Analysis

  • max time kernel
    289s
  • max time network
    293s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-08-2024 21:33

General

  • Target

    https://disk.yandex.ru/d/6_MHEpvPPBEKoQ

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1276872451782869143/xGmDsBJgF-XmVjYHmlWeJITbvIMFvsWrmdUxR44Db6po18jTFjvMRKTFStoHQMaCMZPQ

Signatures

  • 44Caliber

    An open source infostealer written in C#.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Executes dropped EXE 21 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 20 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 5 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://disk.yandex.ru/d/6_MHEpvPPBEKoQ
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed34f46f8,0x7ffed34f4708,0x7ffed34f4718
      2⤵
        PID:2612
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        2⤵
          PID:1416
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1572
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
          2⤵
            PID:1680
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
            2⤵
              PID:3140
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:4244
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
                2⤵
                  PID:1004
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
                  2⤵
                    PID:3468
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4356
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
                    2⤵
                      PID:3724
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
                      2⤵
                        PID:3292
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6052 /prefetch:8
                        2⤵
                          PID:1028
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
                          2⤵
                            PID:3632
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3036
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
                            2⤵
                              PID:5396
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
                              2⤵
                                PID:5404
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
                                2⤵
                                  PID:5884
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                                  2⤵
                                    PID:5160
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6156 /prefetch:8
                                    2⤵
                                      PID:5280
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5156 /prefetch:8
                                      2⤵
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5264
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
                                      2⤵
                                        PID:5852
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                                        2⤵
                                          PID:2480
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
                                          2⤵
                                            PID:5452
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
                                            2⤵
                                              PID:5184
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6948 /prefetch:8
                                              2⤵
                                                PID:5904
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6916 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5828
                                              • C:\Users\Admin\Downloads\winrar-x64-701.exe
                                                "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5348
                                              • C:\Users\Admin\Downloads\winrar-x64-701.exe
                                                "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5340
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
                                                2⤵
                                                  PID:3796
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
                                                  2⤵
                                                    PID:5644
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
                                                    2⤵
                                                      PID:5576
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
                                                      2⤵
                                                        PID:5572
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12522098494353395374,12345152922104749683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7080 /prefetch:2
                                                        2⤵
                                                          PID:1196
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:3712
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:4252
                                                          • C:\Windows\system32\OpenWith.exe
                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5756
                                                          • C:\Windows\system32\OpenWith.exe
                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:6008
                                                          • C:\Windows\system32\OpenWith.exe
                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4224
                                                          • C:\Windows\System32\rundll32.exe
                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                            1⤵
                                                              PID:5484
                                                            • C:\Program Files\7-Zip\7zFM.exe
                                                              "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\debug.rar"
                                                              1⤵
                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:396
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1128
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:852
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3728
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:6140
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4152
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5700
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2488
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2128
                                                            • C:\Program Files\7-Zip\7zFM.exe
                                                              "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\New folder\Insidious.exe.config"
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:4740
                                                            • C:\Program Files\7-Zip\7zFM.exe
                                                              "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:1040
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3232
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5468
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4348
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5816
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5692
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3044
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4476
                                                            • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                              "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5236
                                                            • C:\Windows\system32\werfault.exe
                                                              werfault.exe /h /shared Global\8aaa88e0d565414dbe2534d9be55fac6 /t 5276 /p 5340
                                                              1⤵
                                                                PID:1560
                                                              • C:\Windows\system32\werfault.exe
                                                                werfault.exe /h /shared Global\090db074f50d47559032c2a83f8b1c6b /t 3364 /p 5348
                                                                1⤵
                                                                  PID:2700
                                                                • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                                  "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5172
                                                                • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                                  "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5936
                                                                • C:\Windows\system32\pcwrun.exe
                                                                  C:\Windows\system32\pcwrun.exe "C:\Users\Admin\Desktop\New folder\Insidious.exe" CompatTab
                                                                  1⤵
                                                                    PID:5548
                                                                    • C:\Windows\System32\msdt.exe
                                                                      C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCW66A6.xml /skip TRUE
                                                                      2⤵
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:5448
                                                                  • C:\Windows\System32\sdiagnhost.exe
                                                                    C:\Windows\System32\sdiagnhost.exe -Embedding
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5428
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tkntxddh\tkntxddh.cmdline"
                                                                      2⤵
                                                                        PID:5224
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A8E.tmp" "c:\Users\Admin\AppData\Local\Temp\tkntxddh\CSC722307F6606E4C8280121A3124392A71.TMP"
                                                                          3⤵
                                                                            PID:4468
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v1j4kclt\v1j4kclt.cmdline"
                                                                          2⤵
                                                                            PID:5900
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B1A.tmp" "c:\Users\Admin\AppData\Local\Temp\v1j4kclt\CSC372259A016DF4F09A1F2522F58975CD.TMP"
                                                                              3⤵
                                                                                PID:5172
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cjw025hd\cjw025hd.cmdline"
                                                                              2⤵
                                                                                PID:312
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D7C.tmp" "c:\Users\Admin\AppData\Local\Temp\cjw025hd\CSCA057CD24809F49E2BBB4FC9178D929E.TMP"
                                                                                  3⤵
                                                                                    PID:2108
                                                                              • C:\Users\Admin\Desktop\New folder\Insidious.exe
                                                                                "C:\Users\Admin\Desktop\New folder\Insidious.exe"
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1444

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt

                                                                                Filesize

                                                                                315B

                                                                                MD5

                                                                                71227f862899452aa270d580a8b090c8

                                                                                SHA1

                                                                                13a6dc9506be2066777ec34acbe5ab62684c4929

                                                                                SHA256

                                                                                22e5316f3216208507c8ae67cbb2a90cfcf4389dae87f8f71c3388593eca57c1

                                                                                SHA512

                                                                                126c549e82d679bb9d3e229b09c3dded86b72aa5a98cb956a0d2a740ca43a4da14049134c3836c49ef50e76bb0a69fe158bb776a4c86a7e7b04893ced8ba5b5a

                                                                              • C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt

                                                                                Filesize

                                                                                420B

                                                                                MD5

                                                                                01735e34db13c5f93eead0f8572adb67

                                                                                SHA1

                                                                                5b819f76344907d93f62ecd11e2a2cbd514bee2f

                                                                                SHA256

                                                                                bca74f82c72da083cf88a725f198e0730982595bfa6a137e46d0b77b81552f4d

                                                                                SHA512

                                                                                e833925ccd15947e9234b72cf06e2620b3d982dd4840e5c5cae31634f437702b10c29db85fbb5115490f1d72f4bb5b935815fb14f6221ace756216604101924c

                                                                              • C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt

                                                                                Filesize

                                                                                525B

                                                                                MD5

                                                                                74d90dd5a73f1679bd73fdce50983c50

                                                                                SHA1

                                                                                6f374995ce4842a9f07fc1a935833003066820bb

                                                                                SHA256

                                                                                da34d9a479cfcc31980c9be0a13eb90defa37ec3438f114f03f12649a415cfb9

                                                                                SHA512

                                                                                ad173b782022b72727c9a1d66aa7509ac316450d18561b018ddf563fe921636ea32d9615019ee0fb3be7a8b781154c5e09f6916547bbb7ab4484d3fea509b95f

                                                                              • C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt

                                                                                Filesize

                                                                                630B

                                                                                MD5

                                                                                aef24d8d3c507674cea8b016e2f4e6a3

                                                                                SHA1

                                                                                411eb0cddf04fa969a50736544ac4a6a9a545b80

                                                                                SHA256

                                                                                0fe82ba06f72db753abdf7a51b016bb6ccb880deb1850f56c921264fb2d419da

                                                                                SHA512

                                                                                33904ba625025eb67370ac60d07a2150cb3e4228867716f109e7fb9a470e71987178f1aa209eac6de20734e4e41fbb336c0e9671b4397dab90edc2d6c41b883f

                                                                              • C:\ProgramData\44\Browsers\Firefox\Bookmarks.txt

                                                                                Filesize

                                                                                735B

                                                                                MD5

                                                                                fc161acb0edaa484d705d83835de0e24

                                                                                SHA1

                                                                                00850bbea1ef2db2a16dbb4427822bffbb173d54

                                                                                SHA256

                                                                                6f355f6b050ea450b7f36f8c66121c77fbd5fbf62fba28a5c3305e37977342be

                                                                                SHA512

                                                                                fdccf446d488e5561c71096e00200d384c7870d546433b8dffea7bad1807cc14a98bc6837dd10e12e8fbf70482cce8cf15b02062bbd1bd39dfc416dc67381a0e

                                                                              • C:\Users\Admin\AppData\Local\44\Browsers\Cookies_Edge(77).txt

                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                3ea2f0a427cfcff1656bc8c5d61c26b8

                                                                                SHA1

                                                                                b8f6bc4097437f58cfd7f97d2be86e7c6c158a95

                                                                                SHA256

                                                                                5f8c98771d30f3835900521c33af9a5b9e950b3295bd523e6ea5e3f86db3ee75

                                                                                SHA512

                                                                                adc3aa8653849157164ed690403cf066c26bf3f59e856f4fff9704a50416b8236fef1697b14797698364145cd005d045c38dfe3049c9d729a483ffc51e052ec3

                                                                              • C:\Users\Admin\AppData\Local\44\Browsers\Cookies_Edge(77).txt

                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                332d37daf37d39dc3f4924fd075cc4b7

                                                                                SHA1

                                                                                acd7e64cabac2f469bfd06296632dffe000a3cc9

                                                                                SHA256

                                                                                85912443ec92937b27920c565adf49080674d78ac5db9623cff0b23dc6702a0e

                                                                                SHA512

                                                                                3467e4a091ff66e93707319bc26175d883a905767055690f459ca1bb08e0ab5096364dbbc6170d7ddfbfdc07c722b2b9a7cff5fe08906cedf92b3425936166fc

                                                                              • C:\Users\Admin\AppData\Local\44\Browsers\Firefox\Bookmarks.txt

                                                                                Filesize

                                                                                105B

                                                                                MD5

                                                                                2e9d094dda5cdc3ce6519f75943a4ff4

                                                                                SHA1

                                                                                5d989b4ac8b699781681fe75ed9ef98191a5096c

                                                                                SHA256

                                                                                c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                                                                                SHA512

                                                                                d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                                                                              • C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2024082521.000\PCW.debugreport.xml

                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                406aff7b154e203228408a6b89550b0c

                                                                                SHA1

                                                                                d528dbe35bfe331d5c1b01e856f9da1a6fe8e1ad

                                                                                SHA256

                                                                                bc5b958c798ba36133c656d5d025df1424d907b92465ebafb2df7b50ae7f44e6

                                                                                SHA512

                                                                                12e9e53e332c06e1485b08c3b3a5c9497664ed54951c60260a405f69afcac5f2a658f7bb11751ad943ecb7e2c4264155f8b3b30aad5cf814177257cae3c279a8

                                                                              • C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2024082521.000\results.xsl

                                                                                Filesize

                                                                                47KB

                                                                                MD5

                                                                                310e1da2344ba6ca96666fb639840ea9

                                                                                SHA1

                                                                                e8694edf9ee68782aa1de05470b884cc1a0e1ded

                                                                                SHA256

                                                                                67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

                                                                                SHA512

                                                                                62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                Filesize

                                                                                152B

                                                                                MD5

                                                                                eeaa8087eba2f63f31e599f6a7b46ef4

                                                                                SHA1

                                                                                f639519deee0766a39cfe258d2ac48e3a9d5ac03

                                                                                SHA256

                                                                                50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

                                                                                SHA512

                                                                                eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                Filesize

                                                                                152B

                                                                                MD5

                                                                                b9569e123772ae290f9bac07e0d31748

                                                                                SHA1

                                                                                5806ed9b301d4178a959b26d7b7ccf2c0abc6741

                                                                                SHA256

                                                                                20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

                                                                                SHA512

                                                                                cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                fa02ebdfe42e04b7040fa64c4b037e85

                                                                                SHA1

                                                                                7c5c921fcaa4dc08bda0fc0a18967b0f91a91a8d

                                                                                SHA256

                                                                                26e76082a9c0460e5724c924711360d20ef4ea656af94806315929dff7c2e0c2

                                                                                SHA512

                                                                                39bfa483d72d8bc2c3e29743d0a3d8a50337249abfd99808ef785bccb6821962429532e7e5ed1bb0a486370042afa265ddc798f1758058cfea2fdbe406ba360f

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

                                                                                Filesize

                                                                                32KB

                                                                                MD5

                                                                                34efaf0b8c699e30605db0993802ef85

                                                                                SHA1

                                                                                22d95b527ce48ec90ca8067dcf42e6ffc9f6cd9b

                                                                                SHA256

                                                                                257ccb424da20cb64fc9d8c7deb5781a2fa668d7589e7ee9e13f337ff7aebe86

                                                                                SHA512

                                                                                8ec35b78d42ba229c509665308f2affe027d083b4493ba807d3204cc18d2ca17650b2d7c731ae7731fee7c16c2f289ffd8bace0f913f82ec20dd400c35dd1217

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

                                                                                Filesize

                                                                                16B

                                                                                MD5

                                                                                46295cac801e5d4857d09837238a6394

                                                                                SHA1

                                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                SHA256

                                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                SHA512

                                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                Filesize

                                                                                923B

                                                                                MD5

                                                                                6889006be520da4581408b3618fb50ab

                                                                                SHA1

                                                                                bec22e67ccc07638c99db229a9fa861b93500362

                                                                                SHA256

                                                                                d646a5ffceaae9bb40f0ba68def8edda631b899fe3ac8087bdf3ed1ce9edb670

                                                                                SHA512

                                                                                7eabcba4874ba1e356d21dab9c8c72566c711c7acee50e04a999da332f5ce8a82f999d07c4c5fd46d4be9557061dd2e811695b282d3e024421c5b3d7dd4481ee

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                8325b0c6fabb7ef701c8ddf32c8d1612

                                                                                SHA1

                                                                                22ea5e2ae7f05dae993ebe5a502dd05c2af0c3ec

                                                                                SHA256

                                                                                293f4a81a3a1c92493903a7416f30825cb2e998e85b5d197ec4bc247b0c02820

                                                                                SHA512

                                                                                e7c046e227ba1762f1a961174cb6d18ca0624c41897cf7c5f96a682e5f4ae5e8007b1f07f832836ce962bf88eaf1898140d8ba7fa0468ff38d5d88a6f4db877c

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                7KB

                                                                                MD5

                                                                                646b571d28be024cea1b44f7e8f1b54e

                                                                                SHA1

                                                                                8205e8b75d7209206d649b17cd818e07803601e7

                                                                                SHA256

                                                                                efd397df6d304a4d2c7c0ff54786a04d9157c66693b6ae2ba251da1457da6cfc

                                                                                SHA512

                                                                                77bbfe7bb9a6e15d109b655270f8c729a93fa65208b1029a4ff4c9bb4682c4ec5c01320b177e678236377cb4776dd110373631e0430b632f75156a1b3a04a9c8

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                7KB

                                                                                MD5

                                                                                33ffe48d926013eb8c30c2cac126ae00

                                                                                SHA1

                                                                                b4ea20048c5bbb9ef5c34abeba01a499d1a9cb36

                                                                                SHA256

                                                                                f53a9703913bfb8236cc283397af1d8d57b7717e1e55e5028797d59a15e1ff24

                                                                                SHA512

                                                                                80c61c2f53bfa165922da71ff780334b9b48aafcc19ecfe51ced0c422cd21e3bc0a6fbfdcedc92613be25473881982df4c721f08356317a0f703b9c232c7b3da

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                7KB

                                                                                MD5

                                                                                f50ca4a68be0039ea8d25bee8c0c310d

                                                                                SHA1

                                                                                ca4178514739727d4f284f844b0de5644f69baac

                                                                                SHA256

                                                                                c51e239b9da1860d2da6173a616f6a5d2ae92ff17483d653f5f3efe89f14c425

                                                                                SHA512

                                                                                725539b7d2221bf58ac5b3aa6285a64ae74e00b0dbbd2bd60df772e8b1e7d689a657cba37765339e1097886196e946ee97214f4949dd62628f7c43079b6aa431

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                71a23b865b4e871ae9664d600fd6548c

                                                                                SHA1

                                                                                49c4d479540a16e5ff9947013b5ec79ab5229d0d

                                                                                SHA256

                                                                                78e8266e47c9fbf477bee8723a8b2aeee021b64775a4e8fa9688ecaa35472dce

                                                                                SHA512

                                                                                4e03e62fd637ca421303e29975118435b39e308e8ee159af76d327df6f44c4d90aa337474406b7317167809219ab3bc685896301b0c2d4742b779027eff896b8

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                c039436f1225307a7522114ccfe85df4

                                                                                SHA1

                                                                                89e1c69c7931521a0e7ee46a2dfb89c89afb4ecc

                                                                                SHA256

                                                                                238da48f7f526675d143cfa259ece902bd1a106fc919b9eeaa56788e57d3b098

                                                                                SHA512

                                                                                076a446e7252cd18de9be45875114b5a9eb560075f6baf80393ce512d3142b6e1ba6470fba38e71650f9c72dc1bea4f905326a36e19470679ca7da938e4cca55

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                85ed0d11da14212fec100ae4bcee3261

                                                                                SHA1

                                                                                652b3ae26cb3f43b2217a3afd85c7b7062271b68

                                                                                SHA256

                                                                                4fddfe96119641c0508e4ef268ddcb4d276f8e502644e1deb939430b49940847

                                                                                SHA512

                                                                                d60cdcc5dfbcc14660822915c885a680d5cf37ca56e0140591c0678f787cc8225c6ee7820d802993deebed4aa1556cbaa3ce2743f46a562ebb64dda56b8ec353

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ca74.TMP

                                                                                Filesize

                                                                                707B

                                                                                MD5

                                                                                8ea2b2371af47c30794303f18a2fb083

                                                                                SHA1

                                                                                d3d78d7d72ad15cfe0fd28f9a31b3f066e22a249

                                                                                SHA256

                                                                                00819993b2a550376f594ad40fa8983508189d5deccece774ec459f0ddac9d7b

                                                                                SHA512

                                                                                597655205294a5f3e300ed179971ccd18cb01248b2808e858872ffee095aa5045cba35b9e63bcbc1888612d133c1f1c6c2b28ee73765c54f877042262e36089b

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                Filesize

                                                                                116KB

                                                                                MD5

                                                                                11c83f54b26b16aa8f9f67c1ba6b7028

                                                                                SHA1

                                                                                b2ee196277852e1ecf9a845a50907372a3a55dc6

                                                                                SHA256

                                                                                f880568f9c7eafc2afba96abd078c134874b23d1ae31d5139bb8c4616ecee8c9

                                                                                SHA512

                                                                                a016e1b224b6cbb3b928ee07e6affbc5973cdff75ada8e015459fa7628021a86c897f0a910eddef9f171ddb2a4095fcc168af42067a44e38b752454473d562d8

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                Filesize

                                                                                16B

                                                                                MD5

                                                                                6752a1d65b201c13b62ea44016eb221f

                                                                                SHA1

                                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                SHA256

                                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                SHA512

                                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                cee36a6d134271a9885a1856157436c1

                                                                                SHA1

                                                                                6fc0f347abcae775343000985670e842c8d96bdf

                                                                                SHA256

                                                                                6b9f332f8556271d0f05da0d1ff3c9113d38a57dfd6850c1276a9daad0e0ee59

                                                                                SHA512

                                                                                2c7de05b15415022b320e14898a04f6d5a6cfb0e8fa57a6c5c73ffd6001b84bfcf4217cbade739689efaed7fdfddbb4b46ebe55270e7ab173b0b499b82ceca2f

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                Filesize

                                                                                12KB

                                                                                MD5

                                                                                b78ded1366826c55bb62163a930fb422

                                                                                SHA1

                                                                                95e9496a2e5632cd3f567dcf40a8d92bcc8ed01d

                                                                                SHA256

                                                                                1c82c321b0770c598ef0523655e01214c60f73736a9ebfac2dcf316633f035fd

                                                                                SHA512

                                                                                eee0569fb28a256a55ea6b1b0790dd90c4a30f5470edafe7dd463f45d4da3a0d77577186769e7468f3d55e3ef83a0d9abec7f8100d3287d86dad077f74c9b6f1

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                342ea7b544728714ebc2e51950e06246

                                                                                SHA1

                                                                                3e4375710d16a8117f220d775bf34624e4a89754

                                                                                SHA256

                                                                                008f99b274cf18587e1f2f099c864202ccfc75ba4240e87a8d1e07c1e26bf10f

                                                                                SHA512

                                                                                0fa53c2521097105b47b964535eec6e69f2f7718e78ae020465b14827ceb76097b89119f3e018161f42e4e883ff5d21d471058f379371a7414c96e70e7dd33d2

                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4iebuni2.jld.ps1

                                                                                Filesize

                                                                                60B

                                                                                MD5

                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                SHA1

                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                SHA256

                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                SHA512

                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpB66A.tmp.dat

                                                                                Filesize

                                                                                114KB

                                                                                MD5

                                                                                db26309558628fa1ef6a1edd23ab2b09

                                                                                SHA1

                                                                                9bfb0530d0c2dcc6f9b3947bc3ca602943356368

                                                                                SHA256

                                                                                e6287cb739a35ef64a6d19ec146c90c848de8646032fd98d570042c0e2ecf070

                                                                                SHA512

                                                                                4171bc6af1ffc5d24d6ddade7b47e94b0547297e25d9a4d45ca831801208b7d83edda0b138436626749711a953a5818486c293e8749c5c2539ef070e848b237c

                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpC456.tmp.dat

                                                                                Filesize

                                                                                40KB

                                                                                MD5

                                                                                a182561a527f929489bf4b8f74f65cd7

                                                                                SHA1

                                                                                8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                SHA256

                                                                                42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                SHA512

                                                                                9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpC458.tmp.tmpdb

                                                                                Filesize

                                                                                5.0MB

                                                                                MD5

                                                                                c822ad3a46e58afab84d23614a08e0bc

                                                                                SHA1

                                                                                196f257903ccefa439dc673690c6910356bd1d81

                                                                                SHA256

                                                                                a8dc0fe0bcf7f1553cf0f530f88b38f033b914170d71df05f84093498d82d438

                                                                                SHA512

                                                                                bc5da3bac510289c47d7c835ae6dd50fe96f64e1f522ac930be451cd9e47c5d395b5ff463f9b4aee33b98785f1bd4eec6a0d321962ecbc60e2eb5a0d66c735d2

                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpC45B.tmp.dat

                                                                                Filesize

                                                                                48KB

                                                                                MD5

                                                                                349e6eb110e34a08924d92f6b334801d

                                                                                SHA1

                                                                                bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                SHA256

                                                                                c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                SHA512

                                                                                2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpC47C.tmp.tmpdb

                                                                                Filesize

                                                                                96KB

                                                                                MD5

                                                                                40f3eb83cc9d4cdb0ad82bd5ff2fb824

                                                                                SHA1

                                                                                d6582ba879235049134fa9a351ca8f0f785d8835

                                                                                SHA256

                                                                                cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

                                                                                SHA512

                                                                                cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

                                                                              • C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txt

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                1267f4be35fbe5510886cf08ddee9fdd

                                                                                SHA1

                                                                                04e714a1c8a9d76e860c7cbbe7ebf62c71dea6b9

                                                                                SHA256

                                                                                ab038447adbfd1faf46f0d3bf6dc387621dc8435ab552696ec8d9bbe7a6a9ab3

                                                                                SHA512

                                                                                6f1bc0ad9eb850f37cddc2422e738f0cbbfe8a7a7e064c0c989cafbf0f7d5ae5bdfced4b3f93952688de3bfa338ff5a8c7258aff8397cdaccb36b23b5d16686b

                                                                              • C:\Users\Admin\Desktop\New folder\Insidious.exe

                                                                                Filesize

                                                                                303KB

                                                                                MD5

                                                                                76dc4548eb7f3255913e19fe0a3a9286

                                                                                SHA1

                                                                                4e2efa33af6abca5046042f7ed5fb9b17fc8f5af

                                                                                SHA256

                                                                                7c0c394c161920494f515bb092e2c7c959f52f6078688153f492414d72089d01

                                                                                SHA512

                                                                                12845b0674e89bc0cb46b3c9c6b7dfb4f224751b7274935a555ec9888d4cb4d863b9300a083f253e6e47e561dae7515b13111096172ce1740bc80e7218d43289

                                                                              • C:\Users\Admin\Desktop\New folder\Insidious.exe.config

                                                                                Filesize

                                                                                161B

                                                                                MD5

                                                                                c16b0746faa39818049fe38709a82c62

                                                                                SHA1

                                                                                3fa322fe6ed724b1bc4fd52795428a36b7b8c131

                                                                                SHA256

                                                                                d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad

                                                                                SHA512

                                                                                cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c

                                                                              • C:\Users\Admin\Desktop\New folder\Insidious.pdb

                                                                                Filesize

                                                                                965KB

                                                                                MD5

                                                                                3850184f79a67c151ab4cbe912b5d541

                                                                                SHA1

                                                                                c4365c10322444a88a0be90da9f84d7d600bcb4a

                                                                                SHA256

                                                                                08e73b0055cb3103f412aa205d29e9cbf285bfcfdba15a636126652228e42d51

                                                                                SHA512

                                                                                7917533350baeb5ebd6ecb0fbf829b5fa4aeb66eaf02adc989d2d88446bf1dc895715db90fef35bea47f05c8d51319d20df21460bf616330b4bc6fb6a8eab83e

                                                                              • C:\Users\Admin\Downloads\Unconfirmed 970178.crdownload

                                                                                Filesize

                                                                                3.8MB

                                                                                MD5

                                                                                46c17c999744470b689331f41eab7df1

                                                                                SHA1

                                                                                b8a63127df6a87d333061c622220d6d70ed80f7c

                                                                                SHA256

                                                                                c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

                                                                                SHA512

                                                                                4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

                                                                              • C:\Users\Admin\Downloads\debug.rar

                                                                                Filesize

                                                                                286KB

                                                                                MD5

                                                                                d17027cd211d3c86a26a18ecc9fc26f7

                                                                                SHA1

                                                                                17244e29957235ba9c2395e297bfe839434c91aa

                                                                                SHA256

                                                                                6a30512541b132e3d7d02439ccb4c7deaad8ddf20d868126a77d36a970056461

                                                                                SHA512

                                                                                5ff831ec765ab498fdc334bb03c824482275952c67882c6e937cf6b07dc288cfca821e40bdcac67d2a6efab599f6ccc624d433b265fbe1d77de3044e07b4bf89

                                                                              • C:\Windows\Temp\SDIAG_dd10d4b8-6e61-4450-8b51-ccb03c035ae0\DiagPackage.dll

                                                                                Filesize

                                                                                65KB

                                                                                MD5

                                                                                79134a74dd0f019af67d9498192f5652

                                                                                SHA1

                                                                                90235b521e92e600d189d75f7f733c4bda02c027

                                                                                SHA256

                                                                                9d6e3ed51893661dfe5a98557f5e7e255bbe223e3403a42aa44ea563098c947e

                                                                                SHA512

                                                                                1627d3abe3a54478c131f664f43c8e91dc5d2f2f7ddc049bc30dfa065eee329ed93edd73c9b93cf07bed997f43d58842333b3678e61aceac391fbe171d8461a3

                                                                              • C:\Windows\Temp\SDIAG_dd10d4b8-6e61-4450-8b51-ccb03c035ae0\en-US\DiagPackage.dll.mui

                                                                                Filesize

                                                                                10KB

                                                                                MD5

                                                                                d7309f9b759ccb83b676420b4bde0182

                                                                                SHA1

                                                                                641ad24a420e2774a75168aaf1e990fca240e348

                                                                                SHA256

                                                                                51d06affd4db0e4b37d35d0e85b8209d5fab741904e8d03df1a27a0be102324f

                                                                                SHA512

                                                                                7284f2d48e1747bbc97a1dab91fb57ff659ed9a05b3fa78a7def733e809c15834c15912102f03a81019261431e9ed3c110fd96539c9628c55653e7ac21d8478d

                                                                              • \??\pipe\LOCAL\crashpad_4912_PPEXFDOGCXMLJHWH

                                                                                MD5

                                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                                SHA1

                                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                SHA256

                                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                SHA512

                                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                              • memory/1128-515-0x00000292C7860000-0x00000292C78B2000-memory.dmp

                                                                                Filesize

                                                                                328KB

                                                                              • memory/5428-2138-0x000001B1164D0000-0x000001B1164F2000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                              • memory/5428-2146-0x000001B12ED40000-0x000001B12ED48000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                              • memory/5428-2155-0x000001B12ED50000-0x000001B12ED58000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                              • memory/5428-2164-0x000001B12EFB0000-0x000001B12EFB8000-memory.dmp

                                                                                Filesize

                                                                                32KB