Analysis
-
max time kernel
157s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 14:13
Static task
static1
Behavioral task
behavioral1
Sample
ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe
Resource
win10v2004-20220812-en
General
-
Target
ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe
-
Size
445KB
-
MD5
16d37e17c222118325263e4768a27970
-
SHA1
601d4b66fa04fe446a65a3c07c0b00ad5b1dc5b8
-
SHA256
ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9
-
SHA512
fe190482ff9efae7bd3574d541688e015146ac6c03d57270771666aba10fcaff545e385f6cda54a468065b8bae7f6751922e112436a5a5cd025f33b2c78245b9
-
SSDEEP
12288:52JylsKT/eDQ4dvfLKbhseRwJLqEfYKzvE:52Jyx7YvshseR8vE
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmpee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mmGOG.exepid process 1432 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp 4188 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm 4796 GOG.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
GOG.exemsedge.exeee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mmdescription ioc process Key created \REGISTRY\MACHINE\SoftWare\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices GOG.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SoftWare\Microsoft\Windows\CurrentVersion\Run GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SoftWare\Microsoft\Windows\CurrentVersion\Run ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Key created \REGISTRY\MACHINE\SoftWare\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exedescription ioc process File opened (read-only) \??\A: ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened (read-only) \??\B: ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exesetup.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Uninstall.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3d691a6d-6c39-4893-b6c3-d8ad2b1dfb03.tmp setup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221202133420.pma setup.exe File opened for modification C:\Program Files\7-Zip\7z.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe -
Drops file in Windows directory 3 IoCs
Processes:
ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mmGOG.exedescription ioc process File created C:\Windows\GOG.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm File opened for modification C:\Windows\GOG.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm File created C:\Windows\GOG.exe GOG.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 4 IoCs
Processes:
msedge.exeGOG.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exeGOG.exepid process 3260 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe 3260 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe 4796 GOG.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
msedge.exepid process 3044 msedge.exe 3044 msedge.exe 3044 msedge.exe 3044 msedge.exe 3044 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 3044 msedge.exe 3044 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exeee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mmee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmpmsedge.exemsedge.exedescription pid process target process PID 3260 wrote to memory of 1432 3260 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp PID 3260 wrote to memory of 1432 3260 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp PID 3260 wrote to memory of 1432 3260 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp PID 3260 wrote to memory of 4188 3260 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm PID 3260 wrote to memory of 4188 3260 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm PID 3260 wrote to memory of 4188 3260 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm PID 4188 wrote to memory of 4796 4188 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm GOG.exe PID 4188 wrote to memory of 4796 4188 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm GOG.exe PID 4188 wrote to memory of 4796 4188 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm GOG.exe PID 1432 wrote to memory of 2000 1432 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp msedge.exe PID 1432 wrote to memory of 2000 1432 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp msedge.exe PID 2000 wrote to memory of 1852 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 1852 2000 msedge.exe msedge.exe PID 1432 wrote to memory of 3044 1432 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp msedge.exe PID 1432 wrote to memory of 3044 1432 ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp msedge.exe PID 3044 wrote to memory of 3728 3044 msedge.exe msedge.exe PID 3044 wrote to memory of 3728 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 2000 wrote to memory of 4036 2000 msedge.exe msedge.exe PID 3044 wrote to memory of 3000 3044 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe"C:\Users\Admin\AppData\Local\Temp\ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmpC:\Users\Admin\AppData\Local\Temp\ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa683646f8,0x7ffa68364708,0x7ffa683647184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9222219322969680939,374060484025367258,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9222219322969680939,374060484025367258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2736 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmp&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa683646f8,0x7ffa68364708,0x7ffa683647184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3144 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5048 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5772 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7cbc45460,0x7ff7cbc45470,0x7ff7cbc454805⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17952220211121340462,9110633745894864033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:84⤵
-
C:\Users\Admin\AppData\Local\Temp\ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mmC:\Users\Admin\AppData\Local\Temp\ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177Filesize
471B
MD56181e4e33ee379d858217e9e3c32d74f
SHA1f7ae858f7037e536203cbf1704d2a431b6f5f059
SHA25614844456416b1ef58fdff151b4cd0968ae95acb524ef369f225bfa0991e08a6f
SHA512d4196c5178acfdfc1f176bb21166f5974321e0d0550b44330c2a2dabc7b3e56521eaaa10e1cf5731e8eba4d82a7e722b658bad8154cd06afab4e8178e5611eca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEFilesize
471B
MD50ceb959707bc4a9a9a94e3881584aab0
SHA180f8154bab75b5c54a116dcd25e2d8b20e187ce0
SHA25634e300ba0c264a6dc331be37fa3874a0f793b86dfcb6fb7ad4b184cd246318cb
SHA51226b482b5e4a489f080ebff21f6f267cf01938549ea8f413786f58b5fc5cb66f79fcca3c5e5ee89c6e49b34fd752b66f8f3c3ac790ecd7c8bbe2d608694248458
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177Filesize
442B
MD5d0e387722300536a3420b160aa70a2d9
SHA1f9baec932d625709106b5207373eedd2bf961528
SHA25694fb1173c74ec615955ea7f97af0ad38e75c5d800e2e46a78b06ed39957c8420
SHA512a75b32757a693d1a7828ff77e26e3a1707d159f113e865716cf4e26657c1043672875cc8ae3cea842700ff7bdff2046c64eaa01cf8add64d25fd7a4b9f928374
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177Filesize
442B
MD5d0e387722300536a3420b160aa70a2d9
SHA1f9baec932d625709106b5207373eedd2bf961528
SHA25694fb1173c74ec615955ea7f97af0ad38e75c5d800e2e46a78b06ed39957c8420
SHA512a75b32757a693d1a7828ff77e26e3a1707d159f113e865716cf4e26657c1043672875cc8ae3cea842700ff7bdff2046c64eaa01cf8add64d25fd7a4b9f928374
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEFilesize
446B
MD5ce5e032099a34450dd941a30dc576538
SHA1a335741ef8cb09f4e2c149fd1b73e3093fa8cc59
SHA2562c9ce7bb542d01cb663d3b1c2dd07b014e150da7e2618adef91e38f9f3e92cda
SHA5124405d05b78eac304c6b2b2531c0b879c76d6cf17da3f5b4b288f41666213ffda462cd79989fcb779f61068b8ea790df35dff570ccd2454b3a22cce3991b2e67e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1661723f09a6aed8290c3f836ef2c2b
SHA155e08c810da94c08c5ee54ace181d4347f4e2ae5
SHA256a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2
SHA512dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1661723f09a6aed8290c3f836ef2c2b
SHA155e08c810da94c08c5ee54ace181d4347f4e2ae5
SHA256a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2
SHA512dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1661723f09a6aed8290c3f836ef2c2b
SHA155e08c810da94c08c5ee54ace181d4347f4e2ae5
SHA256a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2
SHA512dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b3f352bbc8046d1d5d84c5bb693e2e5
SHA1e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c
SHA256471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da
SHA512c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b3f352bbc8046d1d5d84c5bb693e2e5
SHA1e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c
SHA256471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da
SHA512c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last VersionFilesize
11B
MD5838a7b32aefb618130392bc7d006aa2e
SHA15159e0f18c9e68f0e75e2239875aa994847b8290
SHA256ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA5129e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettingsFilesize
81B
MD5f222079e71469c4d129b335b7c91355e
SHA10056c3003874efef229a5875742559c8c59887dc
SHA256e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00
SHA512e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1Filesize
126KB
MD56698422bea0359f6d385a4d059c47301
SHA1b1107d1f8cc1ef600531ed87cea1c41b7be474f6
SHA2562f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
SHA512d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUrisFilesize
40B
MD51298ddbfd718966c1f9e8c8c5625f929
SHA14636d14e85d48d6887274d2860b70d74a73d730b
SHA25637a4f35f0af55a0f7becfe5b564701f8700956e987830b22466c0464182b2af8
SHA512a14444c93d6ce4f9bc3ad7096bd2e47fa86e410a5b13c28e9aa6bc5fb52a21101fda8903a25842ac47f8d60c630bdcee03e253bfdc2f9b3f08dffb00fefa8d65
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638055800011563681Filesize
4KB
MD5fe5a0721b5427bba4d77c9a299895da4
SHA168839275ef5e292d0adac37d5945a71cfb2e8bf2
SHA256b45b1a892449e04c1c7724f58a2dd1582476fdfc3794439e5d7e054cb6ca7e1d
SHA512ad35a7fa3d214c2c7e4642f86ba6e4ce5f3302fcfb87a024e2dce8495a85852fbd2d93aabd7ad87d1f886615605836bb9df2ecd8a2dfe6edbdc84d7549889bb5
-
C:\Users\Admin\AppData\Local\Temp\ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mmFilesize
353KB
MD50373307af7a45b541fd37d1b1c85ebd1
SHA165f9ab8e12ae9fa014c687fbe22cdecfed5463a8
SHA2567e2ef30ee7f2bebabb894d70e50884aeda492881cc673e7f5bc3433e2512d2de
SHA512c7f141a878e7528c77966a4f38da320df059349e25591d02c31d79a56a492c2425d4368fd2ad747b3c0b021a3d36162dd6394b8a702e44617a16cc444fffc720
-
C:\Users\Admin\AppData\Local\Temp\ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.mmFilesize
353KB
MD50373307af7a45b541fd37d1b1c85ebd1
SHA165f9ab8e12ae9fa014c687fbe22cdecfed5463a8
SHA2567e2ef30ee7f2bebabb894d70e50884aeda492881cc673e7f5bc3433e2512d2de
SHA512c7f141a878e7528c77966a4f38da320df059349e25591d02c31d79a56a492c2425d4368fd2ad747b3c0b021a3d36162dd6394b8a702e44617a16cc444fffc720
-
C:\Users\Admin\AppData\Local\Temp\ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmpFilesize
92KB
MD50723c2e313b55a02f1fc19647a932c6f
SHA1c24c9e34e9f13301256db866a8348d8651bafaad
SHA256ad7520d9a6fa20744b857c79a3dd24280f60bf6897b23a26dcebb4e9bc3f6cf2
SHA51216e88638efa026a3f7079940d12f7f05b0243364ae0aabe903a7fec57f421ff43385268a561f1db073cf16f24186fb977d575e538d6cb159bb7e2be66555693a
-
C:\Users\Admin\AppData\Local\Temp\ee129d94c21db49d32e8617814364468d9fcd17f543f7e4c30259560e31844b9.tmpFilesize
92KB
MD50723c2e313b55a02f1fc19647a932c6f
SHA1c24c9e34e9f13301256db866a8348d8651bafaad
SHA256ad7520d9a6fa20744b857c79a3dd24280f60bf6897b23a26dcebb4e9bc3f6cf2
SHA51216e88638efa026a3f7079940d12f7f05b0243364ae0aabe903a7fec57f421ff43385268a561f1db073cf16f24186fb977d575e538d6cb159bb7e2be66555693a
-
C:\Windows\GOG.exeFilesize
353KB
MD50373307af7a45b541fd37d1b1c85ebd1
SHA165f9ab8e12ae9fa014c687fbe22cdecfed5463a8
SHA2567e2ef30ee7f2bebabb894d70e50884aeda492881cc673e7f5bc3433e2512d2de
SHA512c7f141a878e7528c77966a4f38da320df059349e25591d02c31d79a56a492c2425d4368fd2ad747b3c0b021a3d36162dd6394b8a702e44617a16cc444fffc720
-
C:\Windows\GOG.exeFilesize
353KB
MD50373307af7a45b541fd37d1b1c85ebd1
SHA165f9ab8e12ae9fa014c687fbe22cdecfed5463a8
SHA2567e2ef30ee7f2bebabb894d70e50884aeda492881cc673e7f5bc3433e2512d2de
SHA512c7f141a878e7528c77966a4f38da320df059349e25591d02c31d79a56a492c2425d4368fd2ad747b3c0b021a3d36162dd6394b8a702e44617a16cc444fffc720
-
\??\pipe\LOCAL\crashpad_2000_IZFIYAFYNFIXDZCAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_3044_TNWIWQBWWOTCCVTMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/840-174-0x0000000000000000-mapping.dmp
-
memory/1180-187-0x0000000000000000-mapping.dmp
-
memory/1240-180-0x0000000000000000-mapping.dmp
-
memory/1432-132-0x0000000000000000-mapping.dmp
-
memory/1852-142-0x0000000000000000-mapping.dmp
-
memory/2000-141-0x0000000000000000-mapping.dmp
-
memory/2196-157-0x0000000000000000-mapping.dmp
-
memory/2528-155-0x0000000000000000-mapping.dmp
-
memory/3000-151-0x0000000000000000-mapping.dmp
-
memory/3012-170-0x0000000000000000-mapping.dmp
-
memory/3044-143-0x0000000000000000-mapping.dmp
-
memory/3112-186-0x0000000000000000-mapping.dmp
-
memory/3276-184-0x0000000000000000-mapping.dmp
-
memory/3460-185-0x0000000000000000-mapping.dmp
-
memory/3544-178-0x0000000000000000-mapping.dmp
-
memory/3728-144-0x0000000000000000-mapping.dmp
-
memory/3832-182-0x0000000000000000-mapping.dmp
-
memory/4036-150-0x0000000000000000-mapping.dmp
-
memory/4188-134-0x0000000000000000-mapping.dmp
-
memory/4796-137-0x0000000000000000-mapping.dmp
-
memory/4824-172-0x0000000000000000-mapping.dmp
-
memory/5024-176-0x0000000000000000-mapping.dmp