Analysis
-
max time kernel
138s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2024 08:25
Static task
static1
Behavioral task
behavioral1
Sample
fdm_x64_setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
fdm_x64_setup.exe
Resource
win11-20240802-en
General
-
Target
fdm_x64_setup.exe
-
Size
38.5MB
-
MD5
dded481da831784a00d556a1280c124c
-
SHA1
48b40f82f66dd678f1c2f4c1298eaae2875f75e6
-
SHA256
2937de2eb7763851d644e637cb7d7375fd69b218beeaceedc46254ac388203c7
-
SHA512
78dd1b42e918e9670edaaecd1765fb26e349ab7a5bc7b4dc3b85bd387f073a8ac0a4abc6b8a50d5b3cc6cce753cc8745b26bd47b42953723b21b949e7956cbcd
-
SSDEEP
786432:jketduUzNdogfpTmDvwLIDH8StVQFkatYPexssk:jkiuUtpTmDvwE78+IHUe
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1992 netsh.exe 3276 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fdm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation fdm.exe -
Executes dropped EXE 8 IoCs
Processes:
fdm_x64_setup.tmpfdm.exehelperservice.exeimportwizard.exefdm5rhwin.exefdm5rhwin.exefdm.exeimportwizard.exepid process 856 fdm_x64_setup.tmp 2500 fdm.exe 4572 helperservice.exe 3512 importwizard.exe 3584 fdm5rhwin.exe 3244 fdm5rhwin.exe 4388 fdm.exe 2968 importwizard.exe -
Loads dropped DLL 64 IoCs
Processes:
fdm.exeimportwizard.exehelperservice.exepid process 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 2500 fdm.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 3512 importwizard.exe 4572 helperservice.exe 4572 helperservice.exe 4572 helperservice.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fdm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Download Manager = "\"C:\\Program Files\\Softdeluxe\\Free Download Manager\\fdm.exe\" --hidden" fdm.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
fdm.exedescription ioc process File opened (read-only) \??\D: fdm.exe File opened (read-only) \??\F: fdm.exe -
Drops file in Program Files directory 64 IoCs
Processes:
fdm_x64_setup.tmpdescription ioc process File created C:\Program Files\Softdeluxe\Free Download Manager\iconengines\is-OOTRG.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\Qt5Compat\GraphicalEffects\is-ORC7J.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\Qt5Compat\GraphicalEffects\private\is-7DDAB.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQml\Models\is-E7Q92.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Imagine\is-42HGO.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-GKJGF.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\Qt5Compat\GraphicalEffects\is-FJAM2.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Material\is-7T0HF.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\main\is-0ENS6.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-I8CFK.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Basic\is-228MJ.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Imagine\is-FH14I.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Dialogs\quickimpl\qml\is-RRO57.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\main\is-4ATVU.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\impl\is-MEKBL.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Material\is-UE3D8.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Material\is-3AQEN.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\multimedia\is-0AKMQ.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\Qt5Compat\GraphicalEffects\is-7EOJI.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Basic\is-T88QT.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Fusion\is-BV7G3.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Imagine\is-E3S46.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Universal\is-A8H63.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Universal\impl\is-ASU3M.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Imagine\is-FO1SU.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Material\impl\is-ODFQ3.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Windows\is-CPF53.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-K9MUR.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-99NKE.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\imageformats\is-6UR7U.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Basic\is-8LTE6.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Imagine\is-OANMR.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Templates\is-K3G7G.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\tls\is-J6G10.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Universal\impl\is-K68EP.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\NativeStyle\controls\is-HTIL8.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\NativeStyle\controls\is-4NL9M.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\platforms\is-O7B61.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Basic\is-R9AIK.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Fusion\is-27FO2.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Imagine\is-Q4A8C.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Universal\is-GP974.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Window\is-AC1TP.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Basic\is-5TVL8.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Imagine\is-6IK7A.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Windows\is-KU861.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Basic\is-TH97Q.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Basic\is-DLRDF.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-FVKTG.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Universal\is-66GOD.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Dialogs\quickimpl\qml\+Material\is-1VPP6.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\main\is-BUJO3.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Basic\is-PE2VI.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Universal\is-BBKKT.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Universal\is-IJAVD.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Universal\is-SF4SG.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Dialogs\quickimpl\qml\is-3N0RV.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-9QPN3.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\Qt5Compat\GraphicalEffects\is-TU3MN.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Fusion\is-6VMSV.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\NativeStyle\controls\is-1QUNL.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qmltooling\is-27T94.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Basic\impl\is-RP1SA.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Material\is-77FD9.tmp fdm_x64_setup.tmp -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
Processes:
resource yara_rule C:\Program Files\Softdeluxe\Free Download Manager\libcrypto-3-x64.dll embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fdm_x64_setup.tmpfdm_x64_setup.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdm_x64_setup.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdm_x64_setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Processes:
fdm_x64_setup.tmpdescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\fdm.exe = "1" fdm_x64_setup.tmp Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING fdm_x64_setup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\fdm.exe = "1" fdm_x64_setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION fdm_x64_setup.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\fdm.exe = "11000" fdm_x64_setup.tmp Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION fdm_x64_setup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\fdm.exe = "11000" fdm_x64_setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING fdm_x64_setup.tmp -
Modifies registry class 64 IoCs
Processes:
fdm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\FreeDownloadManager6_torrent\DefaultIcon\ = "\"C:/Program Files/Softdeluxe/Free Download Manager/fdm.exe\", 1" fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\Content Type = "application/x-magnet" fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\shell\ = "open" fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\shell\open\command fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\FreeDownloadManager6_torrent\shell\open\command\ fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg fdm.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17} fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\FreeDownloadManager6_torrent\shell\open fdm.exe Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff fdm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\shell fdm.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads" fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\DefaultIcon\ fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17}\command fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\shell\open fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\shell\ fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\FreeDownloadManager6_torrent\shell\open\command fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" fdm.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\shell\ = "open" fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\shell\ fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17}\icon fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings fdm.exe Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 fdm.exe Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff fdm.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\DefaultIcon\ fdm.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" fdm.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17} fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Program Files\\Softdeluxe\\Free Download Manager\\fdm.exe\", 1" fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\FreeDownloadManager6_torrent\DefaultIcon\ fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.torrent\ = "FreeDownloadManager6_torrent" fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\shell\open\command\ fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\shell fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\shell\open\command\ fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell fdm.exe Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 fdm.exe Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe110000002389f373d7e4da01e1c1ed2de0e4da01e1c1ed2de0e4da0114000000 fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17}\icon fdm.exe Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\shell\open fdm.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" fdm.exe Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\URL Protocol fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\shell\open\command\ = "\"C:\\Program Files\\Softdeluxe\\Free Download Manager\\fdm.exe\" \"%1\"" fdm.exe Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17}\ fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\Content Type fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\fdm\shell\open\command fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\magnet\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17}\command fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\FreeDownloadManager6_torrent\ = "Bittorrent files" fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\FreeDownloadManager6_torrent\shell\open\command\ = "\"C:\\Program Files\\Softdeluxe\\Free Download Manager\\fdm.exe\" \"%1\"" fdm.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\.torrent\ fdm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
fdm.exefdm.exepid process 2500 fdm.exe 4388 fdm.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
fdm5rhwin.exefdm5rhwin.exemsedge.exemsedge.exeidentity_helper.exepid process 3584 fdm5rhwin.exe 3584 fdm5rhwin.exe 3244 fdm5rhwin.exe 3244 fdm5rhwin.exe 4520 msedge.exe 4520 msedge.exe 3620 msedge.exe 3620 msedge.exe 212 identity_helper.exe 212 identity_helper.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
fdm.exepid process 4388 fdm.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fdm.exedescription pid process Token: SeIncreaseQuotaPrivilege 2500 fdm.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
fdm_x64_setup.tmpmsedge.exefdm.exepid process 856 fdm_x64_setup.tmp 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 4388 fdm.exe 4388 fdm.exe 4388 fdm.exe 4388 fdm.exe 4388 fdm.exe 4388 fdm.exe 4388 fdm.exe -
Suspicious use of SendNotifyMessage 30 IoCs
Processes:
msedge.exefdm.exepid process 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 4388 fdm.exe 4388 fdm.exe 4388 fdm.exe 4388 fdm.exe 4388 fdm.exe 4388 fdm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
fdm.exepid process 4388 fdm.exe 4388 fdm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fdm_x64_setup.exefdm_x64_setup.tmpfdm.exemsedge.exedescription pid process target process PID 2572 wrote to memory of 856 2572 fdm_x64_setup.exe fdm_x64_setup.tmp PID 2572 wrote to memory of 856 2572 fdm_x64_setup.exe fdm_x64_setup.tmp PID 2572 wrote to memory of 856 2572 fdm_x64_setup.exe fdm_x64_setup.tmp PID 856 wrote to memory of 2820 856 fdm_x64_setup.tmp schtasks.exe PID 856 wrote to memory of 2820 856 fdm_x64_setup.tmp schtasks.exe PID 856 wrote to memory of 552 856 fdm_x64_setup.tmp schtasks.exe PID 856 wrote to memory of 552 856 fdm_x64_setup.tmp schtasks.exe PID 856 wrote to memory of 2144 856 fdm_x64_setup.tmp schtasks.exe PID 856 wrote to memory of 2144 856 fdm_x64_setup.tmp schtasks.exe PID 856 wrote to memory of 3616 856 fdm_x64_setup.tmp schtasks.exe PID 856 wrote to memory of 3616 856 fdm_x64_setup.tmp schtasks.exe PID 856 wrote to memory of 2500 856 fdm_x64_setup.tmp fdm.exe PID 856 wrote to memory of 2500 856 fdm_x64_setup.tmp fdm.exe PID 2500 wrote to memory of 3512 2500 fdm.exe importwizard.exe PID 2500 wrote to memory of 3512 2500 fdm.exe importwizard.exe PID 3620 wrote to memory of 8 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 8 3620 msedge.exe msedge.exe PID 856 wrote to memory of 3584 856 fdm_x64_setup.tmp fdm5rhwin.exe PID 856 wrote to memory of 3584 856 fdm_x64_setup.tmp fdm5rhwin.exe PID 856 wrote to memory of 3244 856 fdm_x64_setup.tmp fdm5rhwin.exe PID 856 wrote to memory of 3244 856 fdm_x64_setup.tmp fdm5rhwin.exe PID 856 wrote to memory of 1992 856 fdm_x64_setup.tmp netsh.exe PID 856 wrote to memory of 1992 856 fdm_x64_setup.tmp netsh.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4876 3620 msedge.exe msedge.exe PID 3620 wrote to memory of 4520 3620 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NFU6G.tmp\fdm_x64_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-NFU6G.tmp\fdm_x64_setup.tmp" /SL5="$601D4,39406194,832512,C:\Users\Admin\AppData\Local\Temp\fdm_x64_setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /end /tn FreeDownloadManagerHelperService3⤵
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /create /RU SYSTEM /tn FreeDownloadManagerHelperService /f /xml "C:\Program Files\Softdeluxe\Free Download Manager\service.xml"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /change /tn FreeDownloadManagerHelperService /tr "\"C:\Program Files\Softdeluxe\Free Download Manager\helperservice.exe"\"3⤵
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /run /tn FreeDownloadManagerHelperService3⤵
-
C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe"C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe" --install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Softdeluxe\Free Download Manager\importwizard.exe"C:\Program Files\Softdeluxe\Free Download Manager\importwizard" 3FE02402165644D986B63DE6638495E44⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.freedownloadmanager.org/afterinstall.html?os=windows&osversion=10.0&osarchitecture=x86_64&architecture=x86_64&version=6.24.0.5818&uuid=55365c84-c901-41ba-87dc-e18832f590c1&locale=en_US&ac=1&au=14⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef42346f8,0x7ffef4234708,0x7ffef42347185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11845635576659804352,1815915824935833883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:15⤵
-
C:\Program Files\Softdeluxe\Free Download Manager\fdm5rhwin.exe"C:\Program Files\Softdeluxe\Free Download Manager\fdm5rhwin.exe" 21907CB0205CFF989F82C03684A01B86 phase13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Softdeluxe\Free Download Manager\fdm5rhwin.exe"C:\Program Files\Softdeluxe\Free Download Manager\fdm5rhwin.exe" 21907CB0205CFF989F82C03684A01B86 phase23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exe"netsh.exe" firewall add allowedprogram program="C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe" name="Free Download Manager" ENABLE scope=ALL profile=ALL3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\system32\netsh.exe"netsh.exe" firewall add allowedprogram program="C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe" name="Free Download Manager" ENABLE scope=ALL profile=CURRENT3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe"C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe" --byinstaller3⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Softdeluxe\Free Download Manager\importwizard.exe"C:\Program Files\Softdeluxe\Free Download Manager\importwizard" 3FE02402165644D986B63DE6638495E4 --printFdm5Setting=ExpectingUpdateToVersion4⤵
- Executes dropped EXE
-
C:\Program Files\Softdeluxe\Free Download Manager\helperservice.exe"C:\Program Files\Softdeluxe\Free Download Manager\helperservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6Core.dllFilesize
6.0MB
MD546a0dbd38cb28d8e79c80c9a033f6ae9
SHA11be5f3e78485f9b08e32346f13155a94001de50e
SHA256225bd38093416c825f2e3220213f64e1079e9ab20f4738decc0fc6eb992e8a9e
SHA5123fb62bce7b1d5129237914269aa3dd9a24f9e797927f2f4f937a0a291d357a40ec51b9c829094dc0bae1edcd6c580f1c9a03ca2c84d5526599c3608246f00bd0
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6Core5Compat.dllFilesize
851KB
MD5e50b9b3fa16362c86a40e6255c6b45e7
SHA1fa8ce8fd6d4415abdb67597735575dc83a8fc634
SHA256c95ab3df8dc0bfd92925b7b8b51bce859ae09008691874a5c6f5630969557564
SHA51203a8ac0ae14e8420dd9fd91bc1619d072882d152127b3f2f1c6f7e670b7c54c524490e7c84a7cd0b76e2db413439a1ca55c4e03416fd6beb47b1067c3e960cba
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6Gui.dllFilesize
8.5MB
MD57875aad0d0d426e9d1b132a35266de32
SHA18b7656e3412ae546153d2d3df91a6ff506d64749
SHA256fc2464f62d7915ddeaebb5490bee6d60e7b42ad5a223d5812f0993c27c35be19
SHA5129fa16c5c628f2e9b242323aed4c1aa70f093cee9f341ac61640287ff9be8663658f502769e037a8409943d3c9ab826bb1c6f88532f0fbacdaea28b2353cdfba9
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6Multimedia.dllFilesize
833KB
MD5e8fa5ba349752d18f6302434658229f4
SHA11e7696e1ae887734f017e7c4e521ff648e090508
SHA2567b2aaffd8bd1b042d1d028b071d4fbb42420f52d04f45de06c4a80315b9f1b29
SHA512771a41622b045724604568c18e5df00f99b3da3fa67d25f5a60024db34b01b7b70cd0aa9bb39c53cab4eef7a6059e5855fb205e83d131580626a4b43505bf621
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6Network.dllFilesize
1.4MB
MD5960f50470059381c65833145036fef29
SHA1270e230bfc9248e5ecff9ea8dfbc5f1066df02ee
SHA2561071f4f88c65317401bf93a2ffb55e661adcbb84f05911879ab21a6656521a68
SHA512cb0a0d63aaae1b9646dad722759b1c53b36ed13a4231a30b054f6124bcc69e7285c5777ab6bbbb8296756d6c31fc94e735db42c5155db35274e0ec25c1406582
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6OpenGL.dllFilesize
1.9MB
MD52a2a628e23cada5d2eba63dee642438e
SHA173cbc92073eaedde3f2fc432edda0677e7a49c9d
SHA256054b0a8d87fc735aa2eb281e5078f8d28bd1c395b7e32de13ef64a8bbc10bb04
SHA512ca87b5e95ba9c3b1268b14a6587305ea52512224e9ba48e73e64b292713df295e9d64587f446fd28f0e2788d7cb78ca460d962f06cf43ccde53fe45ae65cbe90
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6Qml.dllFilesize
4.8MB
MD56404ca802e99e8520d6229982e382cf0
SHA1204e0446b4989ef2df2c71a4ef7482240039da45
SHA256477747d49a8b7f51c408fe7a49cc3dcfa99078040d3059c5586c77d9b04d1a0d
SHA51290998283c98eb7002cb0342b664a9f03902a6ee8141781ab03f723fddfb925d0a0e450e3c89589eebec41b95f1e73ec298808857151782b3c00b6c3fecf17df0
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6QmlModels.dllFilesize
708KB
MD5623c7740fc301a398c40dc9504d04fd6
SHA1fb0e711c49c2ff488c7d3be9daebe2779bd42157
SHA2564ae023a87636f5c70c08dbd787e47eecfa0ac15ff741677db323d70bd70a36a1
SHA5122343081e57448e3922eeb86bcedb861ed8fde1dc51ab0e42e7930cf07834e9fcfe41a9b1d64a89341037abee421d242d4ece91dec8a8b26a0a552989e130fc34
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6Quick.dllFilesize
5.3MB
MD5e739a7f0e54081125d1381a42eb7c226
SHA120ef3724f878bfe7773e006c29de3ff4e6e8a8c3
SHA25635e8842051211a1654d6717b8786357e7a93b21a004f941151e7a4af23e16a84
SHA512fde9db1793eec6fe1a0818af1b24c8399c941280982bbbb456332aa2768d0950da0caa7bd21e1cbbe81770358cdcdd3a6b199c71df1432170506dadc718d88e1
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6QuickControls2.dllFilesize
87KB
MD58641967f2caf274abb1be307cc70204f
SHA108dea9d79289dc90dc75554baf0dce8eb7c53023
SHA2567065885b1374f55ade04621b52b5ddf6d6e24cb6d57d89d2a1c5cd6bb0d1dede
SHA512a8cee79efcb002aa2eef263ed0492a212b017375577f42de13322a8f8ba9f942fae2b8658fd7468a7a7bf1a19192013fb092efdf7695b8ca7d291990157154f6
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6QuickTemplates2.dllFilesize
1.7MB
MD5f5b138ab4c0ec16233fa6a9d15d9721d
SHA1c927058d73c57bf34dd37ffc4c899945f38556c1
SHA256000013ac37fb5f210fde72ee1d4b175dec38c45d6615d306e62431753b0d03fd
SHA51240d6becc960d3133c326cce9b7caf1a0d5473605b3c30e935befe60a027f5f3fe5647d3d906a88eab8b347c697758c5a8789949f25bac4ffce3eb2112ba34b90
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6Sql.dllFilesize
291KB
MD504b54b342a7f3b56fe9b327cd3fffa86
SHA1257cbc011eb1c1acb4121a1dbde801411fb3691b
SHA256cec14ed64352d5c6e1e043d716cbd2d4575ddfff2e48633c6e6fa2670895ee59
SHA512493003fa6b37c723ea08b0749348ca96fa0939a384ac452737947eb98195f1c1c78b9fd7c7220d0938cb526afc300232c0e52720d54919ceb05c311d6ed3b62f
-
C:\Program Files\Softdeluxe\Free Download Manager\Qt6Widgets.dllFilesize
6.2MB
MD534abb42b63e71b09b72b48cf5b1dba53
SHA19f3111aab57a5f28a4ce9bf82ea208fa3eadb9a6
SHA256c71e65b882a84f47114590784a256f14ba19202ec30b218ce4841b2c7256060b
SHA51206acab5a04a5d3e6834ddc95229758d4adc7a7f0ef003c80e8d59a8241e295b196aceacce20c88879e1676405a2538d032ec6ac543258538e686878fb29f77f1
-
C:\Program Files\Softdeluxe\Free Download Manager\VCRUNTIME140.dllFilesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
C:\Program Files\Softdeluxe\Free Download Manager\downloadsjsp.dllFilesize
111KB
MD5ac0838c665b3741666667e37e9063bab
SHA10d6f7377aa10b53727b1bc1126b17b7b8c766509
SHA25698867ba613760d132096bc835d0704dde75143dcf5545fffdb452c31fc8adb00
SHA5124d535c928703b0bdfaf5569ea2c8cbc848123225fe6b53fe64db6a71ace06d392093500e1fd3673542adf86c569e7ee8044b812428387e1babb5ed74f6e2530e
-
C:\Program Files\Softdeluxe\Free Download Manager\downloadsms.dllFilesize
623KB
MD5cbbb8b877d4e4abc1cc5f7c87e52e4a3
SHA1e0fbd3bfcbcfe1e9f85e9a03b5411b75cea5d206
SHA25631a9512311013764320feba14e1d849dfc7bc0a689cadf5806a90043945128e5
SHA512c201faefa7fb6fa5eaeb119da7f502951efc3251ad5a76eac1bd139379aa4b6da4f9e73bd0fc8dd0486f4973c9ccf21da401e01839f1a70032ff01bcf754e08d
-
C:\Program Files\Softdeluxe\Free Download Manager\fdm.exeFilesize
7.1MB
MD5b6eb17081c138903a98f4daddc5356ec
SHA195338c82ca76629178c342fabbcaf9fe8ad707cc
SHA25688553acc42f9e638fe19771e0cb2badbe28f569583195d9306c8a8ef6343e297
SHA512ef9242cd41585318d5daa47ac8cffc956672549f4ce9238db6227fa64ce800a7b64a25cd7b7175e3b1769f29fbc37e4b18c28375159eaa3bf294c1a48588e01d
-
C:\Program Files\Softdeluxe\Free Download Manager\helperservice.exeFilesize
136KB
MD5bdd8417b62e8c1dd4352d654b1c0b887
SHA1a4ca880967460b692351efdbf2e94438fb6f2630
SHA2563f58d018ad24f506873b6e4eacae6e19585849e7d6638e72b585cff9a750ebf7
SHA5129e2782c8543583b9f171e4aefd1685f32a70693998addc656169963ed973a93c0c81562c12ca52d07ac94cd628e7cb9909ba519344210cce4a36c64701f78aad
-
C:\Program Files\Softdeluxe\Free Download Manager\iconengines\qsvgicon.dllFilesize
69KB
MD5b57d0218475b81560454e6c0a1a6d9c8
SHA121206763e7121d4792bbf24075c6f6e27c2c11db
SHA2568ab3b526b35a0dec08b4042da70f942b3b5f4d413ad4035c691f972b2008778e
SHA51283464c21073edddcd77dc0978257bf13554ef01825672b60081d9d4ee5caefffe9ed6fbefda0bc7bdc413925b9265981a994195700190cd81cf6b1c93810e891
-
C:\Program Files\Softdeluxe\Free Download Manager\imageformats\qgif.dllFilesize
47KB
MD5000b3771b3dcf0d7eb72750edd80a192
SHA135506ee878b8ad21dbd35876baaf586c30152b71
SHA2566ff0b57822dae5132e1640afe4f8fd6b75e21cf3f1eae53d70373c25a5506581
SHA5124472089f5524172fcfd8d2f8acbf67a3f22b08f788b52d8f42d2736d050cecb87215a9b8d706baca12d5916d3ff79bf57420766746c2484981d679239b3f2924
-
C:\Program Files\Softdeluxe\Free Download Manager\libcrypto-3-x64.dllFilesize
4.6MB
MD5abbed3f87da630930d274871cb794a4b
SHA140398d1aa2c9b9be7aa7744e311b67b5296b0450
SHA2567e8caae0c0e6bf6bc5ece9aad0cae238246a5a98c3409745f571316a50aea54b
SHA51235c04b8ce4702bd6f8629011b382941d24a3122f8d6394e1d6dff3c11549993b16f2d1d4635f16b1d33aa0d5fd0d335d103e2199383934d52527366d6eb624ec
-
C:\Program Files\Softdeluxe\Free Download Manager\logger.dllFilesize
43KB
MD59c93f9c583bb077a23f50c5d64cf1bb9
SHA1d2b2a91bfc9b6cbeccef00a0b8c49f0ca201d78a
SHA2566434f084d00beff3a67b9a20eca0c8a1940d380bc12990258042859cd98c5a20
SHA51227db1a016b6804a5c03d78d163eb6588ffc024c4bcbc0d1c582cdfd7081f351a5ee9beeb6684ca70fb9a1ee24f0eaf0cf8e18120efc5f347db10692d931c04f9
-
C:\Program Files\Softdeluxe\Free Download Manager\msvcp140.dllFilesize
553KB
MD56da7f4530edb350cf9d967d969ccecf8
SHA13e2681ea91f60a7a9ef2407399d13c1ca6aa71e9
SHA2569fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da
SHA5121f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab
-
C:\Program Files\Softdeluxe\Free Download Manager\msvcp140_1.dllFilesize
23KB
MD50832532fab0d5c949aa0c65169aa9d61
SHA126f1bee679b7a6289b663c4fa4e65eba33a234e8
SHA2568731a93e519c2595c9fd489e6d9ac07e964448c0da1c8ee9ee500a7989482617
SHA51203147a59ee35fb3d2752d4c40741a39674ccd4474a575746bc574d2b2fae1fd04f5ab9c2e02b0dc6268fc6aee8fbb46dc4bf5ff23b5fcc4a0e9b847f57ca79d0
-
C:\Program Files\Softdeluxe\Free Download Manager\msvcp140_2.dllFilesize
182KB
MD5e35261e9f4478aabe736bb2269c20b59
SHA1f17330804c159418d4acf7a803662b8c1f7686fd
SHA256366af8e071f004da5d95a832a46b2e8821a8e0294340a93f7c95cf48c441067e
SHA5122694d21431e9b72a9591c4658dc3ade5795a52fcf2bc8631928181a7aeee49184cf741d50e28581b96d439360d21cb176c6bb011db4fa742a2fc64afa38baaf9
-
C:\Program Files\Softdeluxe\Free Download Manager\platforms\qwindows.dllFilesize
869KB
MD56031ccd3785bafba8556008cbc058dfd
SHA1885147d02060dab7b0a124865c8116a478297ce0
SHA2562bdc29b85bd94170f97aadb1cd447eefe7a3ddf7950c535c81a9ef63e17d1ddc
SHA512b35c58cddc461c0160ee223fddcc181d8e6c21b5713fd8d216334b69f6ab1e4c12f4da1d377fd5b718db2c723ab20b673ab89190a3acc88d3cab03ff23bfd23d
-
C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Universal\is-NIKJA.tmpFilesize
1KB
MD563340c8fcb71734ce4bbac29a86821b5
SHA10cfd02b3e95fa482cbd4bd83b0f2d9214acc9709
SHA25678b5fc58e6d881d16351e92d32b8cadea6b14fbf8c20c1bc7e56d02946467ae8
SHA512fe035bb77a32d0fe9d4983d90c65d4c2600a019ac20743dbec409f29ffbfbecd8bca2d15abfffb2e71b77e3c105e248627a176942cdf9d7b98ed9113e6f73ba0
-
C:\Program Files\Softdeluxe\Free Download Manager\qml\QtQuick\Controls\Windows\is-FRSRU.tmpFilesize
215B
MD52006d4b7d0da455aa4c7414653c0018a
SHA16685b8360b97799aa4d6b18789bf84a343e9e891
SHA256a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
SHA512703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84
-
C:\Program Files\Softdeluxe\Free Download Manager\quazip.dllFilesize
227KB
MD5514b4dd973694fe604c7ec22a3ec8481
SHA16285f9ce01e9d061e4d936b7fb44635a9ea19d93
SHA256367ce7cbe3c20048ff6a19383b762efb31a3b5313fc8169a01c9256afd2cb7fd
SHA5124eaacd3a196959d6579bb6c716dbba3d2ebb2f3121641c7b536839bd4c7744da5eae8315f65a4585f35bf76126a4468485b609a4ae9a2c62afd56640055352cb
-
C:\Program Files\Softdeluxe\Free Download Manager\service.xmlFilesize
2KB
MD585c61b85b0ffe2609b00379a5512790d
SHA12dfaf069df408819b06916381ac80b3ec097214c
SHA25624f6062b8679b4140b5c15900deefa8ba187ed5e3c5cb8efc91b26b31769664d
SHA5123a18c17ddcd10cd89d1c666134f13be6ed441fbe2c36a9567e894c0e1674232d5882e696ad2d385bd5eb4d50b6a1b4225bb992389aad93a77b203318293ca6fa
-
C:\Program Files\Softdeluxe\Free Download Manager\styles\qwindowsvistastyle.dllFilesize
140KB
MD5cc096aea386047b0131eea248122c0d2
SHA16251253bbc6e4460884bfc22c1dd30cec32dbac4
SHA25647a22e7958279e7668ace09849a669f7410bf8c7aed752bd6e60f23c9581cd50
SHA5124b097b86a21ac26e8849bf3908de97479b3484f28a68060c06f75515b07b8878466bce4241aae6b0c06a1b671b59b5dd115c760f08dc6d3287f1b875963d1cb1
-
C:\Program Files\Softdeluxe\Free Download Manager\vcruntime140_1.dllFilesize
36KB
MD5135359d350f72ad4bf716b764d39e749
SHA12e59d9bbcce356f0fece56c9c4917a5cacec63d7
SHA25634048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
SHA512cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba
-
C:\Program Files\Softdeluxe\Free Download Manager\vmsclshared.dllFilesize
698KB
MD58a839a29430dca22865dff4f2b5b0124
SHA1600e3b1d00ed8b49e0947a470862da7b8944c48a
SHA2560a8dae7bde1b75351c0f2a030e811f15cf2e341c57828bff22228539c3d574fb
SHA512a374f2313e0f64bde4abf81fb5230cee4a8783c705824d55d44cc45157d272f7a488a4d911ac082eb9851ea4b57fcd817161643538e7587ba8a0feb2274d43c1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
120B
MD55a4b52899c286b1b3c1bf48b576c809a
SHA12e118853d720fa3e16d6273fb135450ebcf185b4
SHA256c257987785508510ba241933f87814df1da069f220fce648cdf9d2a7a0bb9ced
SHA512aaeb92be1198a23955ebf907bf4f2ef1fb4324d4c9a0311d88796638f05d5aecf33fb5fb1ef18870b6ffe595f6136562360bb79e7dd0f0d2ecddbcaaaccf92b1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD5a910251239bc7fd246b870a45330270d
SHA141fd74fbf0166b1b7564885a0ea76d77a2a17815
SHA2561071769e476bfe58da7ab2ebe1fc9c2e2cf72de3c0123bc309be801479dc9688
SHA51235ff4840dd19bbd41dbf711fa4a93189ce2d6544d851489c54bdefe39849b34f2823607970f2a44f2a24b80443f6f2661393b3a9363e50f315699661a799337f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5da8a076afdeeefc543504955078df95c
SHA1f8e8756fe70e0b0692938e4e8f05d6142a7c19a0
SHA256086465c51f6315b018f68fb2b4b7beb3aba24ad6854809798316f954a09892e4
SHA5129bf136fd66dec4d7a3ba9627ec99c88cd7c0c68bef1e4101228b63d5310bb9aa4da000f5177a5f108c1acc2e9c49ec2b47913b0a2fa161200950b642372a34bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD54ae9942b61f3ef6316f8fd3d086e25b5
SHA14a3190942cad4a2180e4ddd1269545441eefd20f
SHA256bbaf044e06e5f54ee8c4edddcdde8315b8f39769fe96b19b5a6aa253e47f11f4
SHA512339ffdbf61aac78ddce100ee69cdfa145933201958482e1f4c6952ab6f4fa87fd0daf8cac2b56ba59c5d31b7164ba3e0a6e7c9fd625ce37e096933d7b2160d63
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5dfc62ffa6cc9fe8efac2836d843d3ede
SHA10bdb773f2be18667702c07e0a58792b4394dd162
SHA2568acb3e481da3befe661196b6664fb300027081b5a439c96e50146153d517cfa6
SHA5124e0b4aeb9aad688048b0bcac57a94571cdf6f6db0e29c691571c4901191e632dcd3e5098d7fda506b0e50094e20d3030c35b044bb76c392085819c5505e38355
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD52479dccf259eb37f1caff7278495ddd9
SHA1107eab957148ebb3808618adb80a1f4d01bd71a3
SHA256d83881e749b74f392b5ff5ddc55a82afc47d48f92401657b39e30a4ad9096f87
SHA512b37429c8780f3a3d27f679e7cda8a82bc8661d7cefec374caa7619de2ad8f275ad1b678d957816a316d6071e0441f45280d5b39381f17bfe4a91915d004602c1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD597731a75e94ee34425ea2f6597a4848b
SHA111d82473609ea06cc062d517b97cc755a8a94e2a
SHA25621faa54202891e8d8f67ad59f921a1e44e87e7b330662d13f354488ba6553031
SHA5127804925ab0bd9ebfceeef569ef71b7cfaa4563260bec0d204d98bc25eb794310eb2172cb3f5112adbd267bc3dcc4ccd01e26d3c1a59a48ed20b96e5dd0964fa7
-
C:\Users\Admin\AppData\Local\Temp\is-NFU6G.tmp\fdm_x64_setup.tmpFilesize
3.1MB
MD560f76f6e78d966f31d9c574c7465899d
SHA12c231f5a57d294ab2b6c1fc6f7902fb453fbeac7
SHA256ced610b7c01111d289a511d35ada43d94fb4b2537ccfc0317a23e1d3eecd3bf8
SHA51259b67dd82d6f3cee823d7fba1722455c52479413664f816c6756e42bee877ba854844b10c90d22e63b3631e3b8b83dbf35912507b7fedd7fda4f2724888e2cf0
-
memory/856-10-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/856-1580-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/856-6-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/856-1783-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/856-9-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/856-1647-0x0000000000400000-0x000000000071C000-memory.dmpFilesize
3.1MB
-
memory/2500-1511-0x00007FFEF7590000-0x00007FFEF7AD5000-memory.dmpFilesize
5.3MB
-
memory/2500-1513-0x00007FF61BE70000-0x00007FF61C59A000-memory.dmpFilesize
7.2MB
-
memory/2500-1509-0x00007FFEF6F60000-0x00007FFEF758D000-memory.dmpFilesize
6.2MB
-
memory/2572-0-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2572-8-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2572-2-0x0000000000401000-0x00000000004B7000-memory.dmpFilesize
728KB
-
memory/2572-1784-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2968-1815-0x00007FFEF52F0000-0x00007FFEF591D000-memory.dmpFilesize
6.2MB
-
memory/3512-1521-0x00007FFEF6F60000-0x00007FFEF758D000-memory.dmpFilesize
6.2MB
-
memory/4388-2302-0x00000148A26B0000-0x00000148A26B1000-memory.dmpFilesize
4KB
-
memory/4388-2292-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-1779-0x00007FF61BE70000-0x00007FF61C59A000-memory.dmpFilesize
7.2MB
-
memory/4388-1824-0x000001489F860000-0x000001489FA62000-memory.dmpFilesize
2.0MB
-
memory/4388-1822-0x000001489F410000-0x000001489F852000-memory.dmpFilesize
4.3MB
-
memory/4388-2268-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2267-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2269-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2307-0x00000148A26B0000-0x00000148A26B1000-memory.dmpFilesize
4KB
-
memory/4388-2306-0x00000148A26C0000-0x00000148A26C1000-memory.dmpFilesize
4KB
-
memory/4388-2305-0x00000148A26C0000-0x00000148A26C1000-memory.dmpFilesize
4KB
-
memory/4388-2303-0x00000148A26B0000-0x00000148A26B1000-memory.dmpFilesize
4KB
-
memory/4388-1780-0x00007FFEF6350000-0x00007FFEF6895000-memory.dmpFilesize
5.3MB
-
memory/4388-2301-0x00000148A26B0000-0x00000148A26B1000-memory.dmpFilesize
4KB
-
memory/4388-2300-0x00000148A26B0000-0x00000148A26B1000-memory.dmpFilesize
4KB
-
memory/4388-2299-0x00000148A26B0000-0x00000148A26B1000-memory.dmpFilesize
4KB
-
memory/4388-2298-0x00000148A26B0000-0x00000148A26B1000-memory.dmpFilesize
4KB
-
memory/4388-2297-0x00000148A26B0000-0x00000148A26B1000-memory.dmpFilesize
4KB
-
memory/4388-2296-0x00000148A26B0000-0x00000148A26B1000-memory.dmpFilesize
4KB
-
memory/4388-2295-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-2294-0x00000148A26B0000-0x00000148A26B1000-memory.dmpFilesize
4KB
-
memory/4388-1781-0x00007FFEF52F0000-0x00007FFEF591D000-memory.dmpFilesize
6.2MB
-
memory/4388-2291-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-2290-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-2289-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-2288-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-2287-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-2286-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-2285-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2284-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-2283-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-2282-0x00000148A26A0000-0x00000148A26A1000-memory.dmpFilesize
4KB
-
memory/4388-2280-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2279-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2278-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2277-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2276-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2275-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2274-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2273-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2272-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2271-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB
-
memory/4388-2270-0x00000148A15A0000-0x00000148A15A1000-memory.dmpFilesize
4KB