amadey | 5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
Size

2.9MB
MD5

f8fc64f50be9ac7c2757ae0dc1fecae9
SHA1

a8548a7fe4db8133e0287aa0e0e30c22bd607268
SHA256

5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd
SHA512

a4a15b36105b05b1fe82b3da36412fd8f464341d04c6d3e8c4d66736b89965d15b8df0c342164b2f6653aed62848a8c89aa716d567fd0581d8ce3928aa9f06b3
SSDEEP

24576:ed/VVseAYPHvO7oh0V0nqKd/66xjvvtAvqXe4O57d7O0wtiTYLg60wZ1OpvEZP3j:o1AOH28hJyyEFO0wtIkP3yiBSwtD

Score

10^/10

amadey cryptbot lumma vidar 9c9aa5 credential_access discovery evasion execution spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Extracted

Family

lumma

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/files/0x0009000000023ce1-229.dat	family_vidar_v7
behavioral2/memory/4808-233-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7
behavioral2/memory/4808-306-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	97115963d2.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	97115963d2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3ec7d09f94.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4912	powershell.exe
1744	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3ec7d09f94.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3ec7d09f94.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	97115963d2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	97115963d2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	465e07371b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	fafcf5d7251c4354a3f769f1d5240de9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	c4f03826950a47a5905f3ac9da0f97b7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe

Executes dropped EXE 13 IoCs

pid	Process
1676	skotes.exe
4092	97115963d2.exe
3840	cda466de36.exe
2600	skotes.exe
1104	3ec7d09f94.exe
3760	effb0cc387.exe
1828	effb0cc387.exe
976	516f734228.exe
772	465e07371b.exe
3276	cda466de36.exe
4808	c4f03826950a47a5905f3ac9da0f97b7.exe
1748	fafcf5d7251c4354a3f769f1d5240de9.exe
5932	skotes.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	3ec7d09f94.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	97115963d2.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	skotes.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
75	raw.githubusercontent.com
77	raw.githubusercontent.com
76	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3648	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
1676	skotes.exe
4092	97115963d2.exe
2600	skotes.exe
1104	3ec7d09f94.exe
5932	skotes.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3760 set thread context of 1828	3760	effb0cc387.exe	105
PID 3840 set thread context of 3276	3840	cda466de36.exe	113

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	97115963d2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4f03826950a47a5905f3ac9da0f97b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	465e07371b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cda466de36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	516f734228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cda466de36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ec7d09f94.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	effb0cc387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	effb0cc387.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c4f03826950a47a5905f3ac9da0f97b7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c4f03826950a47a5905f3ac9da0f97b7.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
440	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3648	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
3648	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
1676	skotes.exe
1676	skotes.exe
4092	97115963d2.exe
4092	97115963d2.exe
4092	97115963d2.exe
4092	97115963d2.exe
4092	97115963d2.exe
4092	97115963d2.exe
4092	97115963d2.exe
4092	97115963d2.exe
4092	97115963d2.exe
4092	97115963d2.exe
2600	skotes.exe
2600	skotes.exe
1104	3ec7d09f94.exe
1104	3ec7d09f94.exe
976	516f734228.exe
976	516f734228.exe
772	465e07371b.exe
4912	powershell.exe
4912	powershell.exe
976	516f734228.exe
1744	powershell.exe
1744	powershell.exe
4808	c4f03826950a47a5905f3ac9da0f97b7.exe
4808	c4f03826950a47a5905f3ac9da0f97b7.exe
4244	msedge.exe
4244	msedge.exe
3508	msedge.exe
3508	msedge.exe
4088	identity_helper.exe
4088	identity_helper.exe
5932	skotes.exe
5932	skotes.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3840	cda466de36.exe
Token: SeDebugPrivilege	772	465e07371b.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1748	fafcf5d7251c4354a3f769f1d5240de9.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3648	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 1676	3648	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe	83
PID 3648 wrote to memory of 1676	3648	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe	83
PID 3648 wrote to memory of 1676	3648	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe	83
PID 1676 wrote to memory of 4092	1676	skotes.exe	92
PID 1676 wrote to memory of 4092	1676	skotes.exe	92
PID 1676 wrote to memory of 4092	1676	skotes.exe	92
PID 1676 wrote to memory of 3840	1676	skotes.exe	97
PID 1676 wrote to memory of 3840	1676	skotes.exe	97
PID 1676 wrote to memory of 3840	1676	skotes.exe	97
PID 1676 wrote to memory of 1104	1676	skotes.exe	102
PID 1676 wrote to memory of 1104	1676	skotes.exe	102
PID 1676 wrote to memory of 1104	1676	skotes.exe	102
PID 1676 wrote to memory of 3760	1676	skotes.exe	103
PID 1676 wrote to memory of 3760	1676	skotes.exe	103
PID 1676 wrote to memory of 3760	1676	skotes.exe	103
PID 3760 wrote to memory of 1828	3760	effb0cc387.exe	105
PID 3760 wrote to memory of 1828	3760	effb0cc387.exe	105
PID 3760 wrote to memory of 1828	3760	effb0cc387.exe	105
PID 3760 wrote to memory of 1828	3760	effb0cc387.exe	105
PID 3760 wrote to memory of 1828	3760	effb0cc387.exe	105
PID 3760 wrote to memory of 1828	3760	effb0cc387.exe	105
PID 3760 wrote to memory of 1828	3760	effb0cc387.exe	105
PID 3760 wrote to memory of 1828	3760	effb0cc387.exe	105
PID 3760 wrote to memory of 1828	3760	effb0cc387.exe	105
PID 1676 wrote to memory of 976	1676	skotes.exe	107
PID 1676 wrote to memory of 976	1676	skotes.exe	107
PID 1676 wrote to memory of 976	1676	skotes.exe	107
PID 1676 wrote to memory of 772	1676	skotes.exe	108
PID 1676 wrote to memory of 772	1676	skotes.exe	108
PID 1676 wrote to memory of 772	1676	skotes.exe	108
PID 772 wrote to memory of 4912	772	465e07371b.exe	110
PID 772 wrote to memory of 4912	772	465e07371b.exe	110
PID 772 wrote to memory of 4912	772	465e07371b.exe	110
PID 3840 wrote to memory of 3276	3840	cda466de36.exe	113
PID 3840 wrote to memory of 3276	3840	cda466de36.exe	113
PID 3840 wrote to memory of 3276	3840	cda466de36.exe	113
PID 3840 wrote to memory of 3276	3840	cda466de36.exe	113
PID 3840 wrote to memory of 3276	3840	cda466de36.exe	113
PID 3840 wrote to memory of 3276	3840	cda466de36.exe	113
PID 3840 wrote to memory of 3276	3840	cda466de36.exe	113
PID 3840 wrote to memory of 3276	3840	cda466de36.exe	113
PID 3840 wrote to memory of 3276	3840	cda466de36.exe	113
PID 772 wrote to memory of 1744	772	465e07371b.exe	115
PID 772 wrote to memory of 1744	772	465e07371b.exe	115
PID 772 wrote to memory of 1744	772	465e07371b.exe	115
PID 772 wrote to memory of 4808	772	465e07371b.exe	118
PID 772 wrote to memory of 4808	772	465e07371b.exe	118
PID 772 wrote to memory of 4808	772	465e07371b.exe	118
PID 772 wrote to memory of 1748	772	465e07371b.exe	119
PID 772 wrote to memory of 1748	772	465e07371b.exe	119
PID 1748 wrote to memory of 3508	1748	fafcf5d7251c4354a3f769f1d5240de9.exe	122
PID 1748 wrote to memory of 3508	1748	fafcf5d7251c4354a3f769f1d5240de9.exe	122
PID 3508 wrote to memory of 392	3508	msedge.exe	123
PID 3508 wrote to memory of 392	3508	msedge.exe	123
PID 3508 wrote to memory of 4876	3508	msedge.exe	124
PID 3508 wrote to memory of 4876	3508	msedge.exe	124
PID 3508 wrote to memory of 4876	3508	msedge.exe	124
PID 3508 wrote to memory of 4876	3508	msedge.exe	124
PID 3508 wrote to memory of 4876	3508	msedge.exe	124
PID 3508 wrote to memory of 4876	3508	msedge.exe	124
PID 3508 wrote to memory of 4876	3508	msedge.exe	124
PID 3508 wrote to memory of 4876	3508	msedge.exe	124
PID 3508 wrote to memory of 4876	3508	msedge.exe	124
PID 3508 wrote to memory of 4876	3508	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe
"C:\Users\Admin\AppData\Local\Temp\5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Users\Admin\AppData\Local\Temp\1018196001\97115963d2.exe
    "C:\Users\Admin\AppData\Local\Temp\1018196001\97115963d2.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\1018197001\cda466de36.exe
    "C:\Users\Admin\AppData\Local\Temp\1018197001\cda466de36.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\1018197001\cda466de36.exe
      "C:\Users\Admin\AppData\Local\Temp\1018197001\cda466de36.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3276
- - C:\Users\Admin\AppData\Local\Temp\1018198001\3ec7d09f94.exe
    "C:\Users\Admin\AppData\Local\Temp\1018198001\3ec7d09f94.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\1018199001\effb0cc387.exe
    "C:\Users\Admin\AppData\Local\Temp\1018199001\effb0cc387.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\1018199001\effb0cc387.exe
      "C:\Users\Admin\AppData\Local\Temp\1018199001\effb0cc387.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1828
- - C:\Users\Admin\AppData\Local\Temp\1018200001\516f734228.exe
    "C:\Users\Admin\AppData\Local\Temp\1018200001\516f734228.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\1018201001\465e07371b.exe
    "C:\Users\Admin\AppData\Local\Temp\1018201001\465e07371b.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\wyarulcna"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4912
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1744
  - - C:\wyarulcna\c4f03826950a47a5905f3ac9da0f97b7.exe
      "C:\wyarulcna\c4f03826950a47a5905f3ac9da0f97b7.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4808
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\wyarulcna\c4f03826950a47a5905f3ac9da0f97b7.exe" & rd /s /q "C:\ProgramData\Q900HVS2V3WB" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:440
  - - C:\wyarulcna\fafcf5d7251c4354a3f769f1d5240de9.exe
      "C:\wyarulcna\fafcf5d7251c4354a3f769f1d5240de9.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9MSZ40SLW145?ocid=&referrer=psi
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8608e46f8,0x7ff8608e4708,0x7ff8608e4718
        6⤵
        
        PID:392
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        6⤵
        
        PID:4876
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:8
        6⤵
        
        PID:2340
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
        6⤵
        
        PID:1452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
        6⤵
        
        PID:3960
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
        6⤵
        
        PID:1956
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4088
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2600 /prefetch:1
        6⤵
        
        PID:1608
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
        6⤵
        
        PID:4228
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
        6⤵
        
        PID:4264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11643591254442858588,4795103205090978994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
        6⤵
        
        PID:3044

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4eff5f54381f25a564d8874367d34c0e

SHA1
83251ad3405c779d2389e3de3f9fabb84c943e4a

SHA256
bbb9243459dbe8c5af884355e9725ecd8901060eb09b308b46d8d6f416ce5899

SHA512
4453fcc8508e56d6cf299f4221fc2295a0d74357e2d815916affa278072b337d22abc82170d6ed092796b7713f8b71d8b027771eee6a12b65795af1f46a76767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
339B

MD5
36241a71cb5c037c9fb83a36a3a70cec

SHA1
2db701ea9421dfa6800d09c5c1e8845d93b9b907

SHA256
3cfd309540de0ee8389d603086fd25856050a9d4c5258db6bbf8a99606906661

SHA512
fc4b43a16e9be8d9da40318c4399b1553a26f0fff572f27ba1efde1b3ec22ca63d72601adaff93435fbdc235b8f1ead8879129357573b6edc2140463f0e8a495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2c8f3b023c1299813431888ce82e7b9e

SHA1
811c56a45f84ff430c4310527e7eb3276af4997b

SHA256
2df6925110c8ae29690cd85f91d43a4e308590ddb7054c2b2127729cca4ebd95

SHA512
ea29ee7ab57091fd80516ece7f152d84b17f09c32bdd9a02768d0cfd5e18e0f1d00ba480537e699631b1f03eef9c6fffa5e3c35141ed9f9b93d30bae3214ca75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b239ed4f057f85716fcd8c8a85a6752

SHA1
e5a9b85913dc2b9360722f8204dfca2bbd227406

SHA256
e8e5f0d01c7e731f7fb348eedd07e86915287fdc9f737ccef88296107bab4f33

SHA512
7c715e8cba5750c6bf179d51fb968ff1d2cceb26435782ae76ddfca6d2d6e29dcb9e71123f71fbed59b5fccb899019e4b7f220438a9a1cc2b577cddb8dc6687c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\23fc1d6a-43e7-497e-b46b-e4bcc1e1a552\index-dir\the-real-index

Filesize
1KB

MD5
a7a9d29dcf65ff0c57f64b687db8e44f

SHA1
ae14c636ce44f8885ad0a5dad4d46d827b405adc

SHA256
59e55ae0b475f45fdb3a212414698bd04251f18967569ae142d31b20ba151848

SHA512
93c29cc6f80663c04363318affab863f6e83069d1ec2728dce3fc8f8e405b3551c0205a009b9a63588cf15b8f9194fcd2c83482ac9222f6002cd17e41b64ffd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\23fc1d6a-43e7-497e-b46b-e4bcc1e1a552\index-dir\the-real-index~RFe592438.TMP

Filesize
48B

MD5
2a44f2636fd3a585dd5e262ed478010b

SHA1
7a04a432c46ae95fe945e95a0a1edf115b6727f4

SHA256
3c51579062ebbe4f1aceb6b04209426f1bc5d8d4b3108c0e1e7f8fedecc55905

SHA512
0f801ff5ef922ad6e594d1544dd6878a46973c52c5f684f62f9b1a28a9a43c368c63506f9d79a896adba1b53c4521f4a9f090a516fa031f7aa18bb02d4bfc0ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\553b53bc-6d61-4c7c-93d3-be8005cf043e\index-dir\the-real-index

Filesize
72B

MD5
b3564f5aa125ae306b71e5c8d5c3ecd0

SHA1
3576564f2d2648b6f7e87881afd24f7ed229abc8

SHA256
0853594a0b595bb156db17d3cfc73a0273aa5bd6a5f5be21fd9c6f6f797cb6b7

SHA512
5a49f26243fd91424d5e7512a10f24ac5fd65de9d9babda366c56c7f4b6118402d4a1cf4b322b4f3ea1cc19e096790d4e4c69645c851089618c93f6ba5145531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\553b53bc-6d61-4c7c-93d3-be8005cf043e\index-dir\the-real-index~RFe590bed.TMP

Filesize
48B

MD5
6ca90e35d465000bb61cf92d57f07099

SHA1
93661ce802459dfbf8790166456e2104224fecda

SHA256
86cb6a2a686b84e6e5e10cd29632354e329a9b9cade6c8d80fe272f34b1cbd51

SHA512
5797aa128166c853fa341ff90449ca88eb83fa665a44533dcf6d4f3e327639b72f4b4a0b4870541741637a6bb1472846135983436fba0b747fc3df4706b26ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
201B

MD5
f1e7e211c77baf2d54af9b9d970faeac

SHA1
3c2cabb31eac2432036870daf64d2e0ef8e1a1ba

SHA256
53c6b3675e4c361d21733c737b7691e54f90e5dfa8311a9f9e008715eed0c1ed

SHA512
db8cd620a703c71edc03605158016abf601b98409e700ccc6746108a0dc6945556d462fc6de224d2eb3e801997a290a6975e006d6d7a97928f35265efcaf8792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
109B

MD5
437d6e5324f96d61e6e6e6c756fc7587

SHA1
d0f3c04c5a2d0871ade4d352d86b4ac17ce0beea

SHA256
90ed8fff7f38d7efaf52dcc6c1edb6fa5a3e11cc81641675622193549dac092d

SHA512
92ec80b14d868a7fd1dfbdec863911814bae3b31ea3a0513dd6a696f52777e131b02773fabff39cf9269fae597ca22a71fc7040d0e3818757a7bd8ac3ea75ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
204B

MD5
de6ada6c5080a444b1174403c0600dba

SHA1
bc3ebc0aadc91b2ef650967919cda66a9dc14baa

SHA256
6fb164c0f59cc5eb136f722c3e2c9666c09183387d9e5a1892850cd0ec8473ba

SHA512
6267b12db14be4a65453619e77c75d0c8ea58071d5fc123cccf96e8fe0f3613e99587076d16bdf08cdc68007035b7f55dcb5d082611b1ad5a87ce793c69ecbb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6ca531f5f2166ce99f53f965c7ac0162

SHA1
f217ec7b1c0fc9ee302a8e116d4f02baf75f39b6

SHA256
237956ca09925adc4a50d66b18b3d68583906c73e4b5b5bb8c9735fc9f844142

SHA512
ab945b580e22961d69cb18047ebcc7fb6121968f0a44d2064d7c68053a3517a0e2c6e209bd1b8dcdafb79419257ab3e79f9d742175d8af7aa4476fb2e5e6e7eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590bae.TMP

Filesize
48B

MD5
11c0328c48712788db181d04c42dae05

SHA1
24c8803a4c9c9356949081f2ad5b7d8f402fe6ba

SHA256
0c8be67e3a286a7a43f5f8599d51bb65674824d285536daf955729007257803f

SHA512
a5a33e47080154c228365ae037594cf7519100c8d22e627aab18b064f2307d9bc7f11c5b764f1e7f838b4d5cabef5b400c962e6b8356dd51b946e2918fd727ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ea130a80f15bc04fc42ead073dbfe49c

SHA1
2b1e0f2b4e8e17f99091ad1b0fb94200327deb0b

SHA256
7b2f8b2f7ece626821e4f40ace20de0652e41445c54efa6d4b769cb1dd33b65a

SHA512
f898b6bf17055f297d61990e0f3e71c3d6d50771a3456a17d8c2089775809537450321ba991c3a40c7b9534e113d694564e1ef43179334cc343c1c2d3472b532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
cd89d2a35540d11f4515475ff98177ea

SHA1
d75b007001925f2a62a6f96583f10f54baef1a92

SHA256
b1413c7d4e17320b05d332824d6f546a5505452dcd1f6fad4f285095060dc9dd

SHA512
0031bce83924ff0830e8aae5a94916d7d897a1859c2eb3d526ba7bc9581564944727ef4be8bdb796ac90f4432e1affaad08284117840a8af44d096a3fab64e26

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018196001\97115963d2.exe

Filesize
4.2MB

MD5
1d057672840921889505863b33e87671

SHA1
3bbc68098e4080f656c7f92147a54d05d18e1277

SHA256
e4420b07cff76b9f623b1e9ed3957d708769a744f245e27fb3b1e44cdc67eb35

SHA512
12f5d869fea831d66f0811bc00a2c25e4d156f24189a7eee3e4593d0062057638686f780132a188f52ac6de9fba78404517ca041205c6834dd135217d0ab4eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018197001\cda466de36.exe

Filesize
3.1MB

MD5
c00a67d527ef38dc6f49d0ad7f13b393

SHA1
7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

SHA256
12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

SHA512
9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018198001\3ec7d09f94.exe

Filesize
4.3MB

MD5
d460614a38afe39ba7ca3fe331c0de53

SHA1
d150e613032919a2a4da84c26f17bdbe5112f847

SHA256
8bff2b1dd2b8b6b4e09d448eecca556b368db5ea69581d64f7a8201e974d90ef

SHA512
cc02f6d6c4c4a5f66a9cb7fcf8c2378651d882c408492a3e3e51b9e011ac5f39148ec665d422ef7ce7ee4f9741e30fb875c77f0a8e2f4b43088cd5d43a6c3b52

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018199001\effb0cc387.exe

Filesize
791KB

MD5
e8af4d0d0b47ac68d762b7f288ae8e6e

SHA1
1d65f31526cc20ab41d6b1625d6674d7f13e326c

SHA256
b83449768e7af68867c8bc42b19ff012722d88ea66aef69df48661e63e0eb15e

SHA512
80fad90314ff639f538a72c5e4ca2bf9ae52b9309caa7cd6f87d61791505bb3612b7f3190ab9b67348c5d71f4d29bb9d101e3f66d525eb9b5e2060a10b2d187a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018200001\516f734228.exe

Filesize
1.3MB

MD5
669ed3665495a4a52029ff680ec8eba9

SHA1
7785e285365a141e307931ca4c4ef00b7ecc8986

SHA256
2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

SHA512
bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018201001\465e07371b.exe

Filesize
21KB

MD5
04f57c6fb2b2cd8dcc4b38e4a93d4366

SHA1
61770495aa18d480f70b654d1f57998e5bd8c885

SHA256
51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

SHA512
53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpA5B1.tmp

Filesize
1KB

MD5
a10f31fa140f2608ff150125f3687920

SHA1
ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b

SHA256
28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6

SHA512
cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_madyurtm.bfb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.9MB

MD5
f8fc64f50be9ac7c2757ae0dc1fecae9

SHA1
a8548a7fe4db8133e0287aa0e0e30c22bd607268

SHA256
5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd

SHA512
a4a15b36105b05b1fe82b3da36412fd8f464341d04c6d3e8c4d66736b89965d15b8df0c342164b2f6653aed62848a8c89aa716d567fd0581d8ce3928aa9f06b3

Download Submit
C:\wyarulcna\c4f03826950a47a5905f3ac9da0f97b7.exe

Filesize
144KB

MD5
cc36e2a5a3c64941a79c31ca320e9797

SHA1
50c8f5db809cfec84735c9f4dcd6b55d53dfd9f5

SHA256
6fec179c363190199c1dcdf822be4d6b1f5c4895ebc7148a8fc9fa9512eeade8

SHA512
fcea6d62dc047e40182dc4ff1e0522ca935f9aeefdb1517957977bc5d9ac654285a973261401f3b98abf1f6ed62638b9e31306fd7aaeb67214ca42dfc2888af0

Download Submit
C:\wyarulcna\fafcf5d7251c4354a3f769f1d5240de9.exe

Filesize
1.0MB

MD5
971b0519b1c0461db6700610e5e9ca8e

SHA1
9a262218310f976aaf837e54b4842e53e73be088

SHA256
47cf75570c1eca775b2dd1823233d7c40924d3a8d93e0e78c943219cf391d023

SHA512
d234a9c5a1da8415cd4d2626797197039f2537e98f8f43d155f815a7867876cbc1bf466be58677c79a9199ea47d146a174998d21ef0aebc29a4b0443f8857cb9

Download Submit
memory/772-144-0x0000000000A60000-0x0000000000A6C000-memory.dmp

Filesize
48KB

Download
memory/976-212-0x0000000000830000-0x0000000000987000-memory.dmp

Filesize
1.3MB

Download
memory/976-163-0x0000000000A90000-0x0000000000AE6000-memory.dmp

Filesize
344KB

Download
memory/1104-88-0x0000000000100000-0x0000000000D90000-memory.dmp

Filesize
12.6MB

Download
memory/1104-86-0x0000000000100000-0x0000000000D90000-memory.dmp

Filesize
12.6MB

Download
memory/1676-675-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-650-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-640-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-627-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-624-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-591-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-16-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-89-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-19-0x0000000000A91000-0x0000000000ABF000-memory.dmp

Filesize
184KB

Download
memory/1676-160-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-20-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-21-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-565-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-22-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-23-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-432-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-24-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-25-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-61-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-248-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1676-66-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/1744-213-0x000000006FC80000-0x000000006FCCC000-memory.dmp

Filesize
304KB

Download
memory/1744-210-0x0000000006240000-0x0000000006594000-memory.dmp

Filesize
3.3MB

Download
memory/1748-247-0x0000020FDEBD0000-0x0000020FDEC8A000-memory.dmp

Filesize
744KB

Download
memory/1748-263-0x0000020FDD9F0000-0x0000020FDDA02000-memory.dmp

Filesize
72KB

Download
memory/1748-268-0x0000020FE27F0000-0x0000020FE2976000-memory.dmp

Filesize
1.5MB

Download
memory/1748-267-0x0000020FDF510000-0x0000020FDF51E000-memory.dmp

Filesize
56KB

Download
memory/1748-266-0x0000020FE1B70000-0x0000020FE1BA8000-memory.dmp

Filesize
224KB

Download
memory/1748-265-0x0000020FDF4D0000-0x0000020FDF4D8000-memory.dmp

Filesize
32KB

Download
memory/1748-264-0x0000020FDE9E0000-0x0000020FDEA1C000-memory.dmp

Filesize
240KB

Download
memory/1748-245-0x0000020FC3330000-0x0000020FC3432000-memory.dmp

Filesize
1.0MB

Download
memory/1748-276-0x0000020FE29B0000-0x0000020FE29D6000-memory.dmp

Filesize
152KB

Download
memory/1748-246-0x0000020FC50B0000-0x0000020FC50BA000-memory.dmp

Filesize
40KB

Download
memory/1828-108-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1828-106-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2600-70-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/2600-69-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/3276-185-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3276-187-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3648-0-0x0000000000340000-0x000000000065E000-memory.dmp

Filesize
3.1MB

Download
memory/3648-18-0x0000000000340000-0x000000000065E000-memory.dmp

Filesize
3.1MB

Download
memory/3648-4-0x0000000000340000-0x000000000065E000-memory.dmp

Filesize
3.1MB

Download
memory/3648-3-0x0000000000340000-0x000000000065E000-memory.dmp

Filesize
3.1MB

Download
memory/3648-2-0x0000000000341000-0x000000000036F000-memory.dmp

Filesize
184KB

Download
memory/3648-1-0x0000000077E64000-0x0000000077E66000-memory.dmp

Filesize
8KB

Download
memory/3840-63-0x0000000000780000-0x0000000000AA8000-memory.dmp

Filesize
3.2MB

Download
memory/3840-182-0x0000000005DC0000-0x0000000006364000-memory.dmp

Filesize
5.6MB

Download
memory/3840-183-0x0000000005330000-0x0000000005352000-memory.dmp

Filesize
136KB

Download
memory/3840-169-0x00000000056C0000-0x0000000005816000-memory.dmp

Filesize
1.3MB

Download
memory/3840-64-0x0000000005370000-0x000000000540C000-memory.dmp

Filesize
624KB

Download
memory/4092-62-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-168-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-65-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-105-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-566-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-639-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-68-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-269-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-42-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-41-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-628-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-625-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-602-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4092-455-0x00000000000D0000-0x0000000000C24000-memory.dmp

Filesize
11.3MB

Download
memory/4808-233-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/4808-306-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/4912-161-0x0000000005940000-0x000000000595E000-memory.dmp

Filesize
120KB

Download
memory/4912-195-0x0000000007310000-0x0000000007324000-memory.dmp

Filesize
80KB

Download
memory/4912-162-0x0000000005970000-0x00000000059BC000-memory.dmp

Filesize
304KB

Download
memory/4912-190-0x00000000070D0000-0x00000000070EA000-memory.dmp

Filesize
104KB

Download
memory/4912-159-0x0000000005BB0000-0x0000000005F04000-memory.dmp

Filesize
3.3MB

Download
memory/4912-196-0x0000000007410000-0x000000000742A000-memory.dmp

Filesize
104KB

Download
memory/4912-149-0x0000000005620000-0x0000000005686000-memory.dmp

Filesize
408KB

Download
memory/4912-148-0x00000000055B0000-0x0000000005616000-memory.dmp

Filesize
408KB

Download
memory/4912-170-0x0000000006380000-0x00000000063B2000-memory.dmp

Filesize
200KB

Download
memory/4912-191-0x0000000007140000-0x000000000714A000-memory.dmp

Filesize
40KB

Download
memory/4912-192-0x0000000007350000-0x00000000073E6000-memory.dmp

Filesize
600KB

Download
memory/4912-197-0x00000000073F0000-0x00000000073F8000-memory.dmp

Filesize
32KB

Download
memory/4912-194-0x0000000007300000-0x000000000730E000-memory.dmp

Filesize
56KB

Download
memory/4912-193-0x00000000072D0000-0x00000000072E1000-memory.dmp

Filesize
68KB

Download
memory/4912-147-0x0000000004DE0000-0x0000000004E02000-memory.dmp

Filesize
136KB

Download
memory/4912-181-0x0000000006F70000-0x0000000006F8E000-memory.dmp

Filesize
120KB

Download
memory/4912-146-0x0000000004E50000-0x0000000005478000-memory.dmp

Filesize
6.2MB

Download
memory/4912-171-0x000000006FC80000-0x000000006FCCC000-memory.dmp

Filesize
304KB

Download
memory/4912-189-0x0000000007710000-0x0000000007D8A000-memory.dmp

Filesize
6.5MB

Download
memory/4912-145-0x00000000047E0000-0x0000000004816000-memory.dmp

Filesize
216KB

Download
memory/4912-184-0x0000000006FA0000-0x0000000007043000-memory.dmp

Filesize
652KB

Download
memory/5932-604-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download
memory/5932-603-0x0000000000A90000-0x0000000000DAE000-memory.dmp

Filesize
3.1MB

Download