Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240729-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240729-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/07/2024, 01:58

General

  • Target

    7886c7f2eb19e688c8ab3382e4cb3ceb39d63a7dc8b920f7e0d29a628cc9b4bd.exe

  • Size

    1.8MB

  • MD5

    62784b54dca4829a61e16d31b8e30f87

  • SHA1

    2323b4b01ea18b4478ecb41309e24d64ad52746d

  • SHA256

    7886c7f2eb19e688c8ab3382e4cb3ceb39d63a7dc8b920f7e0d29a628cc9b4bd

  • SHA512

    7e06144259680af23fabb3c225daaccaf930a7313ca3ccf9639addd119acf13a41b23c764be08259a1643077475d8edc51e08e46a699a75f61fc2ff07d2e56a3

  • SSDEEP

    49152:tP1Dp0xtpy4XriZY20Tf7b7X34fYXmag9kUVVo:Z0vI4X2ZY20Tzb7XIf2GHo

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7886c7f2eb19e688c8ab3382e4cb3ceb39d63a7dc8b920f7e0d29a628cc9b4bd.exe
    "C:\Users\Admin\AppData\Local\Temp\7886c7f2eb19e688c8ab3382e4cb3ceb39d63a7dc8b920f7e0d29a628cc9b4bd.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:968
      • C:\Users\Admin\AppData\Local\Temp\1000020001\8f2a5e842a.exe
        "C:\Users\Admin\AppData\Local\Temp\1000020001\8f2a5e842a.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1656
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\97EA.tmp\97EB.tmp\97EC.bat C:\Users\Admin\AppData\Local\Temp\1000020001\8f2a5e842a.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4952
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
            5⤵
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1392
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff97817cc40,0x7ff97817cc4c,0x7ff97817cc58
              6⤵
                PID:452
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,7200707079515624684,15052968995898533546,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=1768 /prefetch:2
                6⤵
                  PID:916
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,7200707079515624684,15052968995898533546,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=2156 /prefetch:3
                  6⤵
                    PID:1384
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,7200707079515624684,15052968995898533546,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=2548 /prefetch:8
                    6⤵
                      PID:2288
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,7200707079515624684,15052968995898533546,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=3148 /prefetch:1
                      6⤵
                        PID:1840
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,7200707079515624684,15052968995898533546,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=3352 /prefetch:1
                        6⤵
                          PID:1188
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4528,i,7200707079515624684,15052968995898533546,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=4484 /prefetch:8
                          6⤵
                            PID:5984
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4720,i,7200707079515624684,15052968995898533546,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=4756 /prefetch:8
                            6⤵
                              PID:6076
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4540,i,7200707079515624684,15052968995898533546,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=4612 /prefetch:3
                              6⤵
                                PID:5496
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4484,i,7200707079515624684,15052968995898533546,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=4608 /prefetch:8
                                6⤵
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5596
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                              5⤵
                              • Enumerates system info in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of WriteProcessMemory
                              PID:1020
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff977f646f8,0x7ff977f64708,0x7ff977f64718
                                6⤵
                                  PID:2104
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,16648679025447520164,8043120150662749969,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
                                  6⤵
                                    PID:4008
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,16648679025447520164,8043120150662749969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1164
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,16648679025447520164,8043120150662749969,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
                                    6⤵
                                      PID:4664
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16648679025447520164,8043120150662749969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
                                      6⤵
                                        PID:1920
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16648679025447520164,8043120150662749969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                                        6⤵
                                          PID:4852
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16648679025447520164,8043120150662749969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
                                          6⤵
                                            PID:1108
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,16648679025447520164,8043120150662749969,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4040 /prefetch:2
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5452
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                          5⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3112
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                            6⤵
                                            • Checks processor information in registry
                                            • Modifies registry class
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:3284
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc25dbd7-55b4-43e9-a70e-21347bb2448a} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" gpu
                                              7⤵
                                                PID:4544
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8eb77e19-c1da-42e9-bf41-ac1ed22557f4} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" socket
                                                7⤵
                                                  PID:4920
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3292 -childID 1 -isForBrowser -prefsHandle 3164 -prefMapHandle 3160 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abf57007-a137-47cb-80c7-6fc32aa9909c} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" tab
                                                  7⤵
                                                    PID:4504
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3596 -childID 2 -isForBrowser -prefsHandle 3184 -prefMapHandle 3200 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {204a2a80-61f9-466d-9449-943bbd1a09c9} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" tab
                                                    7⤵
                                                      PID:5828
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3104 -childID 3 -isForBrowser -prefsHandle 3700 -prefMapHandle 3696 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36631559-19f8-41f7-8b25-9574d1408c80} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" tab
                                                      7⤵
                                                        PID:5840
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 4 -isForBrowser -prefsHandle 3832 -prefMapHandle 3836 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2041c27-6146-455f-be3a-e1827631005d} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" tab
                                                        7⤵
                                                          PID:5852
                                                • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
                                                  3⤵
                                                    PID:5748
                                                  • C:\Users\Admin\1000029002\eced6470e9.exe
                                                    "C:\Users\Admin\1000029002\eced6470e9.exe"
                                                    3⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5300
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\RoamingCFIEGDAEHI.exe"
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5564
                                                      • C:\Users\Admin\AppData\RoamingCFIEGDAEHI.exe
                                                        "C:\Users\Admin\AppData\RoamingCFIEGDAEHI.exe"
                                                        5⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1184
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 2408
                                                      4⤵
                                                      • Program crash
                                                      PID:6092
                                                  • C:\Users\Admin\AppData\Local\Temp\1000030001\046d7fb279.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\1000030001\046d7fb279.exe"
                                                    3⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:5740
                                                    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
                                                      4⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5984
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:4512
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:392
                                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                                    1⤵
                                                      PID:5160
                                                    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5560
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:5180
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5300 -ip 5300
                                                        1⤵
                                                          PID:5848
                                                        • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                          C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                          1⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4852
                                                        • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                          C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                          1⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3328

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\ProgramData\FCFBAKJDBKJJKFIDBGHC

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          9daa397b74dd45738cfe3fb0fe84991c

                                                          SHA1

                                                          03dc969a4dc7bfa382702aa34dce78cb47796f34

                                                          SHA256

                                                          83e155a2edd56bdf084b7fb635cdb0bd5ff1bf3b2d4954fb51b9adf4513d4180

                                                          SHA512

                                                          fa5ebef4818e3ff6844f836c7a20b82ea3727d7f6e135164f8e0430d9bc0afff4f24e1243462c879363c1ce41f7fd833895ed9a66dda363decafb261d9e1a0ed

                                                        • C:\ProgramData\mozglue.dll

                                                          Filesize

                                                          593KB

                                                          MD5

                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                          SHA1

                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                          SHA256

                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                          SHA512

                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                        • C:\ProgramData\nss3.dll

                                                          Filesize

                                                          2.0MB

                                                          MD5

                                                          1cc453cdf74f31e4d913ff9c10acdde2

                                                          SHA1

                                                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                          SHA256

                                                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                          SHA512

                                                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                        • C:\Users\Admin\1000029002\eced6470e9.exe

                                                          Filesize

                                                          2.5MB

                                                          MD5

                                                          a9656876f5827e7fe9d3c51fd293fcae

                                                          SHA1

                                                          c85b66a9d296e82a3792125dc07d50df2cf36d4e

                                                          SHA256

                                                          556070b2b114cf521989bed70ebf42b47bcb31ac5357c4813f1ffc7bfab66a18

                                                          SHA512

                                                          233f291b30a72ada032ea579ff3facbcc7db413a10b69d32b6e7990b784cc7d3da83c433c1af5aeb60e89c3e8f669b4bd10fb475391497b3cd904bab3735dddd

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

                                                          Filesize

                                                          44KB

                                                          MD5

                                                          edd91769a51af242e0dfb237f35703b4

                                                          SHA1

                                                          ff2dda85a2cec289fe2370c81c9f22408bdc6c4c

                                                          SHA256

                                                          a5a3c9e7508d6cc600657ee800fe6dfa0c174f9d8feceb8f3a2b16149422955a

                                                          SHA512

                                                          75ad7acb563306fb4c74d811b71161b992d03cfb2c592711446378d0642604a5d829c746945bbe44e02361029042425eb9865921ec360ba5c4c36db6206cfff9

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

                                                          Filesize

                                                          264KB

                                                          MD5

                                                          3dea0552b9d3fcfa78a33f9e5576dec7

                                                          SHA1

                                                          1c4d6bb6e0339e95acb3b90825e37419aeb75c5b

                                                          SHA256

                                                          558385bec4f7ec89895cb4e0588edd8d01eaab15a48b9137dfe5f6c15743ace2

                                                          SHA512

                                                          16a97518f81873166e61663a97344e821da7c2c113fc7c4c8c35e28a6f0470f1bdb79a6f93bd138d587884fb668f702382d1484ecea48c7220b524fe6f530d35

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

                                                          Filesize

                                                          1.0MB

                                                          MD5

                                                          bf7601c66d1ec739fa324b1ce8f3cc27

                                                          SHA1

                                                          0c37f1eaf7b38b3503e844d818009f0a1c4e704b

                                                          SHA256

                                                          0c7f75886d5361cc961c479523e098014f04662f25a6a005d1a4173b9d4b3d94

                                                          SHA512

                                                          1e531c65045729f53bfb0a8de4dde4ddfd2b47537592c017ad5d63202a82e6aa81ea6ccb305413e505ec89e3fc14c772d84b0700fa7617cc804a251c5bb03662

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

                                                          Filesize

                                                          4.0MB

                                                          MD5

                                                          079d4354acc6f394cbb621df8d4f866d

                                                          SHA1

                                                          f9919952f33faa3335fa0013c3e3978312825960

                                                          SHA256

                                                          692c5e9240028f15fb4b15a97c4c3a0a6af0b6118240f4f1b29c6c7b9697d415

                                                          SHA512

                                                          679a41c798b2848dfd9d6802446b9cda03e149b901eae160c035b9cf8417165baabcbaeae8116037e27ba06f73742d65d543a064621d7ed8de04758e17790224

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                                          Filesize

                                                          68KB

                                                          MD5

                                                          fbf0911ebe4f2e508ac2ed235d00e55e

                                                          SHA1

                                                          bc4c28796a860bfd36c99e64b495682518f86896

                                                          SHA256

                                                          60a59803330f9e762c90793daf5ea396085b794d2f51ed1a730a838a4ad49767

                                                          SHA512

                                                          72f39b423285cec8f462995459c05a9a30e408652f72f06477ddef0f504c06d6cf8a0336cf0ac0984b9cbee85e611eb1c785d9e75dfe6b961c880bc943a8de1e

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

                                                          Filesize

                                                          51KB

                                                          MD5

                                                          f61f0d4d0f968d5bba39a84c76277e1a

                                                          SHA1

                                                          aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

                                                          SHA256

                                                          57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

                                                          SHA512

                                                          6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

                                                          Filesize

                                                          85KB

                                                          MD5

                                                          533028bc88b8c919df8015a5530b2619

                                                          SHA1

                                                          d0525738835505ff9d73ba26e3f7d3fe67805221

                                                          SHA256

                                                          174bc924860e66e957fce675f42e342f3ea8c16daa14854d4a33cdaf592fbbe9

                                                          SHA512

                                                          3a51ad22fc22beb0e7ccb8ee000c9ab4146e81f91791c59e6134572ba51ec543382bd3f17456ee9aec3ecefecb11f3dfd41ae2660ae3b06723f135f4ccfb23bc

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

                                                          Filesize

                                                          33KB

                                                          MD5

                                                          daa6948a37ac312342600f2b96db15ea

                                                          SHA1

                                                          0bfa2e04bf51480baf1fc7e7819f65cd3b0c90ba

                                                          SHA256

                                                          de7cf820e8eb0aa51d82aff3a848fd853dfa878674cc67094aee0ac115c85fee

                                                          SHA512

                                                          5af3ceb0a4c56b767792ad349b83a179191d9fe6dca8e3795cb48edb87ae6a8b89e51a64ebedd68857c674befd71dc1664a2e8380ac21abacc9566329d8c2e14

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                                                          Filesize

                                                          38KB

                                                          MD5

                                                          a1cbc8600fb0e0b668df61bb5d1737f9

                                                          SHA1

                                                          65aaea9cf40ee7aafcf033f35980aac172b0a267

                                                          SHA256

                                                          b0324009cc7d496245d763710959284dbc9eb3c4aa93227cd6fa82772ff5a2bb

                                                          SHA512

                                                          c731cbc3fd2397fea0afdb98ad7e0a2624dfdd9da00da2032cbb425ff653291bd3e9290514d6aac2761923a055c0666b521a61524595c5ab1aa2b56ce18b2338

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          264B

                                                          MD5

                                                          4f2c8b2aab4b434c5a774dc08e790da6

                                                          SHA1

                                                          5d92d69d6a887cccb39d8c5b4fb98fe812a580b5

                                                          SHA256

                                                          ef3b1da0791c11c52a33ecea83e2c8da2a089bacd1224b30e762dfcc6ebf9fa5

                                                          SHA512

                                                          a37d14b6a6381a19ef2e612cb3a15de7e5a4908951024e058be332b7ee3bd1337ceced93c6eaac74c2a421006140598e2eb6cdddced2c4ba435bb7ff3f3ab34d

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

                                                          Filesize

                                                          160KB

                                                          MD5

                                                          1bd0a7247133b4fe84acebf77363d02b

                                                          SHA1

                                                          3014004eb99f3774a1bc21c29eff628b3ba8c6bd

                                                          SHA256

                                                          5c613bb5eff871072db807c2e00a6101344043a0edf911bc9112b1e0c2ab3600

                                                          SHA512

                                                          fadbc35d7f259ca7c14a7974b2b70a0aa345c685f85c500246bd4f5feebd045f9fc61cf64749435ad86226bbf53bb9b9e84673dfdc6e0a20acc0f0006a29f92f

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          4a1513d36fc4d766923d50870143ebe1

                                                          SHA1

                                                          f66a3e6627e9adc1b49d76b5da8145e311ca9ff3

                                                          SHA256

                                                          3b33e7e051dedd13deca629cd077a274539f4abc692ecd32f6e45baeb93db168

                                                          SHA512

                                                          86ca0c574850db4c31caa29ecfc1fa5c228ed4397582d454517211138d772f07178872d204533681ef1588b241bcb5e459397c7796ba040a9b51edd4d7974e0a

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                          Filesize

                                                          2B

                                                          MD5

                                                          d751713988987e9331980363e24189ce

                                                          SHA1

                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                          SHA256

                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                          SHA512

                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                          Filesize

                                                          524B

                                                          MD5

                                                          c97e7c831420c34c8f664e2ca261eadd

                                                          SHA1

                                                          ef727e138a401bb48bde549baac92f7ad38ba9a8

                                                          SHA256

                                                          a6f9de4640634bfe109636cbd2fe1688b7439ef3b48f28752c54163600a21164

                                                          SHA512

                                                          8595d35295e59b914102474e62cce86d77f4d1f8126daf078aea3ed94dee13b6f374b5d8f987dbd664d2f65b24464684b4e0b7d4eceefde110ae5d40ae6282ff

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          8273187b2b29175ba568b925f7da72e6

                                                          SHA1

                                                          59f440bd2389d1faeb0cd8c9ff96cc07eff616bf

                                                          SHA256

                                                          7442043ebae66dbd480a98e78504910b43da5967ddc86015cc62e784f15f82ba

                                                          SHA512

                                                          9f63413fba03106a4bba3a783c39c6705a98a73e8eb9ca0688e0bdada71a7daf9da1c5a76ea3daa64304e2688c6c182280eb11e222addbc3249169c2b01ecebd

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          7cf5f4a9b140a190e695fb44ea9742bc

                                                          SHA1

                                                          8d646a8a87aa6e4931b764421db3566495361381

                                                          SHA256

                                                          d4261d0fe7e6817e517cc6013b95cbe86fe92830292274c3534fc5ad65f7dfe9

                                                          SHA512

                                                          dfba740ea1b3d0927340bc6752a9c1d5d44d7e7fdd2b4d311871c4e62a3aa0292701e7206503c2701c6f9d451a475697d5b34bfb927ab514baf79f74bf875299

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          c36f7379b6662882136f6eb5b7ce1190

                                                          SHA1

                                                          6ff36e0a4ce770e140a56fd93ebae595031a3ff2

                                                          SHA256

                                                          d86d8a9aebb0481f5e843030013fc71061c5598025760ed7629c92114253ef7c

                                                          SHA512

                                                          3d277c319a3b974502d56a2ab7ebc16b7dcf09fe50f2dbbeb2fb9254ff219b5eff23c5fc84fc3202cc1b0237189fc01f8e08ae00edaf04889ab3e4a0700669ec

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          4cec6ff33ca8798dd3d3cf67dd1e1832

                                                          SHA1

                                                          37371cccce0a3f2784b50caf7f79c19774a5638b

                                                          SHA256

                                                          3e6f403aeafe8131c2fa8520e4b7bc10784f9ecb5404aabab68b7a1f65577fad

                                                          SHA512

                                                          e3667b943153568a01cbc465210ff53f737359cb8df48791f311311807e0f534ee24d0bf7dfc90d6e982ab57513d4cd4be4ce8691270e58487ca2aef273c06ba

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          a613f8569aea95a1ba5e6f28e78b3bf4

                                                          SHA1

                                                          1b0cb1a55d9baeed4deb2827efa0f5a43e5b3226

                                                          SHA256

                                                          5c8ab0d08f724ca3b98554d8b4dacf0de3afd9b71741918f292f18980568231a

                                                          SHA512

                                                          0eb6b83d369c5f2ae4438ffefbe70fb76fb517c188173dbd4b41ad4e2c80c4ec6167bdbaa55da826d9b147b8a62faa544196645eaa6fc58c635092ead6a04e8d

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          c965707b512de165d8e76a85bf317b18

                                                          SHA1

                                                          00160d88a943bd095f90ae0bc00ca141d0bae4c1

                                                          SHA256

                                                          395b18d43db67817b24ccccf8b62eaf19a3591354d5814c957ab76a9d4fc58fc

                                                          SHA512

                                                          cb99bdb58011a25f074ae8dc1dd1ad3a7bc51b03a80322f4ecbfc72a5d494cfd7abda5d04c2c5919a8783e962c20d3716a7c29ae4b5cfecaabeaf5920a3b8fe6

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          4ec79fd4f3a469c5b65c2f8696c652dd

                                                          SHA1

                                                          9f9bd34cdb14894865f456e50ac084cab94171ba

                                                          SHA256

                                                          306eb852bfa1a247c8cf9a593bdfe5a09934d9ca265483f788f160dbbdbfb1c1

                                                          SHA512

                                                          a48453c85032591d304b7e66320c42be75390e733b82793a560bcfad46e49a46d525891f1576687ac7e8d489d1e01611449382649eab9f6ff6fb8f9b641aada0

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          a45db80faa461703e0b5c596ed3a0aaf

                                                          SHA1

                                                          a3828eba97113ed07302a192fae603bfafe80077

                                                          SHA256

                                                          7106c360540a1d2523cd22b7fbee959f0a5eefdee54ec33f65a8f546672a84bd

                                                          SHA512

                                                          617c96e540e1acad626d2f53d033f1014c8c86ad341e9778aeef1448a9ec0f9a771c07cfc0cf00cab3b7f657cde32c93d039a94a04bd1f604e4ddf6b735f7225

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          18d913a93ed5acd19dc6e929a1051efe

                                                          SHA1

                                                          7688fcdfbbd2f029cba168fcc5ac2a4bb96c4008

                                                          SHA256

                                                          57cfee56850e27f780582604819a6ca85b04fe1b81eab6d67bbc919f22daea3c

                                                          SHA512

                                                          be45a225aa6f37a5fd59d2bddde5befb67df5390249a6cb1f7a541e0927470bc62e8b1f60be545405e1aa2b51db4b1cdbea2f0c01f97604e8a0f2195fb5916b5

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                          Filesize

                                                          197KB

                                                          MD5

                                                          d0814b563a75495c08dd665251ddcb98

                                                          SHA1

                                                          78405de8f754dfd275aa2b8194d87754fac70269

                                                          SHA256

                                                          389775e8b793ed33a7c8e907d5bd0765363eff2d321f366af7b37f269c0f1a35

                                                          SHA512

                                                          8220218322766f0e2a625617811bceffb66272d5fc48287b7852841f8a8a617e98fb108ee0f9eddecf542ae3e577675cd7b0a0fd3ca169a1174ed25fcb396394

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                          Filesize

                                                          197KB

                                                          MD5

                                                          e78cac4940bf27cccd2215358309787a

                                                          SHA1

                                                          929a2b2f6256e5f7d56243b9481be21a03db162f

                                                          SHA256

                                                          eab9acadb478ce44f9a04fe5118bfd3a640652757f2bf37970e761a7d6ced0ac

                                                          SHA512

                                                          5d81240461adf187ce01dea5c35c0a224375052afe01797b7e868dde1592d47935d8c779a0b02665b024efa4f58b036ea913a54ae6e12a63e86045cf516327f6

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          368c244e384ff4d49f8c2e7b8bea96d2

                                                          SHA1

                                                          69ce5a9daeaf1e26bba509f9569dc68b9a455c51

                                                          SHA256

                                                          6f8cb8fe96a0e80be05e02f0f504e40d20e7f5db23fd0edee0e56bcffa1059a3

                                                          SHA512

                                                          ac460f1b35bcdefa89104e26379fc5639499607be6559353665a73ee8dd41822699d767532d48cffc67c755b75042294c29e93062d4eab22ca6bcbe054108a5c

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          8004d5759305b326cebfa4d67dee5f25

                                                          SHA1

                                                          36b9a94959977f79dd0a14380ba0516d09f8fcaa

                                                          SHA256

                                                          21f35e2ac53a817389d7027e99018450993fc66e37f916e454bff9eed95562d7

                                                          SHA512

                                                          7afba827395c1a5438091bd2762a097f6ea098fcbf3db99f90f9bc442afee7a7841a6e0e83f9cbf017cda0e52d35da93f8efd60cec73638baea5eaf1c85b7089

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          240B

                                                          MD5

                                                          87880fd076d270d1ea870d5d2dc03746

                                                          SHA1

                                                          9e9a3faad63d30ae8ccd9c33055d49c357f88e96

                                                          SHA256

                                                          4a79f68d94ca46109111d992b6833d9f429120ce65b39df70c00ddbed56ffeb1

                                                          SHA512

                                                          f068e5ce62b2772f4c0cdd2757bbb13ce34527acadadd8d96f2295c81124d2eeda8b493640ab2c78375027eed63299b9d7d22b6517606f438f98135a69e949b1

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                          Filesize

                                                          124KB

                                                          MD5

                                                          7d197b63ef0e8dd866003bd13fb1cbba

                                                          SHA1

                                                          9d4114ed402a56256f8367d550b9a4075c5c0427

                                                          SHA256

                                                          a118e7c82be9163db31ce1fb63ef0c1284a24dc799f5451153e38d47127cd283

                                                          SHA512

                                                          c85969e4076bb871d56d3c4d2945acbdfff996b4cdb1f65c87f93f4954fe3792a4d226c92641fee79a552e2480bd495d7843995644143bceb3268f32496b2f1d

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          b40ca8c835b9fd4694c864ebe9bef1ce

                                                          SHA1

                                                          1b34a85057b3274c0a733dfc7b0b6fccd20465e4

                                                          SHA256

                                                          6e6eccce61d3cea1b0c0e9b42f867783129179f8cad140e9200df3334cd1878a

                                                          SHA512

                                                          e2b78155becbe998ce100894a75292135ec5df368792e254518aa4983fa9aa72ba7a0fd30836aa6acfb0cb9a80e5654a3bd66828537f084420de475d940734eb

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          f7269d837d3a3a522d258a149a6a67c7

                                                          SHA1

                                                          d17c12a508da25a6281a0e238bfac01340bcb84f

                                                          SHA256

                                                          71367f17fe449cff5e771f8ad0008192e44de39c0ecca7f4890769a661f1c0ce

                                                          SHA512

                                                          1e45397dbcb53df51f0cc9a87bef7701be390be3a707ed44e2587b52e884605c7046ac112b87772069a937993f7cc0cf6b1eab3f9dda66640a7b2db9258daf7a

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          76dee78b54351df0d83ac42d89479705

                                                          SHA1

                                                          54e3792903074f6af897341ad48b7f8d519751c6

                                                          SHA256

                                                          eb6c4cc032689cdbc5d5d7e1e58fb9c69e7ca34c3ada20324afbb4d55ae1df6a

                                                          SHA512

                                                          c3922563626024a0c24a34c5136b7b2679ebf585dcbff9b6f510158e4350d275c73bc6cc707cc71bbfe104032c9e0fca3193e11b18e206fd7c1370344150895d

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          9dc28dc4264e21ee5dcf649295cf9f38

                                                          SHA1

                                                          30c986debcf85667015dcd5a856ab168d106a8f5

                                                          SHA256

                                                          07f36fdb3522c617ae6e32d438ddba783afce4e7992f4976e8c130eeab4632df

                                                          SHA512

                                                          2aecdeda8bbd99352aa698b84a588d51c12ccfb631a74d30b9affd043b934daa20a71d8e2829e622bce05d2d3abe7831e863aaed717b6b41172e98de8580484e

                                                        • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          62784b54dca4829a61e16d31b8e30f87

                                                          SHA1

                                                          2323b4b01ea18b4478ecb41309e24d64ad52746d

                                                          SHA256

                                                          7886c7f2eb19e688c8ab3382e4cb3ceb39d63a7dc8b920f7e0d29a628cc9b4bd

                                                          SHA512

                                                          7e06144259680af23fabb3c225daaccaf930a7313ca3ccf9639addd119acf13a41b23c764be08259a1643077475d8edc51e08e46a699a75f61fc2ff07d2e56a3

                                                        • C:\Users\Admin\AppData\Local\Temp\1000020001\8f2a5e842a.exe

                                                          Filesize

                                                          89KB

                                                          MD5

                                                          fb384b3a9547a5a88d4c79fbbbbd9e77

                                                          SHA1

                                                          079c97bb8c11a273af4be603c9f62eb62f2e1197

                                                          SHA256

                                                          0cdaf032535980f3c5cc7eebb661608ad5713677b2d54eaac584892916598e73

                                                          SHA512

                                                          8f28a21a4ebcc9745941647e7900c884077e4abb7066b861c187ece6e5270ac5d42d77d8275aca9a6bbf95bcfa3cad8da8a831cd73fd6f3a28b8affee8fb1261

                                                        • C:\Users\Admin\AppData\Local\Temp\1000030001\046d7fb279.exe

                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          e6d4fd57bdfa0329696464bddc309084

                                                          SHA1

                                                          5ceff1d78f31ab36fb919d4caeca3e0d0aa275f7

                                                          SHA256

                                                          18f51fc7520d98dbfa8a51275600c2d9e3665f56a0aeb4d2c9c381a021f65dfc

                                                          SHA512

                                                          2817c9c5075015d53130399be4e86458f3c1536732c67cb5d173ab16891482d89b63abf56554b8a0f42a1fd72a2a417795b994611da1647fe33c3fbf95e1e622

                                                        • C:\Users\Admin\AppData\Local\Temp\97EA.tmp\97EB.tmp\97EC.bat

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          de9423d9c334ba3dba7dc874aa7dbc28

                                                          SHA1

                                                          bf38b137b8d780b3d6d62aee03c9d3f73770d638

                                                          SHA256

                                                          a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698

                                                          SHA512

                                                          63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                          Filesize

                                                          479KB

                                                          MD5

                                                          09372174e83dbbf696ee732fd2e875bb

                                                          SHA1

                                                          ba360186ba650a769f9303f48b7200fb5eaccee1

                                                          SHA256

                                                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                          SHA512

                                                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                          Filesize

                                                          13.8MB

                                                          MD5

                                                          0a8747a2ac9ac08ae9508f36c6d75692

                                                          SHA1

                                                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                          SHA256

                                                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                          SHA512

                                                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                        • C:\Users\Admin\AppData\RoamingCFIEGDAEHI.exe

                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          ca129087014137aa790a764856ff12f3

                                                          SHA1

                                                          fa852e81f6e6d99988b3d891136baf4fe35fbf1e

                                                          SHA256

                                                          6d25eab7bde08efbfe08e0136cd410dbc717b646b03ae8171f76c55ec169e9cf

                                                          SHA512

                                                          2a6837b6c2570f0fdd0e445564998e5417fff947ae35f15f18231e5e8c4dab75f2aee987e9b1c0bb1270ab9abe600b0d0be7eeab4ee395e6b4ae858ed18cfd87

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\op47hmv6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                          Filesize

                                                          1.1MB

                                                          MD5

                                                          842039753bf41fa5e11b3a1383061a87

                                                          SHA1

                                                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                          SHA256

                                                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                          SHA512

                                                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\op47hmv6.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                          Filesize

                                                          116B

                                                          MD5

                                                          2a461e9eb87fd1955cea740a3444ee7a

                                                          SHA1

                                                          b10755914c713f5a4677494dbe8a686ed458c3c5

                                                          SHA256

                                                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                          SHA512

                                                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\op47hmv6.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                          Filesize

                                                          372B

                                                          MD5

                                                          bf957ad58b55f64219ab3f793e374316

                                                          SHA1

                                                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                          SHA256

                                                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                          SHA512

                                                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\op47hmv6.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                          Filesize

                                                          17.8MB

                                                          MD5

                                                          daf7ef3acccab478aaa7d6dc1c60f865

                                                          SHA1

                                                          f8246162b97ce4a945feced27b6ea114366ff2ad

                                                          SHA256

                                                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                          SHA512

                                                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\op47hmv6.default-release\prefs-1.js

                                                          Filesize

                                                          11KB

                                                          MD5

                                                          7c86d2f42c44dcffaee0dec0bdb1a07f

                                                          SHA1

                                                          3db05e890fd98514b58b685407c1f8258b5dfa0c

                                                          SHA256

                                                          6faaea7641957813fecb674c73ed15751bf73b1a0e475b2f9f95052799f3ee5c

                                                          SHA512

                                                          a64f4f7e6ee2882531d4699be119189c17120ead312fa44c905fd57e56580d1da130644d8874814a3436c199a490f81b248fc1f7e738647200f03df975299a45

                                                        • memory/968-21-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-18-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-561-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-550-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-145-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-455-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-353-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-19-0x00000000003F1000-0x000000000041F000-memory.dmp

                                                          Filesize

                                                          184KB

                                                        • memory/968-467-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-444-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-282-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-281-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-533-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-522-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-209-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-506-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-503-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-428-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-492-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/968-20-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/1184-355-0x0000000000520000-0x00000000009CC000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/1184-354-0x0000000000520000-0x00000000009CC000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3328-547-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/3328-548-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4852-463-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4852-465-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/5056-0-0x0000000000A40000-0x0000000000F02000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/5056-4-0x0000000000A40000-0x0000000000F02000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/5056-1-0x0000000077494000-0x0000000077496000-memory.dmp

                                                          Filesize

                                                          8KB

                                                        • memory/5056-2-0x0000000000A41000-0x0000000000A6F000-memory.dmp

                                                          Filesize

                                                          184KB

                                                        • memory/5056-3-0x0000000000A40000-0x0000000000F02000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/5056-17-0x0000000000A40000-0x0000000000F02000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/5300-161-0x0000000000400000-0x00000000031E1000-memory.dmp

                                                          Filesize

                                                          45.9MB

                                                        • memory/5300-225-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                          Filesize

                                                          972KB

                                                        • memory/5300-293-0x0000000000400000-0x00000000031E1000-memory.dmp

                                                          Filesize

                                                          45.9MB

                                                        • memory/5300-356-0x0000000000400000-0x00000000031E1000-memory.dmp

                                                          Filesize

                                                          45.9MB

                                                        • memory/5560-122-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/5560-118-0x00000000003F0000-0x00000000008B2000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/5740-223-0x0000000000930000-0x0000000000DDA000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5740-210-0x0000000000930000-0x0000000000DDA000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-523-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-521-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-491-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-429-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-445-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-456-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-505-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-224-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-549-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-332-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-466-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-560-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5984-493-0x0000000000A80000-0x0000000000F2A000-memory.dmp

                                                          Filesize

                                                          4.7MB