Overview
overview
10Static
static
8all/clicke...fy.exe
windows7_x64
7all/clicke...fy.exe
windows10-2004_x64
7all/clicke...v2.exe
windows7_x64
8all/clicke...v2.exe
windows10-2004_x64
8all/clicke...on.exe
windows7_x64
1all/clicke...on.exe
windows10-2004_x64
4all/clicke...er.exe
windows7_x64
1all/clicke...er.exe
windows10-2004_x64
7all/clicke...p3.exe
windows7_x64
8all/clicke...p3.exe
windows10-2004_x64
8all/clicke...ao.exe
windows7_x64
4all/clicke...ao.exe
windows10-2004_x64
6all/clickers/vega.exe
windows7_x64
1all/clickers/vega.exe
windows10-2004_x64
10all/gcs/Cl...er.exe
windows7_x64
7all/gcs/Cl...er.exe
windows10-2004_x64
7all/gcs/Icetea.exe
windows7_x64
1all/gcs/Icetea.exe
windows10-2004_x64
4all/gcs/Koid.exe
windows7_x64
1all/gcs/Koid.exe
windows10-2004_x64
4all/gcs/crypt.exe
windows7_x64
9all/gcs/crypt.exe
windows10-2004_x64
9all/gcs/en...an.exe
windows7_x64
8all/gcs/en...an.exe
windows10-2004_x64
8all/gcs/epic.exe
windows7_x64
1all/gcs/epic.exe
windows10-2004_x64
4all/gcs/itami.exe
windows7_x64
1all/gcs/itami.exe
windows10-2004_x64
4all/gcs/kr...nt.exe
windows7_x64
1all/gcs/kr...nt.exe
windows10-2004_x64
9all/gcs/kura.exe
windows7_x64
1all/gcs/kura.exe
windows10-2004_x64
9Analysis
-
max time kernel
1825s -
max time network
1768s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
16-02-2022 17:24
Behavioral task
behavioral1
Sample
all/clickers/Spotify.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
all/clickers/Spotify.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral3
Sample
all/clickers/axentav2.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
all/clickers/axentav2.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral5
Sample
all/clickers/isolation.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
all/clickers/isolation.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
all/clickers/mangoclicker.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
all/clickers/mangoclicker.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral9
Sample
all/clickers/nigclickermp3.exe
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
all/clickers/nigclickermp3.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral11
Sample
all/clickers/slinkylmao.exe
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
all/clickers/slinkylmao.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral13
Sample
all/clickers/vega.exe
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
all/clickers/vega.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral15
Sample
all/gcs/Client_Loader.exe
Resource
win7-en-20211208
Behavioral task
behavioral16
Sample
all/gcs/Client_Loader.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral17
Sample
all/gcs/Icetea.exe
Resource
win7-en-20211208
Behavioral task
behavioral18
Sample
all/gcs/Icetea.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral19
Sample
all/gcs/Koid.exe
Resource
win7-en-20211208
Behavioral task
behavioral20
Sample
all/gcs/Koid.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral21
Sample
all/gcs/crypt.exe
Resource
win7-en-20211208
Behavioral task
behavioral22
Sample
all/gcs/crypt.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral23
Sample
all/gcs/encephalon_clean.exe
Resource
win7-en-20211208
Behavioral task
behavioral24
Sample
all/gcs/encephalon_clean.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral25
Sample
all/gcs/epic.exe
Resource
win7-en-20211208
Behavioral task
behavioral26
Sample
all/gcs/epic.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral27
Sample
all/gcs/itami.exe
Resource
win7-en-20211208
Behavioral task
behavioral28
Sample
all/gcs/itami.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral29
Sample
all/gcs/kryptonclient.exe
Resource
win7-en-20211208
Behavioral task
behavioral30
Sample
all/gcs/kryptonclient.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral31
Sample
all/gcs/kura.exe
Resource
win7-en-20211208
General
-
Target
all/clickers/slinkylmao.exe
-
Size
687KB
-
MD5
5bfdbb28cc7fed82bf415edac9c9eb83
-
SHA1
c04b108edbb95b75dc1496bed342b937f37fa17a
-
SHA256
12affb37160cf0bb5fe284c7f65ddeea23a788f4d35fbf158a4877c99640e8c3
-
SHA512
ff52df5c58fbee9dd555f373bb1a4b520e36f6a76e1b6ed345015cbd0adf1a3927dd79afe1b92e76b439d1221865b72a34a9023fad3c0c1f849e6a90e4352ae3
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3ff602de-dfd4-41ac-9708-339fbff460df.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220216183007.pma setup.exe -
Drops file in Windows directory 3 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
HTTP links in PDF interactive object 1 IoCs
Detects HTTP links in interactive objects within PDF files.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\all\clickers\Slinky.pdf pdf_with_link_action -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 54 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4268" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "14.726978" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.463410" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3944" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3852" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013021" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013248" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4128" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4252" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132896825617749616" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.106495" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3024 msedge.exe 3024 msedge.exe 3112 msedge.exe 3112 msedge.exe 1472 identity_helper.exe 1472 identity_helper.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
slinkylmao.exepid process 3532 slinkylmao.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
TiWorker.exedescription pid process Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe Token: SeRestorePrivilege 4208 TiWorker.exe Token: SeSecurityPrivilege 4208 TiWorker.exe Token: SeBackupPrivilege 4208 TiWorker.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 3112 msedge.exe 3112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
slinkylmao.exemsedge.exedescription pid process target process PID 3532 wrote to memory of 3112 3532 slinkylmao.exe msedge.exe PID 3532 wrote to memory of 3112 3532 slinkylmao.exe msedge.exe PID 3112 wrote to memory of 4020 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 4020 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2644 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 3024 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 3024 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe PID 3112 wrote to memory of 2264 3112 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\all\clickers\slinkylmao.exe"C:\Users\Admin\AppData\Local\Temp\all\clickers\slinkylmao.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\all\clickers\Slinky.pdf2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe0a3b46f8,0x7ffe0a3b4708,0x7ffe0a3b47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5220 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=2224 /prefetch:63⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ff6c2675460,0x7ff6c2675470,0x7ff6c26754804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5968 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6432 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6120 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3848 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3956 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3844 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17209851881859224687,9062215810092852200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3660 /prefetch:83⤵
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wsappx -p1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\AdvertisingMD5
4e9962558e74db5038d8073a5b3431aa
SHA13cd097d9dd4b16a69efbb0fd1efe862867822146
SHA2566f81212bd841eca89aa6f291818b4ad2582d7cdb4e488adea98261494bdcd279
SHA512fcd76bca998afc517c87de0db6ee54e45aa2263fa7b91653ac3adb34c41f3681fbe19d673ae9b24fdf3d53f5af4e4968e603a1eb557207f8860ac51372026b2e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\AnalyticsMD5
fad197d6ffd32d1268b9e7e8d13ab32a
SHA1b0129887a75965bb2ef56a2c39d3231e5b87265d
SHA2564e446af739e1a06b48a73607e9441bc4aa34ceafd808ff845864408179a4d2c3
SHA51201d9f588bfa315e316ff0ff4a15a0a49144fd77ee89960882cd528d7f7a277b086667cea2357c3ca2bd16a2b3f4aeb7fcaf473501b499101be68acbe1e0126cb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\CompatExceptionsMD5
900263477e1368869fbf1be99990c878
SHA1e56e199aa4119f3cc4c4d46f96daea89bbf9685a
SHA2567f660d9db521646e9c6510d844b6c6ea26716b620c46f34edaf7ce318a9473e4
SHA5121035b388b4b00c744824d13c5ef48118d88abbb53e9d76896a2d96a2a127a7739c119e781d7d5f0b8d910e10539c0c502c9f937fc2487747c65e7285f4b1e6d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\ContentMD5
94c183b842784d0ae69f8aa57c8ac015
SHA1c5b1ebc2b5c140ccbb21cd377ca18f3c5d0b80cd
SHA256aa5c4d50684aa478d5982e509cbf1f8347fbc9cc75cb847d54915c16c3a33d25
SHA5125808ddb81657acf4712fa845c95aacbab32a414ffda3b9d1218637e2d53bd3e0d6b95c872779ead6eaa13b4d2d563494ad5587337958bd17f1e791fad5d822fb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\CryptominingMD5
8c31feb9c3faaa9794aa22ce9f48bfbd
SHA1f5411608a15e803afc97961b310bb21a6a8bd5b6
SHA2566016fd3685046b33c7a2b1e785ac757df20e7c760abe0c27e1b8b0294222421d
SHA512ba4b5886c04ba8f7a7dbb87e96d639783a5969a245de181cf620b8f536e3ac95bbd910cd2f1f6aae6c3cd70fc1ef6209dc10d2b083ec51861b51d83f95811baa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\EntitiesMD5
0d37c9d98f35f2c6524bd9b874ec93ed
SHA187d2d1149db8a1c2d91bc8d2d6e2827d2d8850f5
SHA25619ce05d2716fae5d0d6e2067a7a624c0fa7f8b02486d9469861fd30cf1c499ac
SHA51268e73804a144cbe7287c2136ab1986c4e2a97c497d5bfd36ef5db0f1fb1b4a28839d63d83019082ce61af9b42853934888ce05d6b28350742776b97fa310a575
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\FingerprintingMD5
b51076d21461e00fcbf3dbd2c9e96b2b
SHA131311536cf570f2f9c88d21f03a935ac6e233231
SHA25621a8d3e85d76761a1aab9dca765efef5dfa08d49db037befd91833e4639dd993
SHA5123e193220ddddc47ecea32a2f777e55faa12c7a8052323455c8d7a89c01048155c77ae009fd0f5bebea89f1fae4a88b6b3ceca4e808064f474ea5b3a9497598cb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\OtherMD5
cd0395742b85e2b669eaec1d5f15b65b
SHA143c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA2562b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
SHA5124df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\SocialMD5
152b745da17397ed5a2f3059bb157600
SHA147bf4e575ba1acf47dcc99f1800f753b4cc65ef6
SHA256ef994058a637f7b1b47c31c8670977084d1f86cc21a196920aa87f8ed31e98e8
SHA5124984a8a46eb452b3c62f2c2ca8c9d999de37c39895ad9a9ed91d12a7731b1cd227f335829f7a6927f19cd8bf4dd7d6749fc853461a46fc97853d5b9e23171d31
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\AdvertisingMD5
d024831cae8599f0edee70275d99e843
SHA169e08b543802b130da5305cbb0140bda5601079c
SHA2560b75817b9ce2164f52e537c66bbff0fe53024bf9a00fb193efd63fe48f34a978
SHA512ee1096446f6a17bc3fde9aadb418ca4b2db5132cdde1e429300487aaf4d8b9865a3bbc95d3a3198cde137a6395f69c035b74a72f74edc22a490bccc3320b0b03
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\AnalyticsMD5
4cefbb980962973a354915a49d1b0f4d
SHA11d20148cab5cdadb85fad6041262584a12c2745d
SHA25666de8db363de02974a1471153112e51f014bb05936ce870c433fd9a85b34455a
SHA5126a088bbc6c40454165ddee3183667d2997dca5fcc8312f69e3c2397e61255e49b5146b24c2c64cd3c8867289e3abfdf1155e47722fdd8276f96d51e8f311d4b0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\ContentMD5
7f077f40c2d1ce8e95faa8fdb23ed8b4
SHA12c329e3e20ea559974ddcaabc2c7c22de81e7ad2
SHA256bda08f8b53c121bbc03da1f5c870c016b06fa620a2c02375988555dd12889cdf
SHA512c1fb5d40491ae22a155a9bd115c32cbe9dbcba615545af2f1a252475f9d59844763cd7c177f08277d8ef59e873b7d885fda17f2a504d9ec2c181d0f793cb542b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\CryptominingMD5
4ec1eda0e8a06238ff5bf88569964d59
SHA1a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA256696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
SHA512c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\EntitiesMD5
ba60431b366f83677a5bf1a2e4601799
SHA183f828c27de5429e25c38c36ba77e069d5c7b2de
SHA256ab895ef5f75efd49dbb4fcdf7529e50ca622d13433e067bcf8a1f1127a944da3
SHA512aa9ff0374fb3d4bff7ee5a78dd5ace340da4af1a844f453a40b2723a91b32e6e3f4bd736fb3f3cb210b016109660a7b5cc8440901c6bb410e61530286a4e0200
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\FingerprintingMD5
a004023825237dadc8f934758ff9eaf2
SHA1c981a900b5ce63884635cedfe5ba722416021cb2
SHA2563c4e82aae615a7bed985b4544afecb774b728df1cc9f7561ea25b97482119ef7
SHA512e49667fca51a6497ccae9b881d679b857c025f2945ab93c9a6769b1c0a632329993daefab6eda9ed70a32a75630d7b3d93dda5acda8ff87ffe5f090ca7b35e4f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\OtherMD5
c6c7f3ee1e17acbff6ac22aa89b02e4e
SHA1bdbd0220e54b80b3d2ffbbddadc89bfbb8e64a8b
SHA256a2f9f27d6938a74979d34484bced535412969c2533dc694bfa667fe81d66d7d4
SHA51286ed28ffdd00b4a397a20968792fcd30dd4a891a187a7789c00c88b64689b334a11fa087eb54ccee813c181cf891b43184dde7af9a6f33caed2a71e2c445a7b4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\SocialMD5
976b1cf7e3442f88cd8ba26d3f0965bb
SHA1b75438dc71de4ac761d94a215ddbffadcd1225b0
SHA256decde67630f29fc003cb1f2ccbd7371a05079985a9cce93ec93c4fadd8dc5541
SHA512d0472fed72e1eb0a7747a693a0e654fbe92dd028db3cc42377810d90474dd4099ac981cca333eb52c18e75ed04a1f1f79f3bf5957fe8b16086f1252b3454b8d5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\StagingMD5
9ca5eb41a53645be63d247ad8a9a7869
SHA12e98b04b5a2efb04d20bc7fe51b05c4e4841205b
SHA256f67c58a61ddef715b01debc66ddc0e3c365295ac9870328f6b8bdbcb02a6b8c9
SHA5127dd7d295ccce957490f025eef124b22c809f140a96003126b801bbbdd94eb2115ee59e7d16dd1f020b1d6eaaff66853b9de2cbf7092c1692f40dbe21ab346fd8
-
C:\Users\Admin\AppData\Local\Temp\all\clickers\Slinky.pdfMD5
8a651d3c642d4da38c54124b8a045804
SHA18006c155846f5a7a422a84eebd4ac175fc895da5
SHA256ce7e7f6efec617fd75d599ec48a2a162cf2f520dd982d168c6caf596a74567bb
SHA5126a9a40511b8cf13a0f8c147c0cd503bb1584a6178cbeb91a58b6ae1f28ce9fb54f396fd0faeb7cd2c0d369fe349c4e54c27c32252f40092f0391e63fd68ac62b
-
\??\pipe\LOCAL\crashpad_3112_ECUMOCYLROYITJDVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2264-138-0x00007FFE26490000-0x00007FFE26491000-memory.dmpFilesize
4KB