83-0x0000000006850000-0x0000000006CF7000-memory.dmp

memory/2716-82-0x0000000006850000-0x0000000006CF7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006161001\c5dda29e29.exe

MD5 32759286f0d328a68c63fbb0b85dacb7
SHA1 08df21f5f91ffc76293473dc8acfd3fa364678d7
SHA256 21af6e9262502de17e772eafacaa6eedc2128c1a6c445801bbc0f06318143bf7
SHA512 3afae0cc276fae073b4a07d8c3d90e28fb1585bc9cbc3e29519f8fd6b7148acb494cbf4497254537e8351ffd480604b0a91ee4107bd09ea915084245663a1922

memory/1084-105-0x0000000000990000-0x0000000000C83000-memory.dmp

memory/2716-104-0x0000000006230000-0x0000000006523000-memory.dmp

memory/2716-103-0x0000000006230000-0x0000000006523000-memory.dmp

memory/1020-106-0x0000000001150000-0x00000000015F7000-memory.dmp

memory/2716-108-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-109-0x0000000006850000-0x0000000006CF7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006162001\e17e5b3279.exe

MD5 673adb8fbfc09e598b9f2cd49291d360
SHA1 64b647245c6206581fd1ada3df3f9dc7dca75e9f
SHA256 a3eaf680536f723aad903e7b9f0802699f113951925f3ffe25572345a79855d1
SHA512 bc140fbc9bc2f31fc6df6db5fc52099920335b0e583585c7759a5bf4b2dba2f2a90da84b392e0c06a1ee0c7d8475fa6c1559ba3168fe31ad1c2699debcca9a31

memory/2716-125-0x0000000006850000-0x0000000006ECF000-memory.dmp

memory/2716-126-0x0000000006850000-0x0000000006ECF000-memory.dmp

memory/2388-128-0x00000000008F0000-0x0000000000F6F000-memory.dmp

memory/1084-130-0x0000000000990000-0x0000000000C83000-memory.dmp

memory/2388-131-0x00000000008F0000-0x0000000000F6F000-memory.dmp

memory/2716-133-0x0000000006230000-0x0000000006523000-memory.dmp

memory/2968-132-0x0000000001380000-0x0000000001F3E000-memory.dmp

memory/2716-137-0x0000000005ED0000-0x00000000061E8000-memory.dmp

memory/2716-136-0x0000000006230000-0x0000000006523000-memory.dmp

memory/2968-138-0x0000000069CC0000-0x000000006A71B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006164001\dec3197b02.exe

MD5 cd92d8ecfa6e7c1ec2493affd71d2612
SHA1 328676a428c2a17fe6b8ccbe7df1945b4eeda169
SHA256 f4997a04a30174c18394454bd6e4f41631807041092ac17f25d2349422e7a2b7
SHA512 3588b3f2ba99b6d0939dfc10ac19f560d5332584874fe284393364bef96c1331965e5a85964fd07cbea500f3e222e4c23336ff30616fd61f2370c9052b521883

memory/2716-159-0x0000000006230000-0x00000000064DE000-memory.dmp

memory/2960-162-0x0000000000260000-0x000000000050E000-memory.dmp

memory/2716-161-0x0000000006850000-0x0000000006ECF000-memory.dmp

memory/2960-163-0x0000000000260000-0x000000000050E000-memory.dmp

memory/2960-164-0x0000000000260000-0x000000000050E000-memory.dmp

memory/2716-165-0x0000000006850000-0x0000000006ECF000-memory.dmp

memory/2716-166-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-167-0x0000000005ED0000-0x00000000061E8000-memory.dmp

memory/2968-168-0x0000000001380000-0x0000000001F3E000-memory.dmp

\??\pipe\crashpad_1828_MZDCZBUJCZRLCYWX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

memory/2716-209-0x0000000006230000-0x00000000064DE000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

memory/2960-218-0x0000000000260000-0x000000000050E000-memory.dmp

memory/2960-222-0x0000000000260000-0x000000000050E000-memory.dmp

memory/2716-223-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2968-224-0x0000000001380000-0x0000000001F3E000-memory.dmp

memory/2716-225-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2968-227-0x0000000001380000-0x0000000001F3E000-memory.dmp

memory/2716-228-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2968-243-0x0000000001380000-0x0000000001F3E000-memory.dmp

memory/2128-247-0x0000000001210000-0x0000000001222000-memory.dmp

memory/2716-248-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2920-249-0x0000000001210000-0x0000000001222000-memory.dmp

memory/2920-250-0x00000000733C0000-0x00000000734F4000-memory.dmp

memory/2716-251-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-254-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-257-0x0000000000230000-0x0000000000548000-memory.dmp

memory/2716-260-0x0000000000230000-0x0000000000548000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 08:36

Reported

2024-11-14 08:38

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2f9b68f68c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006161001\\2f9b68f68c.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c9fbfb6835.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006162001\\c9fbfb6835.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cc00436f02.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006164001\\cc00436f02.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3396 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 3396 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 3396 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 3064 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe
PID 3064 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe
PID 3064 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe
PID 3064 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe
PID 3064 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe
PID 3064 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe
PID 3064 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 3064 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 3064 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 3064 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe
PID 3064 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe
PID 3064 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe
PID 4284 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 2168 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 2168 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 3944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 3944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 3944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe

"C:\Users\Admin\AppData\Local\Temp\4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe

"C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe"

C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe

"C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe

"C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2f9b68f68c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffcd0046f8,0x7fffcd004708,0x7fffcd004718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2f9b68f68c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffcd0046f8,0x7fffcd004708,0x7fffcd004718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12267572244689149766,385317070865268852,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 185.215.113.43:80 185.215.113.43 tcp
US 8.8.8.8:53 43.113.215.185.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 frogmen-smell.sbs udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 133.174.67.172.in-addr.arpa udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
RU 185.215.113.206:80 185.215.113.206 tcp
US 8.8.8.8:53 206.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 learn.microsoft.com udp
US 23.192.22.89:443 learn.microsoft.com tcp
US 8.8.8.8:53 57.110.18.2.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 8.8.8.8:53 89.22.192.23.in-addr.arpa udp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 20.42.65.89:443 browser.events.data.microsoft.com tcp
US 20.42.65.89:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/3396-0-0x0000000000760000-0x0000000000A78000-memory.dmp

memory/3396-1-0x0000000076FA4000-0x0000000076FA6000-memory.dmp

memory/3396-2-0x0000000000761000-0x00000000007C9000-memory.dmp

memory/3396-3-0x0000000000760000-0x0000000000A78000-memory.dmp

memory/3396-4-0x0000000000760000-0x0000000000A78000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

MD5 36186abad1b6621bfa6a2910dc005972
SHA1 3ab630f001cf69137f8391ddbbec30a6211a94b0
SHA256 4f3d62f4662ecab837feb201384f04a6a0c79a3a8a2cda97ee6bab3a58e226aa
SHA512 9d3695f5f2314725ac237b819823b1898152b6c0611a119d583cdcff9dc808fa9ae6819b7723046be7b910142f88735921641a93042b7872b5af45784693d0d5

memory/3396-18-0x0000000000761000-0x00000000007C9000-memory.dmp

memory/3396-17-0x0000000000760000-0x0000000000A78000-memory.dmp

memory/3064-19-0x0000000000390000-0x00000000006A8000-memory.dmp

memory/3064-20-0x0000000000391000-0x00000000003F9000-memory.dmp

memory/3064-21-0x0000000000390000-0x00000000006A8000-memory.dmp

memory/3064-22-0x0000000000390000-0x00000000006A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006161001\2f9b68f68c.exe

MD5 32759286f0d328a68c63fbb0b85dacb7
SHA1 08df21f5f91ffc76293473dc8acfd3fa364678d7
SHA256 21af6e9262502de17e772eafacaa6eedc2128c1a6c445801bbc0f06318143bf7
SHA512 3afae0cc276fae073b4a07d8c3d90e28fb1585bc9cbc3e29519f8fd6b7148acb494cbf4497254537e8351ffd480604b0a91ee4107bd09ea915084245663a1922

memory/4284-38-0x00000000001B0000-0x00000000004A3000-memory.dmp

memory/3064-39-0x0000000000390000-0x00000000006A8000-memory.dmp

memory/4284-40-0x00000000001B0000-0x00000000004A3000-memory.dmp

memory/3064-42-0x0000000000390000-0x00000000006A8000-memory.dmp

memory/4284-41-0x00000000001B0000-0x00000000004A3000-memory.dmp

memory/3064-43-0x0000000000391000-0x00000000003F9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006162001\c9fbfb6835.exe

MD5 673adb8fbfc09e598b9f2cd49291d360
SHA1 64b647245c6206581fd1ada3df3f9dc7dca75e9f
SHA256 a3eaf680536f723aad903e7b9f0802699f113951925f3ffe25572345a79855d1
SHA512 bc140fbc9bc2f31fc6df6db5fc52099920335b0e583585c7759a5bf4b2dba2f2a90da84b392e0c06a1ee0c7d8475fa6c1559ba3168fe31ad1c2699debcca9a31

memory/1816-59-0x00000000002F0000-0x000000000096F000-memory.dmp

memory/4284-60-0x00000000001B0000-0x00000000004A3000-memory.dmp

memory/1816-61-0x00000000002F0000-0x000000000096F000-memory.dmp

memory/3064-62-0x0000000000390000-0x00000000006A8000-memory.dmp

memory/4284-64-0x00000000001B0000-0x00000000004A3000-memory.dmp

memory/4284-65-0x00000000001B0000-0x00000000004A3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006164001\cc00436f02.exe

MD5 cd92d8ecfa6e7c1ec2493affd71d2612
SHA1 328676a428c2a17fe6b8ccbe7df1945b4eeda169
SHA256 f4997a04a30174c18394454bd6e4f41631807041092ac17f25d2349422e7a2b7
SHA512 3588b3f2ba99b6d0939dfc10ac19f560d5332584874fe284393364bef96c1331965e5a85964fd07cbea500f3e222e4c23336ff30616fd61f2370c9052b521883

memory/4284-76-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-77-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/988-91-0x0000000000A50000-0x0000000000CFE000-memory.dmp

memory/4284-113-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-115-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-114-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-112-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-111-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-110-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-119-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-118-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-117-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-116-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-109-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-108-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-107-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-106-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-104-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-103-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-102-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-101-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-100-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-98-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-97-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-96-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-95-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-93-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-92-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-105-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-99-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-94-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/4284-120-0x00000000001B0000-0x00000000004A3000-memory.dmp

memory/988-121-0x0000000000A50000-0x0000000000CFE000-memory.dmp

memory/988-122-0x0000000000A50000-0x0000000000CFE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

\??\pipe\LOCAL\crashpad_4560_DVJGPTCEYVOSDQQB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d6c2b1e479e0c225466d08691900edb9
SHA1 ffca1e138d0c8ecc76d8db21b3c519ecd210c699
SHA256 bf7eb03d3a5b2f3f7993e8156706f015d878ea9770dfdd1bd9d33869dc8d1198
SHA512 a9c62fa3c8f62ea41c1c57c024788b258638439e2080886511a70c0164e7767a9f7244f977700b65773134de3c77c121db1c8bce697f728c1518d599fac07db2

memory/4284-147-0x00000000001B0000-0x00000000004A3000-memory.dmp

memory/3064-163-0x0000000000390000-0x00000000006A8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/988-186-0x0000000000A50000-0x0000000000CFE000-memory.dmp

memory/4284-187-0x00000000001B0000-0x00000000004A3000-memory.dmp

memory/988-194-0x0000000000A50000-0x0000000000CFE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3c77edf8d88c94a7625c5b25c0020f62
SHA1 09c7b769092b5a1af4f6a0e3d30f70d9810180f8
SHA256 7276799e67697feaba6dac0072efaca2467c81dc12d7697d37544a8f7a906a85
SHA512 d76c340d87f6e39a0e0820bcde16d193acbfad8b6a58220945511104b7edb4a36d8a381d81e6ca66e7e81a9733d52e2b27067d73750f0e6855fcca779fbb10bc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a4ec05bca6146b81d558bf9082f0bc5b
SHA1 58fc4486515feffe09883c11e8d48edfb70a1f39
SHA256 15b00578401db0a9b7467cdcf7a323e2afeecf9dce583208477f370b366064a4
SHA512 53c7fcb26a49c3c5756b9b4240fbd722355a4f7fcfcbe62b2a0796425548a21d05b89d49b90d89c4cbb8425fa5f8befb8cba1b90f020aa922478e6e1939de5f5

memory/3064-211-0x0000000000390000-0x00000000006A8000-memory.dmp

memory/4284-242-0x00000000001B0000-0x00000000004A3000-memory.dmp

memory/4284-216-0x0000000006140000-0x00000000063EE000-memory.dmp

memory/5264-280-0x0000000000390000-0x00000000006A8000-memory.dmp

memory/5264-282-0x0000000000390000-0x00000000006A8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 de8ef06e15269023f75735b9f0e8d07c
SHA1 b5d65bc6c797e1913c75f4f1b547710b3d919a16
SHA256 7cd5dc170a75717d1794d1c9ad735f951ba2ea77d906a23e049ecb7298c80729
SHA512 f597478e3f64aeedf3546326190644056cdc519499cf16d8bfb348ad41917c04c2f12a489dd849fc7513687d21f39c68b044bb2d936cc413cb6aee99154ab79e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582f87.TMP

MD5 3bf2a3706fe48c31a08fceff85d36a13
SHA1 aa7a53d9f05fab36ffdfc0030216585d3c26a4e9
SHA256 cf6ec395349148def668132e0417e6a9bb0db0623fc7b3c99384fc1779d4df2e
SHA512 ed2c2de0ab76fc07d69904a699583ebd9d15affe817a7e5058bf7f749aae0c625156b9b91f082e6b12aea593307924554ef70b21b3a915c12c79c34c43318025

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 537c47844d05edbd595deb9ed630f141
SHA1 7b3b5dcf8e99ebb30b64e92245dafb855fc12058
SHA256 614ab3708f46ce90eb3e28db909152008cd767d58088c9731e443f43f6230c50
SHA512 c050818b66e78b355a3672c33ee54b28499181f169428cc206d96b387a4b75b841617a623391daad3eaad498ec8c01ce2838a109e8b813bc70ae99e44f2920e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d9d15a1d7fe2d142e651bec996d37273
SHA1 304996fcb109654a6c91b69a708d171a2db6455c
SHA256 3d8ad9de0edad5e63860ce9a25717d854a636de06dc035fd7cff865869c6e1b8
SHA512 c1cae1d76853c9cfd746caf338eb85f6dadb162ebeef57d140a8a8d62b299716c4cd8c744f414bc0911011589167f35f8a8731d08d1036c20f059a54f7f7d00d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

memory/4000-361-0x0000000000390000-0x00000000006A8000-memory.dmp