flawedammyy | ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

Analysis

max time kernel
25s
max time network
320s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-05-2024 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AA_v3.exe
Size

798KB
MD5

90aadf2247149996ae443e2c82af3730
SHA1

050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256

ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512

eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
SSDEEP

24576:Uj0JJ4p/A4npt3XojeQG5EtzRtO7GvmDguXd:UjoJ4u4zojegylDN

Score

10^/10

flawedammyy bootkit persistence trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

AA_v3.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation AA_v3.exe
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

AA_v3.exeAA_v3.exe

description ioc process

File opened for modification \??\PhysicalDrive0 AA_v3.exe
File opened for modification \??\PhysicalDrive0 AA_v3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\International\Geo\Nation	AA_v3.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	AA_v3.exe
File opened for modification	\??\PhysicalDrive0	AA_v3.exe

Drops file in System32 directory 64 IoCs

Processes:

chrome.exeOpenWith.exechrome.exeAA_v3.exechrome.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	OpenWith.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\CURRENT	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\baa32a09-3fd8-4e22-925e-61a0bb4365bc.tmp	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database-journal	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\temp-index	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Top Sites	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2	chrome.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	AA_v3.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6651F976-E38.pma	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\First Run	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Visited Links	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extension State\000001.dbtmp	chrome.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	AA_v3.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	OpenWith.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_2	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_2	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Top Sites-journal	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\CURRENT	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13361121914328915	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Web Data	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Favicons	chrome.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1	chrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

AA_v3.exeOpenWith.exechrome.exechrome.exechrome.exechrome.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}\Count	OpenWith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\homepage_is_newtabpage = "34459F6041EF8C9B20E8FFF3A94076D597471B57ECCC35CE738EF0227BF9CE9C"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https	OpenWith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.account_id = "77341385B394CAA2D51B57CB3B1AB82C9B9D299B9644242EB7109B0DFB35A67A"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\BLBeacon	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\FirefoxURL-308046B0AF4A39CB_https = "0"	OpenWith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\google.services.last_username = "004C41F231362E8EEEB7F90290D2DAEF65484DC54C18E0927E11F5E6D8ED981A"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice	OpenWith.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Tbbtyr\Puebzr\Nccyvpngvba\puebzr.rkr = 00000000010000000000000000000000000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bfffffffffb0238924b2aeda0100000000	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\metricsid = "6facee28-0f22-4896-b495-38ba1b53b783"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\ChromeHTML_http = "0"	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\pinned_tabs = "10BE7ABF52D6730C785B361834E579F73A73DAF79CEB5B1A1CC217FDDAACDC29"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\Undecided_http = "0"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\Hash = "Cao1aCG3MCA="	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\Hash = "Pw1vMfjCL70="	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\IE.HTTP_http = "0"	OpenWith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	OpenWith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\prefs.preference_reset_time = "660DB172AE1B27F5C6F0822827E10405AF623738F9D05B0DA3BE6857040FF53E"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\http\OpenWithList\a = "chrome.exe"	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\metricsid_enableddate = "1716648310"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	chrome.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\http\OpenWithProgids\URL:HyperText Transfer Protocol = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}\Version = "5"	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}\Count	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\StabilityMetrics	chrome.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\http	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\UsageStatsInSample = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\settings_reset_prompt.last_triggered_for_homepage = "7735058B1CF07795273C83142CAE0181B03152F187C3EAE6CB134C1B12FE33E2"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Version = "5"	OpenWith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	OpenWith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\safebrowsing.incidents_sent = "F574FDF232408939D65A6A67C81C2EC127FB997483BDEE18DA3EF7CF232E6C65"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Google\Chrome\PreferenceMACs\Default\settings_reset_prompt.last_triggered_for_default_search = "6C3A2AC4B549B72A88E4ACE42065DA0B30739993A43CF5BCAB4157FF3891A829"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT	chrome.exe

Modifies registry class 5 IoCs

Processes:

OpenWith.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\chrome.exe\shell\open\command\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --single-argument %1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\chrome.exe	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\chrome.exe\shell\open	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\chrome.exe\shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\chrome.exe\shell\open\command	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3640 chrome.exe
3640 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

3640 chrome.exe
3640 chrome.exe
3640 chrome.exe
3640 chrome.exe
3640 chrome.exe

pid	process
3640	chrome.exe
3640	chrome.exe

pid	process
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3640	chrome.exe
Token: SeCreatePagefilePrivilege	3640	chrome.exe
Token: SeShutdownPrivilege	3640	chrome.exe
Token: SeCreatePagefilePrivilege	3640	chrome.exe
Token: SeShutdownPrivilege	3640	chrome.exe
Token: SeCreatePagefilePrivilege	3640	chrome.exe
Token: SeShutdownPrivilege	3640	chrome.exe
Token: SeCreatePagefilePrivilege	3640	chrome.exe
Token: SeShutdownPrivilege	3640	chrome.exe
Token: SeCreatePagefilePrivilege	3640	chrome.exe
Token: SeShutdownPrivilege	3640	chrome.exe
Token: SeCreatePagefilePrivilege	3640	chrome.exe
Token: SeShutdownPrivilege	3640	chrome.exe
Token: SeCreatePagefilePrivilege	3640	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

chrome.exeAA_v3.exe

pid process

3640 chrome.exe
3640 chrome.exe
3640 chrome.exe
2704 AA_v3.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

AA_v3.exe

pid process

2704 AA_v3.exe

pid	process
3640	chrome.exe
3640	chrome.exe
3640	chrome.exe
2704	AA_v3.exe

pid	process
2704	AA_v3.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

OpenWith.exe

pid	process
1384	OpenWith.exe
1384	OpenWith.exe
1384	OpenWith.exe
1384	OpenWith.exe
1384	OpenWith.exe
1384	OpenWith.exe
1384	OpenWith.exe
1384	OpenWith.exe
1384	OpenWith.exe
1384	OpenWith.exe
1384	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AA_v3.exeOpenWith.exechrome.exe

description	pid	process	target process
PID 2944 wrote to memory of 2704	2944	AA_v3.exe	AA_v3.exe
PID 2944 wrote to memory of 2704	2944	AA_v3.exe	AA_v3.exe
PID 2944 wrote to memory of 2704	2944	AA_v3.exe	AA_v3.exe
PID 1384 wrote to memory of 3640	1384	OpenWith.exe	chrome.exe
PID 1384 wrote to memory of 3640	1384	OpenWith.exe	chrome.exe
PID 3640 wrote to memory of 4428	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4428	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4136	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 3976	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 3976	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe
PID 3640 wrote to memory of 4324	3640	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:4480

C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:2944

C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"
2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2704

C:\Windows\SYSTEM32\rundll32.exe
rundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run
3⤵
PID:524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument http://www.ammyy.com/?lang=en&page=admin_eula.html&ver=3.10
2⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffd59c79758,0x7ffd59c79768,0x7ffd59c79778
3⤵
- Drops file in System32 directory
PID:4428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:2
3⤵
PID:4136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:8
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1796 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:8
3⤵
- Modifies data under HKEY_USERS
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2648 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:1
3⤵
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2660 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:1
3⤵
PID:3464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3792 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:1
3⤵
PID:2636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4016 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:1
3⤵
- Modifies data under HKEY_USERS
PID:2392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3696 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:8
3⤵
PID:1520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4968 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:1
3⤵
PID:2932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:8
3⤵
PID:4548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5528 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:1
3⤵
PID:1384

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
3⤵
PID:4912

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff6b5467688,0x7ff6b5467698,0x7ff6b54676a8
4⤵
PID:1156

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
4⤵
PID:1808

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff6b5467688,0x7ff6b5467698,0x7ff6b54676a8
5⤵
PID:3696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:8
3⤵
PID:4220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:8
3⤵
PID:4852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3788 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:8
3⤵
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5684 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:8
3⤵
PID:3972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5396 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:8
3⤵
PID:196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1552 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:8
3⤵
PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3576 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:2
3⤵
PID:168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2524 --field-trial-handle=1744,i,6552632961992166878,4311905191674034909,131072 /prefetch:2
3⤵
PID:3624

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4220

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" SYSTEM
1⤵
PID:1680

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3728

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:392

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
1⤵
PID:404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
PID:3776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.0.595153740\1610659211" -parentBuildID 20221007134813 -prefsHandle 1672 -prefMapHandle 1660 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {111b0d30-f2e7-41ff-952a-02cd43650db6} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 1776 1345fed7b58 gpu
3⤵
PID:1076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.1.1286425346\434478794" -parentBuildID 20221007134813 -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f17ac35e-ec9b-4d8f-840c-bf05ced27a55} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 2108 1345f844e58 socket
3⤵
PID:1524

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.2.81835970\192390139" -childID 1 -isForBrowser -prefsHandle 3180 -prefMapHandle 3148 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec5df26f-faf9-43d4-a56b-cab635a0a1a5} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 3360 13463fada58 tab
3⤵
PID:4076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.3.1471301423\1017209889" -childID 2 -isForBrowser -prefsHandle 3680 -prefMapHandle 3676 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {95b6f1df-3f51-46af-9a5b-d7efd3d6b4d0} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 2704 134624e6058 tab
3⤵
PID:2684

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.4.40972289\384757279" -childID 3 -isForBrowser -prefsHandle 4620 -prefMapHandle 4616 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49a7eb2c-51a2-4a56-a8f2-c1af5c8a0864} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 4636 13465f5da58 tab
3⤵
PID:2936

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.5.710198454\823771570" -childID 4 -isForBrowser -prefsHandle 5040 -prefMapHandle 5024 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {178729f9-d9e4-41af-86c1-abdd29a9b53a} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 4776 13454d72858 tab
3⤵
PID:4132

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.6.1589824592\1753502814" -childID 5 -isForBrowser -prefsHandle 5180 -prefMapHandle 5184 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af9aae73-deed-4f40-8576-4fe5b2f64317} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 5172 1346308b558 tab
3⤵
PID:4324

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3776.7.554313009\1771962155" -childID 6 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4c1e9d5-f470-4305-bfe1-3f9c7b23e611} 3776 "\\.\pipe\gecko-crash-server-pipe.3776" 5360 1346308cd58 tab
3⤵
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\SetupMetrics\dcabed41-abc7-43e8-9193-411b5c34694d.tmp

Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\ProgramData\AMMYY\aa_nts.log

Filesize
4KB

MD5
25f075bc499bf2c3aa7c0bf88417d938

SHA1
5d5329e19c90050c30a7f8a7b4290db492bb1a64

SHA256
7f0e90d0d77d6c6f44ef429bd544ae3305f49696eb765d44cac9ed7f956fa7a4

SHA512
861ff7ebc1ba2fbdc190285fe0f6b1c54baf5140d4eadc422062e640417e4cfdb1f9d908be113b2c00716ed91c66c8c807193742022fdd9273b1e60642600e69

Download Submit
C:\ProgramData\AMMYY\aa_nts.msg

Filesize
46B

MD5
bc1cfce765372fe2eb8ca41251cc1e97

SHA1
d70dec06053fcc309d57c6d326bbd111a76340b7

SHA256
59060ff291cec06fb2cce50a3032cccd7d24368eeee1e08179442a1aac2b5a4f

SHA512
8bfdcea65b0b22126b75c3aa7b43aa8fc6651bd83efe4510baf66aa2471df4f7f4092093c1f82bdea7bf1d047ec9c97b4f7a456158248e71140b84c846a99227

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
327B

MD5
f767909ec931981b9ba08f59317b7c58

SHA1
b3ba0d059737cd1a6788d9453a31339523d576c3

SHA256
b6659d62883903ca6137a17a5949d022a955d624896c537a840ec279b91f1d94

SHA512
d8000ca09a29d45c32ef6c1c043d86d5be0d59887383fb3aa1f48856095bd3768711b10309fd63eea256850fa579c4f517cec9bffea3ff74309fc17bc305642e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
7e66a11423cb3d343d3df68a26b4f345

SHA1
bb7ecf622159516e9853f6a60127828af2557793

SHA256
ee1b54c24f53cfc53ad9e1c1523fc3ea578ab23fce265f88b907f6383de8abc7

SHA512
b5eda8ff07fd9c2de1f5f031fcc5fb6dda18a971620e0f40334814f6bd08d394c4e98fbda7b4fba47416d7b60edfe4a6d594e4318e149d6f6a4eac35841f7e80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\0bce16f3-daa3-4186-acc5-e8ce2910be39

Filesize
10KB

MD5
c919c6492ca00fbe26403b66f85471cc

SHA1
43b775a2d1042fb6e3083bf89256d29feb25f9e2

SHA256
40ff1ec5a5676a592227aa1e94aab0cefd60df4c27e6b1b5b199beb3658c1420

SHA512
3fef7d4dcf5d7b698a7311cd4dd08dbfa351137ba1e150d285b9d3b65c092f7700181c264d9310018387f7d6df7ae3fb693c4c414f4d453cfcee426e9b7dc415

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\3e0695f8-102b-496a-8638-fcad6247da08

Filesize
746B

MD5
cf066de8c8171dd63d384351c797d21c

SHA1
f6eab9d90c8388f41594633ea306b09733f51a19

SHA256
fc0d047db4c971f2332567f904cbf071368ea23f505a260cca5e77051bcde2e2

SHA512
595aa5539656314660c252d9b9057441a866cef1d1d600696f9054ad42ced6d372cdf6499cc6df1754579d77a7dc02b8697cf8f09e63f1ffd559ae93516f51af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
ed20ff555842013cefe1f5588d0efeda

SHA1
2b63cbe87f542627e00922843db568a3b83d0f7c

SHA256
a0c33058f5aed576d64245554a3eff458cf0af96a2f7a751911f16c1008b3431

SHA512
f4ca35bb014c4ff644ffb8ca2619af9442fedeab59ad5caba79302e44616aa526b77032df741f52e359a728b35d7f2c626576f782360900a786634939c11d2b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
33f01c4453c527d2e23996d8b0b542ac

SHA1
40bcde5ec942c05502e58e660dd12201d4639e86

SHA256
19cef6056cebadfd5c4d16ca895fcc7298d35f0650c7729643854162372d5fe8

SHA512
6067ce4d07b37231929d9f0992c73b1da753eaa8e13ec483d85c86e5609773b9e7b2fb2e5dc4363431dba002c07ff7aada7fa4eaf915dc98930596215ba3abb4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
14cae2c8122e386f566d564e3b72af59

SHA1
ed95f4ed9833dc5878508cae97bf9fa345205d44

SHA256
b7f995bb6fe5beb03315a9a064185608128ce2758e20f6ac17025bdb817bece7

SHA512
e1e43104eddc3e70c52efec8b84d6df9d5f266aa4395832f55b6b7bd28ea7ba250ef70bd71f1dbc9ff78a8183aec902760aad5c572223bff464d2ad6db0dca76

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4

Filesize
913B

MD5
88e7a18e78b0c40a178e1b1d9b9652b2

SHA1
6f92e873cc206338094f588a38a7bc0c756362f0

SHA256
8153df1f8ccacf058e1758434d7013f577959b877a8b228d9d13ab7126ed3610

SHA512
cc8d5162ef5231e8ecc9d391ed75d42bfd7225e735e5a5565556b63a8a7b1f86b1f22319b31d210e7eed9aa67f12df252890547ef0fc64605e61b07626cd3fb4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
0a22efeff7f7c31373fcfa04da02663e

SHA1
eddaf6ba985e405f20da48301f3828b5185bff12

SHA256
a3cd967f40f5cdede5bbe5954273b8d78e7b16e8a07de693cb1c510a58efed7f

SHA512
b14dcbbc0407ae31fde7178401c9c8e93c4332c2a2c600f4a7bf7c5a3727a457ba1334caa455d76c0ce94ae99af0c846923db0a90cee5e788f8b68db8598673b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
7785fd513d608a6a70ea54ed53bb03ed

SHA1
a7a92911f94719e3425313d43ffa4c35b497d36c

SHA256
5c014a3de09e854706d7ad1a7ca69ee0e0166faf8c7abb3e53d1853e8eb9bd01

SHA512
ff7f3f64a83633ab6fe7cdd3a1bf4c5e13d8c00d6490a280f5dffe0705f478bce19b4e677e77b7a7ce819fd2b1e21db69d214346e88a3839148a0aa9ed9e7ce0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
511B

MD5
15aa71470abb8b9a6ac6c750cf6e4302

SHA1
6c613572d732082ac2cf9b0ac0b877b5392dc1f9

SHA256
32f773dd2fbfb5df66294ecd40cc3fef50bb6dfea166aaacf394d5b24a8a27b1

SHA512
0b43d5087ac3fdf13cf5d0f0aefb0a3f75492d902aad0b6abacc1cad2e5395681280268560709c1069643464466070f5b9b59675a557d5fc29415f561cefeb2e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State~RFe58d4ef.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
675fc828a4946d27287958be86fda4a0

SHA1
1c44fc1f4e0dbb4c08b1f8f8d6879ec82746db6c

SHA256
8c1d5b8ac7bc1598f6e63b90fad60eb234acdaf46e292f605c880d515faa290d

SHA512
0cec18259be451ed1e676ab54abfdbdc34fe2d8637724b23dfcbfda832287f82dabd9d1acac81b7d84204343625ddf80d1f4ead344e14790241feb9ca7673d9a

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
bbda9a6665334b37ae1520dcdbc3ec5b

SHA1
96f90d107655ddd27f95118796ac0e212883bd2c

SHA256
bab09a5de0d3a42ba277d44d85470f91efaf9ffe425b9833f6675ebdae6b1ee4

SHA512
316d79a565b11782c09ca6e5f1203a82b6300f3a433d38775d31616dfca599cf678521be4f9eaefa90ab9bd0d974c38a942f7ab38c60f923fe6d639652c430f3

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d7c40a543480fc2873e974c8adb22cac

SHA1
d56993e1d88133f0e12f168ac6bcfe073da2953d

SHA256
95ab419921ed9c70c51d55e7e63223c110595a0a9447fdde74526b46895b77c1

SHA512
4b5a2c458ed0e92cd5c007c12b64651de8fb47607c9fc5f54fa280840e9fbb74b3c584aee16027b96fcd36f0cdeeb6d063a0650c444bc9b5922f3fb8e03182c5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
28119fb84e2a35c617501fee1741e784

SHA1
7d2a5ef789e73deb2e42ba2f1511262817b007ee

SHA256
84fe2b2edaa4ffb8bf21e5b88bc8a5df09e7b7378efc7e9c83c2c35329f67376

SHA512
7f79d44fa2c1b983f3e80cad6baad3c824c5c8fa569bdef39f339cc71e0738fe3e090792e0d83c178413386c135f097f07069aae921052c6825f1ff04dee6d39

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
56e81587f18bf245ef002318420b2572

SHA1
dbeb8a9928bfb8b05a635dee1b3950b70eab9f29

SHA256
714ef40d6ab6316e854aa4bb28d48dac8db3f7870bb5739efa4d4d89a65fd58d

SHA512
662f92b110840f5b4ab9bfb7b956121c7ee085329574e079ba99a94073e0c85818fd7ec551f86857ca3ab7bb07884816b5acb2daf4ee6c245f0f38dfa09210b0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6acf2f160500f1c956b31243dd2b2c85

SHA1
ff7f9499fa96444845234cccfec837c230e61d98

SHA256
7beeb84148f357d036b665943fe6769212b9c3aa12b945ab379687035cc03a23

SHA512
5e186da4a70ed79ab6d3a87ed6eab919609ad6a0f4a1681fdfee96907ebbde9c47c20618445de361388d98ede37464e0549ea93327ae5d703cfbf250b167b1b2

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57cfd3.TMP

Filesize
2KB

MD5
c53d6ff8baa896ac878b3af4f370bc40

SHA1
b559ef74608520c25cb023f080e12d5625fdfb40

SHA256
d50033f4213d050407e6474babc39450a25614b482ec881f9e1917616f8fadd9

SHA512
3a7dec5a3f65b1f564f24cbdd3ee50c31b683b60c3e482a2960d5e42d0ce6a68eb7d29d19c937e28989341abe474550c6929de5d7d0f7c2bf2242b4b2a15a605

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3640_785258175\Icons\128.png

Filesize
1KB

MD5
6aea2921a6305cf1942f9260e1db6f5b

SHA1
dd3fe876dc860e7aa4a931bc2e1eb8013788de57

SHA256
89337b497089c0fea3a2770ed9361578031734ba384085596de3010c35b37f37

SHA512
45f69b92378afb4c0507518aa0607a82b8289584a6f04ffaa27b853b6c0ece1ab77729ce54f530025012725be43884f4fe497fbecd18c4bb27b39a793164da3d

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\b0be6eab-d778-4fdf-bb0e-06ee05baa4b2.tmp

Filesize
10KB

MD5
38acc7b114644d67ee61ded704cb71c2

SHA1
4d05862d6512f3452b6ea0c938a500bfe3d8736f

SHA256
cfe193ec02195c194ee0e9da9d968a978f3745796c5abf478569722972e5c476

SHA512
d2ade66311cbd3c36b5f0262786a41d8ee9e95eac4fde191eb59d3b9c7817eae37bc2a5999cf4c5dadbe3ab93f1eee70677ae4e2e32f5d95ae2261342ee6d51c

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\fd2f1479-0870-4d73-b854-430a47efdd11.tmp

Filesize
193KB

MD5
ef36a84ad2bc23f79d171c604b56de29

SHA1
38d6569cd30d096140e752db5d98d53cf304a8fc

SHA256
e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

SHA512
dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Local State

Filesize
144KB

MD5
1f015c3760da5bcc39995ce442127544

SHA1
f3f5b013526b4b5c5d204413db8026f853c864e5

SHA256
d5611d2b02c3c3b6475ab9ec3df2a83b0bed493bd15cc5872c4221ca14d5a980

SHA512
8c9f2a941ecf60fb6f8ce9eaf7ede42785364dce09d8e95379453ba59f6850e25c580de3dbb94fb6036f83bd19f1f7f8ff2d5dbb162978a2833eeeb68bded2a5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Local State

Filesize
144KB

MD5
e2e2bb87ed02708dea997e7ea639d9dc

SHA1
61507742e6e8571b17d3572d0a536851d073e2f1

SHA256
ad68b2b1ec2f6b63f8b4dce015e6df65967c21a45ea9db81c03ef2112e3a8869

SHA512
83894b9b6d9fb4d14d83a251757297d89644af313422fc21de151982d6c977ebeab5ae19374790b70ff3ff7e1ed5128ef02b854b06d3bd43549332cfa363fecd

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Local State

Filesize
144KB

MD5
a1a60f966d10d5449a9f3255c2aca983

SHA1
928e5fd9bd290f658b3156cd0e846acd18b4e22f

SHA256
31b2c43bf72f2a28930649d5c68d5daadb9d89c079d3907975bf06706eb63d8e

SHA512
07d7e2350030638fecfa97cf87744d50392afc01ef5a916b8edd35bc1a218a205c317e02ff37abb008d42dd18c1c81fb46a77a40a11248a723502361684c8446

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Local State~RFe57ce0e.TMP

Filesize
993B

MD5
6fd5350e4ba9fa82c3d2c996a8bdf8d6

SHA1
d3e1d9cb8caa98f489e0a4fa58aa125714eccceb

SHA256
4a4858c7e72f1431d2eab800a8c8a23df3a6fe6bcf41403947022ebe6e9f9163

SHA512
13c600b9616bd99e7db226d789fc4b98f54b9a515b1fdfa08bbeb2ae485f9982164c0e05f6012250f02cf6b96ac28f52b4375015b0f4702756a8efba67802f44

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
92KB

MD5
323e66e4b58cb4579908a37a95868dca

SHA1
3ad4d34df62805a0cd93b83018714ee1e9260e4c

SHA256
dfc93ec590c32827cd687739b4fd5e2ea9d315b448174ed11f55fa068d7d7051

SHA512
3e2d6827678f0c041fbe9df6aacf93c089863178eec5b5f3dfecdb581b63fb2af75dfb59ea9c5b7fcaad0f36416b061ba11b8472d644ddadf4162fcd80de20cd

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe588671.TMP

Filesize
90KB

MD5
025180e82049d735eadc0baadc76e0e2

SHA1
fb4b3ff84c73e4fc10dd5408e2ecaf37b2893a0b

SHA256
d4fff19a31f57b896db4b785ec269c1c7d72ae0a689b0a822d369158fc622dc7

SHA512
b6a68fa6f9b0f78c9ab0b77b7e282bae0f52a9d9b748b7a170461fd984c8f3426471a47e64c91a95cf676c95640bdd5c6759e577387d1d199ea1276afc76cbf4

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat

Filesize
40B

MD5
3c0179fc8709b8042a14ca27c6efd4e6

SHA1
c2fb34ca1ec51dfae7d15e3705db6ea4bb3ae17d

SHA256
d1c53266a59c9ddfefe45576a3ab9a397469fb7ef2d638a388f86420ccff68a3

SHA512
0c5112a6b4f578790f398e8bbed80e0a6b4ecbeca1decbdedeb1bc662e230ce314e2d89b494eb76498a61b1eaf18dc19ca6adc94d42f45db0f4ff68bfc0e3ff1

Download Submit
C:\Windows\TEMP\chrome_installer.log

Filesize
1KB

MD5
0c9cca086cd08c69a58f38c465de0d59

SHA1
70eae3dfbd470585ecde93d88a1f2670c9c45edf

SHA256
474297eac012b84069428093c0efa2a98a812a531e6fb4e506e460f8f087813f

SHA512
4593817ca2489f490715edaae95d760b3a97c4767fa835c275a21ebd9283c64a63ff0cb0e2673ad9e700a84908f0ea35646795610c3c2fad5e483dab02b791fb

Download Submit
C:\Windows\Temp\3e95f89b-0f44-4f1d-a924-c4d4c3d16346.tmp

Filesize
88KB

MD5
2cc86b681f2cd1d9f095584fd3153a61

SHA1
2a0ac7262fb88908a453bc125c5c3fc72b8d490e

SHA256
d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c

SHA512
14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
4e4228d544a17722b629de3a5828e683

SHA1
697dbe2c2ebc40628cfcd176c3fe0d296c0cb56c

SHA256
d4af695c09c0f9d0c69637abd5e17e85ba22e9d7296563e7bbb5b9f8f646aa9c

SHA512
09bd62ff88a622c00b24f77fdb049adafbc3c6eebad961e8f261276656a3f1f5250b15a9c3bfd7ea148490bdc8f29baff6788fcb88fa3d31467acc6b1eff9fa9

Download Submit
\??\pipe\crashpad_3640_LUHOJJBTIVTIIPMQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\AMMYY\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
memory/524-712-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/524-916-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/524-907-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/524-728-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/524-693-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/524-673-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/524-582-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download