Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/08/2024, 23:12

General

  • Target

    44b840309d763ca08dc04c62daf30cdf9b282a990ff52572591eb0c004a44b34.exe

  • Size

    1.8MB

  • MD5

    6b1be5003973052d34deb0f0b6c0ecd5

  • SHA1

    3d47ab3e4d475097982a56686ba3298982f8a225

  • SHA256

    44b840309d763ca08dc04c62daf30cdf9b282a990ff52572591eb0c004a44b34

  • SHA512

    9e2006a743a6f401c42f37f0253a105b7ef0814a5c1667dbe28a1f395f80e788afa20159132b90477d89199c4255d2b56b2a1b405ff2a1ff3c2a307a6fbd9971

  • SSDEEP

    49152:wwDx2gHYSoASYs9VCRpMGvnnonwe6smtZq:wwDx28oA+V0JvCwfsmtZ

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default

C2

http://185.215.113.24

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44b840309d763ca08dc04c62daf30cdf9b282a990ff52572591eb0c004a44b34.exe
    "C:\Users\Admin\AppData\Local\Temp\44b840309d763ca08dc04c62daf30cdf9b282a990ff52572591eb0c004a44b34.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:740
      • C:\Users\Admin\AppData\Local\Temp\1000020001\994eca61d8.exe
        "C:\Users\Admin\AppData\Local\Temp\1000020001\994eca61d8.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:932
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\73C8.tmp\73C9.tmp\73CA.bat C:\Users\Admin\AppData\Local\Temp\1000020001\994eca61d8.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1416
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
            5⤵
            • Drops file in Windows directory
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3556
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffd129acc40,0x7ffd129acc4c,0x7ffd129acc58
              6⤵
                PID:4136
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,6173577616615610988,4491393550072520738,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1832 /prefetch:2
                6⤵
                  PID:3020
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2080,i,6173577616615610988,4491393550072520738,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2096 /prefetch:3
                  6⤵
                    PID:4736
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2164,i,6173577616615610988,4491393550072520738,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2360 /prefetch:8
                    6⤵
                      PID:3836
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3040,i,6173577616615610988,4491393550072520738,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3092 /prefetch:1
                      6⤵
                        PID:5288
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,6173577616615610988,4491393550072520738,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3140 /prefetch:1
                        6⤵
                          PID:5304
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4360,i,6173577616615610988,4491393550072520738,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4400 /prefetch:8
                          6⤵
                            PID:5816
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4492,i,6173577616615610988,4491393550072520738,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4596 /prefetch:8
                            6⤵
                              PID:5820
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4404,i,6173577616615610988,4491393550072520738,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4804 /prefetch:8
                              6⤵
                                PID:5888
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4320,i,6173577616615610988,4491393550072520738,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4672 /prefetch:8
                                6⤵
                                  PID:2816
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4720,i,6173577616615610988,4491393550072520738,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4724 /prefetch:8
                                  6⤵
                                  • Drops file in System32 directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1592
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
                                5⤵
                                • Enumerates system info in registry
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of WriteProcessMemory
                                PID:1340
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffd12af3cb8,0x7ffd12af3cc8,0x7ffd12af3cd8
                                  6⤵
                                    PID:4860
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1980 /prefetch:2
                                    6⤵
                                      PID:944
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:3
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3716
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
                                      6⤵
                                        PID:5104
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
                                        6⤵
                                          PID:2296
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                                          6⤵
                                            PID:2756
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
                                            6⤵
                                              PID:5804
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
                                              6⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5424
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
                                              6⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5148
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
                                              6⤵
                                                PID:5332
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                                                6⤵
                                                  PID:5604
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
                                                  6⤵
                                                    PID:484
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
                                                    6⤵
                                                      PID:4608
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,3442057847779921608,2479885803531435014,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5064 /prefetch:2
                                                      6⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1552
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
                                                    5⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3128
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                                      6⤵
                                                      • Checks processor information in registry
                                                      • Modifies registry class
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SetWindowsHookEx
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4544
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1936 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c84a9ab2-4572-4741-8e81-8311dc5c5ef2} 4544 "\\.\pipe\gecko-crash-server-pipe.4544" gpu
                                                        7⤵
                                                          PID:2844
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2380 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed92ff6b-eb9a-4aad-b71d-d081a8023716} 4544 "\\.\pipe\gecko-crash-server-pipe.4544" socket
                                                          7⤵
                                                            PID:1084
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3408 -childID 1 -isForBrowser -prefsHandle 3224 -prefMapHandle 3220 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f014edec-a5ae-4187-92b3-a759f4715245} 4544 "\\.\pipe\gecko-crash-server-pipe.4544" tab
                                                            7⤵
                                                              PID:5460
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3324 -childID 2 -isForBrowser -prefsHandle 3336 -prefMapHandle 3212 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2889ea4-8bfb-4f99-a7aa-983d9a460fa0} 4544 "\\.\pipe\gecko-crash-server-pipe.4544" tab
                                                              7⤵
                                                                PID:5336
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2840 -childID 3 -isForBrowser -prefsHandle 2900 -prefMapHandle 3560 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09553f61-7407-4a24-a6d1-4f4a254396c8} 4544 "\\.\pipe\gecko-crash-server-pipe.4544" tab
                                                                7⤵
                                                                  PID:5348
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2864 -childID 4 -isForBrowser -prefsHandle 2828 -prefMapHandle 3120 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55515723-971a-4c45-8563-feea78f36d9b} 4544 "\\.\pipe\gecko-crash-server-pipe.4544" tab
                                                                  7⤵
                                                                    PID:5360
                                                          • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
                                                            3⤵
                                                              PID:2284
                                                            • C:\Users\Admin\1000029002\34984a63bf.exe
                                                              "C:\Users\Admin\1000029002\34984a63bf.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5964
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 1444
                                                                4⤵
                                                                • Program crash
                                                                PID:5344
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:856
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:5472
                                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                              1⤵
                                                                PID:5600
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                1⤵
                                                                  PID:6044
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5964 -ip 5964
                                                                  1⤵
                                                                    PID:1512
                                                                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                                    1⤵
                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                    • Checks BIOS information in registry
                                                                    • Executes dropped EXE
                                                                    • Identifies Wine through registry keys
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5904
                                                                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                                    1⤵
                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                    • Checks BIOS information in registry
                                                                    • Executes dropped EXE
                                                                    • Identifies Wine through registry keys
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:3040
                                                                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                                                    1⤵
                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                    • Checks BIOS information in registry
                                                                    • Executes dropped EXE
                                                                    • Identifies Wine through registry keys
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:1920

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Users\Admin\1000029002\34984a63bf.exe

                                                                    Filesize

                                                                    2.4MB

                                                                    MD5

                                                                    d14febd6f1eb07795373d3ff7bf126d3

                                                                    SHA1

                                                                    f15145a0d33d30af965a3d1d8fc5f955d80e8ca0

                                                                    SHA256

                                                                    82c53ac3817d5054c2ed6161ce399eef2cb5dd29217eb2f45e84b95cde126e91

                                                                    SHA512

                                                                    487605dde1a201c67212679db8caba0bfec1985c586f1bca35b7ed25f5c34362dba73c113d3e412bb0eb047020ad7521d6322f6172904cd789fc6646f4b31c05

                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                    Filesize

                                                                    64KB

                                                                    MD5

                                                                    b5ad5caaaee00cb8cf445427975ae66c

                                                                    SHA1

                                                                    dcde6527290a326e048f9c3a85280d3fa71e1e22

                                                                    SHA256

                                                                    b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                                                                    SHA512

                                                                    92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                    Filesize

                                                                    4B

                                                                    MD5

                                                                    f49655f856acb8884cc0ace29216f511

                                                                    SHA1

                                                                    cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                    SHA256

                                                                    7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                    SHA512

                                                                    599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                    Filesize

                                                                    1008B

                                                                    MD5

                                                                    d222b77a61527f2c177b0869e7babc24

                                                                    SHA1

                                                                    3f23acb984307a4aeba41ebbb70439c97ad1f268

                                                                    SHA256

                                                                    80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                                                                    SHA512

                                                                    d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    264B

                                                                    MD5

                                                                    e48b8e2239a761168bfc15c35e07c9cc

                                                                    SHA1

                                                                    aed67c19fe76d77db416c5c72417b833b21382e5

                                                                    SHA256

                                                                    f3944e8d881cdcf61077171992f4af3861415b4039add754995e050dc26b61c2

                                                                    SHA512

                                                                    617678208cb597fea35b5c26ce412735893d72dd400f30e41bd14d7bbe44d3ec846de3069e2b2bd404494368b44e2ddc55736aa34cda2ea92dd6c2b202f9cf4c

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                    Filesize

                                                                    3KB

                                                                    MD5

                                                                    646ebeff7f46a487c839f377a8367fa5

                                                                    SHA1

                                                                    91770266cce95757afbba69dea1b01192fdd6e11

                                                                    SHA256

                                                                    50160c9a9723fdb388cc0085156077ac48f7c70d1b3f0c1e8e3a9d3928be6267

                                                                    SHA512

                                                                    052cf05f29cd784e6b8c4943caf7f65f45e2f3407703a27392bc8e1043260c24bebeb65f1f0f5c5303c97eb3c255e64146cf4b45962ba163fd415d530b40b089

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                    Filesize

                                                                    3KB

                                                                    MD5

                                                                    0170b97ba3310d9096ff95e458c5ef9e

                                                                    SHA1

                                                                    97197e23870248a2156458b64a3f7cad85b59956

                                                                    SHA256

                                                                    f093cc7653fa53dfb642756363d95826525c269f203bfc6637368348d36acb4e

                                                                    SHA512

                                                                    5eb3f99b82c0335009479c076ab5ac901fd671739981168315238602fb99b13323d1575b425e5190ff600ded7240dc7d87e6249faa402e4a20500b73de7310e0

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                    Filesize

                                                                    2B

                                                                    MD5

                                                                    d751713988987e9331980363e24189ce

                                                                    SHA1

                                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                                    SHA256

                                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                    SHA512

                                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                    Filesize

                                                                    524B

                                                                    MD5

                                                                    48ddba3dbc26570ba1b4b542cd101b5f

                                                                    SHA1

                                                                    baa29ac845493b91152ba82a26a1b67e732d6d8f

                                                                    SHA256

                                                                    7d2536f234576e943f19b00dffff11ecaaa81905dedbaefc158544c7037d4e98

                                                                    SHA512

                                                                    7ab0d0b2d7341c36073e48a3f5b3ac8f757331c84dbd6a486cafc7baf1ba21a9b7810c8066fae5dc0ed744ee67dd767af2b4f461a533a8e92dd8222e676e2c33

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                    Filesize

                                                                    8KB

                                                                    MD5

                                                                    cf19309d1a2119c2f3a65155250710b5

                                                                    SHA1

                                                                    676b68b3bc7d28d2018a06549b7419d3a31a6da8

                                                                    SHA256

                                                                    e29865bc0d77e403999be67cda07edc8b41b262f9b794790afb1a414cc388458

                                                                    SHA512

                                                                    28f0cf7507101920b83e1ada106bbe6fbb4ddd09a99d89c2173a9beb39db0a89ee311d684c62b7ab34905fb7ee6478813778f1e876412dd74877f808757878cc

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                    Filesize

                                                                    8KB

                                                                    MD5

                                                                    2ce15ec843b3cc3bf8c3602d86ccd343

                                                                    SHA1

                                                                    9b4ae2ffc9cead1c321fa36d58086be55f93b6c7

                                                                    SHA256

                                                                    b56606487ff5d7f3fdf39e556912a6ac1743c16f267d624fcd76bbd6fa0beec5

                                                                    SHA512

                                                                    f889054d9e7006af7e25f2d34b61fc19a0f05c4f637b9ce2368a21431094ed8fdf3427362ce2bef871d0d3aff6c1bb908717a40f1f76863f348b674449dbb1e4

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                    Filesize

                                                                    8KB

                                                                    MD5

                                                                    2fc02ad57b3971d560154cab2670cddf

                                                                    SHA1

                                                                    b23c59a22b875dfa57166e7913afd215eb20d255

                                                                    SHA256

                                                                    381bdeeecee68a3e240f2a7e7d25b2b360fc4dba3bf99707eb0cc08aace06b4e

                                                                    SHA512

                                                                    45791d2fb7fcdb12c79fd08bd47d9f9a39ef9fd15a6dda31c0c64a2c984b38bdd94f20e137cf5f906279edb1d1273ca670a54c0e79fb9783cae5c6d4139f1ad4

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                    Filesize

                                                                    8KB

                                                                    MD5

                                                                    fbb12f680366be8e1b9dfc9e40a72837

                                                                    SHA1

                                                                    be6fe8ebadd67f7f27919dfec46d2f807107d5c7

                                                                    SHA256

                                                                    a13fd24fc3278640acd9294a79e5307019ee86690f0154e9ae782a5166856d45

                                                                    SHA512

                                                                    6bb6d7c0a1e4b436c9d34993084ea350ff5124b05b0af883c84e86a8dfb008a2bd73a7dbb02b528304594227c55b212fe25ced500a42020a9fcbb81bba9a6a91

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                    Filesize

                                                                    8KB

                                                                    MD5

                                                                    502fc7aa743522d327dfc516e00c2e07

                                                                    SHA1

                                                                    2de35989bb48d566d7cef955dec98fcbbe530cc7

                                                                    SHA256

                                                                    14ce8f4527aefdbb39f09755e871788773ccd60078d54db6c10a493df8930c97

                                                                    SHA512

                                                                    0a995baad5e1b4bb3f0b62080935f15afa28c80e69e1ec3af56465bdd6266c62cc6ece058410857d538e508325abf31ac87fdb702af9b480787e590fcd5b252d

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                    Filesize

                                                                    8KB

                                                                    MD5

                                                                    295a8536fee3a53f119cd658e0ec04f6

                                                                    SHA1

                                                                    ee248b40a432b9fec939e239eea8e08b9944f8b1

                                                                    SHA256

                                                                    173318d60c7d5f0fa0f0a524259b357f657107ed20c26ef41da2edb8131bebd1

                                                                    SHA512

                                                                    8c3a6287a88b0cd5f412551edb1247792988583daea006988e458a4a1d75dd9f9f4ae0581940208817196440ec08b53545c0437a1c83591aa21f05df48cc7a0e

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                    Filesize

                                                                    8KB

                                                                    MD5

                                                                    67ed0d838339d8b10738538eec7e8e87

                                                                    SHA1

                                                                    e9bc637ca33591cf0402aa5c8bc83947f9573d3d

                                                                    SHA256

                                                                    51c907d6ff9c6fd035e66b8b1347143b22d2ff053698089c91ff86c6b90ed35b

                                                                    SHA512

                                                                    f98321e7a9123f3451bc4fc6faa129dd5cf3c6c08bf60878cf0269576081a4fcdd5ceb4174d25cd62a82338b4ae4a7b30276c6d02cbd94a734b7a5125b9737eb

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                    Filesize

                                                                    8KB

                                                                    MD5

                                                                    e07a499b651ebfac875c08d41dd9a553

                                                                    SHA1

                                                                    81366ffb404b6cb508b6e8903349e23e4b1ac7c3

                                                                    SHA256

                                                                    9d8d1697fd37c6ee44fcd6f027a88097792943ddad213f29941b7ae76be5df63

                                                                    SHA512

                                                                    210658e245ce9aeefa7d9e460f62ad93d88a6e856af55a1282dac174cb7f7cb18d37c4ef50185b0f2c12d506c6230bc43f538ae4fb80350d0ff01cecb09d5c4c

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                    Filesize

                                                                    8KB

                                                                    MD5

                                                                    1d11cca6f66f39c0fc172025f4115383

                                                                    SHA1

                                                                    0d4bbb93153635c8b7d3b4e93abd9a199927afba

                                                                    SHA256

                                                                    ac7b6284420e64983cb5f2b8d972b9e868396096993e69dcb1ffaafba2b31881

                                                                    SHA512

                                                                    4a7b6e34ea31054fe0bca5a7052c88e1d1737e428c7f2351f4033da321ce66e74f3bdd305c1ef38eda99536bcd6685ff42e4258cf37e874d634b746bb1cc0f75

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                    Filesize

                                                                    197KB

                                                                    MD5

                                                                    e4fb5226cb92768373f7f52496468661

                                                                    SHA1

                                                                    ab0c0c2eb0cb04db5cc19803639b35e61aed73c6

                                                                    SHA256

                                                                    76c428790c82440e4505f8ec49722256024909fcfc9179eb14e33b7fc6872c24

                                                                    SHA512

                                                                    6418bd3f8591828faa6b90bdcd5cc836c90c9a984cdbcc99c3660f2bbdfd7aa058f617537b37ce144f06680c145a6817b8edca52e4966f393e2288235c2a97fd

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                    Filesize

                                                                    101KB

                                                                    MD5

                                                                    4506040da2f8b8747ac6d6ec5bc0d3a7

                                                                    SHA1

                                                                    3f548676f4efb8735e5f77d0a152d3c86e5b9f47

                                                                    SHA256

                                                                    6a24f8a25b11fe2debedacc900d450084bcfc106b7d547fbdd606dd9eb6d5c41

                                                                    SHA512

                                                                    e8eb5bd3be65d7ef6bf001384978954d34fe34cb877202f3e6508a49ada95109e1ad63ec1cc76343ed2b9136a9b0c9a04efec1edf3d08ad9c9cf6852835b0eb3

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                    Filesize

                                                                    197KB

                                                                    MD5

                                                                    1908b5debbcd01641af923ddbe45ad8e

                                                                    SHA1

                                                                    4842f78a7fb7539673b99cc4b55098c37c65feff

                                                                    SHA256

                                                                    f6c9d3d1bccb6d957f658fb6cbdd87e664583a35f306dd6c50d50ddc331cbe0d

                                                                    SHA512

                                                                    f36d69649002d0a9c90db4942ce8ef031bc7433a92958629c03fc660b0af0aa574767a806b28d3be3a3940a8a245e69f626643c5ab197a8dd165803a739eecde

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                    Filesize

                                                                    197KB

                                                                    MD5

                                                                    742d2ad8b35cbd6a024822411719ab16

                                                                    SHA1

                                                                    e2ea3e1e7f3b07728af75e8330030007fb413bdf

                                                                    SHA256

                                                                    f266b1883cfd350970b5f11e7c99f7d3640ab8e52c4203d5a13b83737498be7f

                                                                    SHA512

                                                                    5241b822efcb552569acd7bf9eab13f18ddd4c383a2be05424b04adbdc0020c8488c151692f64d15bde5d69c7686081eb001ad4b95bbda6e18746c38baae255f

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                    Filesize

                                                                    226KB

                                                                    MD5

                                                                    95448e4ceb9bb925d8a77b7219d30efb

                                                                    SHA1

                                                                    4a04758ee39f6ae9e221853c6c0c804d39d7ae62

                                                                    SHA256

                                                                    c68b5b291018f06874517e8b3318213019f9f51a3ed04d06be89d61c2ad94952

                                                                    SHA512

                                                                    88a66bb873c885482e5d68ab51a21c925d9ac237c6e7ffe252512dcfd44209ce8b316840a112994ab4ff458556bbfe0dc7f6d097a36e3a49fccb6cd8aecc7e9a

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    c4a10f6df4922438ca68ada540730100

                                                                    SHA1

                                                                    4c7bfbe3e2358a28bf5b024c4be485fa6773629e

                                                                    SHA256

                                                                    f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

                                                                    SHA512

                                                                    b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    4c3889d3f0d2246f800c495aec7c3f7c

                                                                    SHA1

                                                                    dd38e6bf74617bfcf9d6cceff2f746a094114220

                                                                    SHA256

                                                                    0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

                                                                    SHA512

                                                                    2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    240B

                                                                    MD5

                                                                    f4ac3231558e2f51362abb4f55ca91ad

                                                                    SHA1

                                                                    2f6fdba0290e935c89f2d81ffff5fc797582860e

                                                                    SHA256

                                                                    4c65fffc9e3ead6346c6cbb51a209c7dfe7762581089d0d24a5202f387960158

                                                                    SHA512

                                                                    c452ab85110509a0cf7bd6bcc8e3e756f8ee5d2bc1158f29046a43685878413904f05b59f11cf30afdd2c1ee7afe518bef02cd1abae2e7af9b6ca893f8eeed7e

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    85d5fffbcf1eb5a5e18f4010f9a5d094

                                                                    SHA1

                                                                    5508c96a87517243f74d9b480be67daa62a98b12

                                                                    SHA256

                                                                    d6aa2e02512e151f38b759924e21cf0e2f51d38fd71bada56f23ba438e50bbf1

                                                                    SHA512

                                                                    bf00f907a2d3d9a06999706e0e0f18033fc0d15365600153a8f14d6cd893a5a095005f91606ea0e3632746f8b6258d5328c3f5065e964fabf5ca9476056e29fa

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    f62b32d4b49aaa7997fa597f027e27b7

                                                                    SHA1

                                                                    b3c750c8f693df330bb5aa2836c29e7795399328

                                                                    SHA256

                                                                    80e5c71d428e07738f932a9512f2e8b606e2901d04bf6787c617f75f255a295b

                                                                    SHA512

                                                                    5fc3e796ef00c15e215cf292e1272ceea63ed6fd53f2589aff6b99df8572f665afa0145e80a84b32a57d6a749b5bf017633ac8513d40a300f133acc7a9c980d1

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    5KB

                                                                    MD5

                                                                    f2caf1ec567ea2fd043c89d2dff72ac8

                                                                    SHA1

                                                                    cdcb6c9cbdb73c2f469f53f1008b48015cdd20d1

                                                                    SHA256

                                                                    73f83f71975c753ca14310057abd57cc68a95f3b739417a7463c382f67edc25c

                                                                    SHA512

                                                                    35daf5128ec8e3787c80631866a324342a87526b3f3204c237e71c97a328937c3457f47f1384db1500db5931a3fdb13fb7464b9201d46b455e2d4d3cb73c2a45

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                    Filesize

                                                                    16B

                                                                    MD5

                                                                    46295cac801e5d4857d09837238a6394

                                                                    SHA1

                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                    SHA256

                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                    SHA512

                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                    Filesize

                                                                    16B

                                                                    MD5

                                                                    206702161f94c5cd39fadd03f4014d98

                                                                    SHA1

                                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                    SHA256

                                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                    SHA512

                                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    11KB

                                                                    MD5

                                                                    80d2c684c4977c72e20247fdf66a29d2

                                                                    SHA1

                                                                    6dee819395fa52dfc64fde03a7cc4697df9dcba3

                                                                    SHA256

                                                                    1758ff09b29647c2a3796507ffde9b3dc7a81507227353f000d0bcedcd0afc1f

                                                                    SHA512

                                                                    58d52038db8256ea0a52e21e7efd1607f85c51f6a9cf9c805b62861e5d2898157853741720279d204443736ef7bb0afe81b8601506a29ca2c3ae5fdd8ff68acb

                                                                  • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                                                                    Filesize

                                                                    1.8MB

                                                                    MD5

                                                                    6b1be5003973052d34deb0f0b6c0ecd5

                                                                    SHA1

                                                                    3d47ab3e4d475097982a56686ba3298982f8a225

                                                                    SHA256

                                                                    44b840309d763ca08dc04c62daf30cdf9b282a990ff52572591eb0c004a44b34

                                                                    SHA512

                                                                    9e2006a743a6f401c42f37f0253a105b7ef0814a5c1667dbe28a1f395f80e788afa20159132b90477d89199c4255d2b56b2a1b405ff2a1ff3c2a307a6fbd9971

                                                                  • C:\Users\Admin\AppData\Local\Temp\1000020001\994eca61d8.exe

                                                                    Filesize

                                                                    89KB

                                                                    MD5

                                                                    0726d43cf85d986897d078ae49911a9c

                                                                    SHA1

                                                                    a26932f5f78197872e5dfed717a8ff29f08517e8

                                                                    SHA256

                                                                    67f011fb576e931d37dd6ebcfda52e4ae4fba59f2831ccaa1b649fbdbde78808

                                                                    SHA512

                                                                    320c2be79607f3bfe2c56ae986b8ff60d20d6e688b8207183a91c4339a787e338799017c51c0ff2755c6fa5e7fab08ee06429cbe096adacf9f7de2ef2e972e0f

                                                                  • C:\Users\Admin\AppData\Local\Temp\73C8.tmp\73C9.tmp\73CA.bat

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    de9423d9c334ba3dba7dc874aa7dbc28

                                                                    SHA1

                                                                    bf38b137b8d780b3d6d62aee03c9d3f73770d638

                                                                    SHA256

                                                                    a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698

                                                                    SHA512

                                                                    63f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401

                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                    Filesize

                                                                    479KB

                                                                    MD5

                                                                    09372174e83dbbf696ee732fd2e875bb

                                                                    SHA1

                                                                    ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                    SHA256

                                                                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                    SHA512

                                                                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                                    Filesize

                                                                    13.8MB

                                                                    MD5

                                                                    0a8747a2ac9ac08ae9508f36c6d75692

                                                                    SHA1

                                                                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                    SHA256

                                                                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                    SHA512

                                                                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                                    Filesize

                                                                    1.1MB

                                                                    MD5

                                                                    842039753bf41fa5e11b3a1383061a87

                                                                    SHA1

                                                                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                    SHA256

                                                                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                    SHA512

                                                                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                                    Filesize

                                                                    116B

                                                                    MD5

                                                                    2a461e9eb87fd1955cea740a3444ee7a

                                                                    SHA1

                                                                    b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                    SHA256

                                                                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                    SHA512

                                                                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                                    Filesize

                                                                    372B

                                                                    MD5

                                                                    bf957ad58b55f64219ab3f793e374316

                                                                    SHA1

                                                                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                    SHA256

                                                                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                    SHA512

                                                                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                                    Filesize

                                                                    17.8MB

                                                                    MD5

                                                                    daf7ef3acccab478aaa7d6dc1c60f865

                                                                    SHA1

                                                                    f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                    SHA256

                                                                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                    SHA512

                                                                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\prefs-1.js

                                                                    Filesize

                                                                    11KB

                                                                    MD5

                                                                    4115beaad030ee1668df1558482e5eab

                                                                    SHA1

                                                                    2c35e4ba19e03998262dff33bdedf2301cc9db8f

                                                                    SHA256

                                                                    47d4adf1708ca0e3ea0a30080768f16b29d6b488a133e17f7cbd74b0cc7dcada

                                                                    SHA512

                                                                    c8b2b565fa5c0fd6e47b25810efff38310a75acee2382717440b520d1f388323b4c9698788ed48a3810635740837c6c57bffec1d66e25e255643429265480e06

                                                                  • memory/740-376-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-446-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-530-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-235-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-338-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-506-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-226-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-357-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-225-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-181-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-396-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-220-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-487-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-477-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-21-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-18-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-467-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-264-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-20-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/740-19-0x00000000003D1000-0x00000000003FF000-memory.dmp

                                                                    Filesize

                                                                    184KB

                                                                  • memory/740-465-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/1280-5-0x0000000000FD0000-0x000000000147E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/1280-1-0x0000000077CD6000-0x0000000077CD8000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/1280-0-0x0000000000FD0000-0x000000000147E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/1280-17-0x0000000000FD0000-0x000000000147E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/1280-3-0x0000000000FD0000-0x000000000147E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/1280-2-0x0000000000FD1000-0x0000000000FFF000-memory.dmp

                                                                    Filesize

                                                                    184KB

                                                                  • memory/1920-519-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/1920-520-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/3040-444-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/3040-445-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/5904-213-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/5904-219-0x00000000003D0000-0x000000000087E000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/5964-105-0x0000000000400000-0x0000000000FED000-memory.dmp

                                                                    Filesize

                                                                    11.9MB

                                                                  • memory/5964-180-0x0000000000400000-0x0000000000FED000-memory.dmp

                                                                    Filesize

                                                                    11.9MB