Trojan.Siggen32.21163

Technical Information

Malicious functions

Injects code into

the following user processes:

msedge.exe

Modifies file system

Creates the following files

%TEMP%\_mei18162\crypto\cipher\_arc4.pyd
%TEMP%\_mei18162\crypto\cipher\_salsa20.pyd
%TEMP%\_mei18162\crypto\cipher\_chacha20.pyd
%TEMP%\_mei18162\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_des.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei18162\crypto\hash\_blake2b.pyd
%TEMP%\_mei18162\crypto\hash\_blake2s.pyd
%TEMP%\_mei18162\crypto\hash\_md2.pyd
%TEMP%\_mei18162\crypto\hash\_md4.pyd
%TEMP%\_mei18162\crypto\hash\_md5.pyd
%TEMP%\_mei18162\crypto\hash\_ripemd160.pyd
%TEMP%\_mei18162\crypto\hash\_sha1.pyd
%TEMP%\_mei18162\crypto\hash\_sha224.pyd
%TEMP%\_mei18162\crypto\hash\_sha256.pyd
%TEMP%\_mei18162\crypto\hash\_sha384.pyd
%TEMP%\_mei18162\crypto\hash\_sha512.pyd
%TEMP%\_mei18162\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei18162\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei18162\crypto\hash\_keccak.pyd
%TEMP%\_mei18162\crypto\hash\_poly1305.pyd
%TEMP%\_mei18162\crypto\math\_modexp.pyd
%TEMP%\_mei18162\crypto\protocol\_scrypt.pyd
%TEMP%\_mei18162\crypto\publickey\_curve25519.pyd
%TEMP%\_mei18162\crypto\publickey\_curve448.pyd
%TEMP%\_mei18162\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei18162\crypto\publickey\_ed25519.pyd
%TEMP%\_mei18162\crypto\publickey\_ed448.pyd
%TEMP%\_mei18162\crypto\util\_cpuid_c.pyd
%TEMP%\_mei18162\crypto\util\_strxor.pyd
%TEMP%\_mei18162\vcruntime140.dll
%TEMP%\_mei18162\vcruntime140_1.dll
%TEMP%\_mei18162\_asyncio.pyd
%TEMP%\_mei18162\_bz2.pyd
%TEMP%\_mei18162\_cffi_backend.cp312-win_amd64.pyd
%TEMP%\_mei18162\_ctypes.pyd
%TEMP%\_mei18162\_decimal.pyd
%TEMP%\_mei18162\_hashlib.pyd
%TEMP%\_mei18162\_lzma.pyd
%TEMP%\_mei18162\_multiprocessing.pyd
%TEMP%\_mei18162\_overlapped.pyd
%TEMP%\_mei18162\_queue.pyd
%TEMP%\_mei18162\_socket.pyd
%TEMP%\_mei18162\_sqlite3.pyd
%TEMP%\_mei18162\_ssl.pyd
%TEMP%\_mei18162\_wmi.pyd
%TEMP%\_mei18162\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei18162\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei18162\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei18162\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei18162\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei18162\base_library.zip
%TEMP%\_mei18162\bcrypt\_bcrypt.pyd
%TEMP%\_mei18162\certifi\cacert.pem
%TEMP%\_mei18162\charset_normalizer\md.cp312-win_amd64.pyd
%TEMP%\_mei18162\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
%TEMP%\_mei18162\chrome.exe
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\installer
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\metadata
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\record
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\wheel
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\licenses\license
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\licenses\license.apache
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\licenses\license.bsd
%TEMP%\_mei18162\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei18162\libcrypto-3.dll
%TEMP%\_mei18162\libffi-8.dll
%TEMP%\_mei18162\libssl-3.dll
%TEMP%\_mei18162\pyexpat.pyd
%TEMP%\_mei18162\python3.dll
%TEMP%\_mei18162\python312.dll
%TEMP%\_mei18162\pywin32_system32\pywintypes312.dll
%TEMP%\_mei18162\select.pyd
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
%TEMP%\_mei18162\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei18162\sqlite3.dll
%TEMP%\_mei18162\ucrtbase.dll
%TEMP%\_mei18162\unicodedata.pyd
%TEMP%\_mei18162\win32\win32crypt.pyd
<Current directory>\edge_tmp.db
<Current directory>\cookies.txt
%TEMP%\xc7vityg
%TEMP%\dump_proc_1769561383\default\readme
%TEMP%\dump_proc_1769561383\default\web data-journal
%TEMP%\etilqs_srizqrmca3kguqa
%TEMP%\dump_proc_1769561383\default\history-journal
%TEMP%\etilqs_90jgrbd72xtiok5
%TEMP%\dump_proc_1769561383\default\data_reduction_proxy_leveldb\manifest-000001
%TEMP%\dump_proc_1769561383\default\data_reduction_proxy_leveldb\000001.dbtmp
%TEMP%\dump_proc_1769561383\default\extension cookies-journal
%TEMP%\etilqs_h3ededeslwvivtg
%TEMP%\dump_proc_1769561383\default\data_reduction_proxy_leveldb\log
%TEMP%\dump_proc_1769561383\default\732d.tmp
%TEMP%\dump_proc_1769561383\default\web data
%TEMP%\dump_proc_1769561383\default\history
%TEMP%\dump_proc_1769561383\default\extension cookies
%TEMP%\dump_proc_1769561383\default\favicons-journal
%TEMP%\etilqs_8z6vhkfbs9m1bhl
%TEMP%\dump_proc_1769561383\default\login data-journal
%TEMP%\etilqs_l6mbtsqdh4rykdd
%TEMP%\dump_proc_1769561383\default\favicons
%TEMP%\dump_proc_1769561383\default\origin bound certs-journal
%TEMP%\etilqs_kdfiiscqcd12yh1
%TEMP%\dump_proc_1769561383\default\login data
%TEMP%\7a23.tmp
%TEMP%\scoped_dir_3448_28995\docs.crx
%TEMP%\7a43.tmp
%TEMP%\dump_proc_1769561383\default\origin bound certs
%TEMP%\scoped_dir_3448_15528\drive.crx
%TEMP%\7ac1.tmp
%TEMP%\scoped_dir_3448_28030\youtube.crx
%TEMP%\7b10.tmp
%TEMP%\scoped_dir_3448_465\search.crx
%TEMP%\7b40.tmp
%TEMP%\dump_proc_1769561383\default\databases\databases.db-journal
%TEMP%\etilqs_qjqb6du56cmt2po
%TEMP%\scoped_dir_3448_1684\gmail.crx
%TEMP%\dump_proc_1769561383\default\top sites-journal
%TEMP%\etilqs_phdyvefkdplae6x
%TEMP%\dump_proc_1769561383\default\visited links
%TEMP%\dump_proc_1769561383\default\cache\index
%TEMP%\dump_proc_1769561383\default\cache\data_0
%TEMP%\dump_proc_1769561383\default\current session
%TEMP%\dump_proc_1769561383\default\cache\data_1
%TEMP%\dump_proc_1769561383\default\cache\data_2
%TEMP%\dump_proc_1769561383\default\cache\data_3
%TEMP%\dump_proc_1769561383\default\databases\databases.db
%TEMP%\dump_proc_1769561383\default\top sites
%TEMP%\dump_proc_1769561383\default\shortcuts-journal
%TEMP%\dump_proc_1769561383\default\shortcuts
%TEMP%\dump_proc_1769561383\default\network action predictor-journal
%TEMP%\dump_proc_1769561383\default\network action predictor
%TEMP%\dump_proc_1769561383\default\quotamanager-journal
%TEMP%\etilqs_6qvjhtgh2bicz3o
%TEMP%\dump_proc_1769561383\default\quotamanager
%TEMP%\scoped_dir_3448_28995\crx_install\manifest.json
%TEMP%\dump_proc_1769561383\default\extension rules\manifest-000001
%TEMP%\dump_proc_1769561383\default\extension rules\000001.dbtmp
%TEMP%\dump_proc_1769561383\default\extension rules\log
%TEMP%\dump_proc_1769561383\default\extension rules\000003.log
%TEMP%\dump_proc_1769561383\982f.tmp
%TEMP%\dump_proc_1769561383\default\9959.tmp
%TEMP%\dump_proc_1769561383\default\997a.tmp
%TEMP%\dump_proc_1769561383\safe browsing cookies-journal
%TEMP%\etilqs_vcgxfmcmidbcqnn
%TEMP%\dump_proc_1769561383\safe browsing cookies
%TEMP%\dump_proc_1769561383\default\cookies-journal
%TEMP%\etilqs_4r3w32w7c6bcgj1
%TEMP%\dump_proc_1769561383\default\cookies
%TEMP%\dump_proc_1769561383\default\cache\f_000001
%TEMP%\etilqs_fo47xzgzrwaezhr
%TEMP%\dump_proc_1769561383\default\cache\f_000002
%TEMP%\dump_proc_1769561383\default\cache\f_000003
%TEMP%\dump_proc_1769561383\default\cache\f_000004
%TEMP%\dump_proc_1769561383\default\cache\f_000005
%TEMP%\dump_proc_1769561383\default\cache\f_000006
%TEMP%\dump_proc_1769561383\default\cache\f_000007
%TEMP%\dump_proc_1769561383\default\cache\f_000008
%TEMP%\dump_proc_1769561383\default\cache\f_000009
%TEMP%\dump_proc_1769561383\default\cache\f_00000a
%TEMP%\dump_proc_1769561383\default\cache\f_00000b
%TEMP%\dump_proc_1769561383\default\cache\f_00000c
%TEMP%\dump_proc_1769561383\default\cache\f_00000d
%TEMP%\dump_proc_1769561383\default\cache\f_00000e
%TEMP%\dump_proc_1769561383\default\cache\f_00000f
%TEMP%\dump_proc_1769561383\default\cache\f_000010
%TEMP%\dump_proc_1769561383\default\cache\f_000011
%TEMP%\scoped_dir_3448_15528\crx_install\manifest.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\ar\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\bg\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\ca\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\cs\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\da\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\de\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\el\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\en_gb\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\en_us\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\es\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\es_419\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\et\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\fi\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\fil\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\fr\messages.json
%TEMP%\dump_proc_1769561383\default\cache\f_000012
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\he\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\hi\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\hr\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\hu\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\id\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\it\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\ja\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\ko\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\lt\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\lv\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\ms\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\nl\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\pl\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\pt_br\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\pt_pt\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\ro\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\sk\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\sl\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\sr\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\sv\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\th\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\tr\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\uk\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\vi\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\zh_cn\messages.json
%TEMP%\scoped_dir_3448_15528\crx_install\_locales\zh_tw\messages.json
%TEMP%\dump_proc_1769561383\default\cache\f_000013
%TEMP%\dump_proc_1769561383\default\cache\f_000014
%TEMP%\dump_proc_1769561383\default\cache\f_000015
%TEMP%\dump_proc_1769561383\default\cache\f_000016
%TEMP%\dump_proc_1769561383\default\extension state\manifest-000001
%TEMP%\dump_proc_1769561383\default\extension state\000001.dbtmp
%TEMP%\dump_proc_1769561383\default\extension state\log
%TEMP%\dump_proc_1769561383\default\extension state\000003.log
%TEMP%\scoped_dir_3448_1684\crx_install\manifest.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\ar\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\bg\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\ca\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\cs\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\da\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\de\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\el\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\en\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\es\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\fi\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\fil\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\fr\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\hi\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\hr\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\hu\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\id\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\it\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\ja\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\ko\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\lt\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\lv\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\nl\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\pl\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\pt_br\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\pt_pt\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\ro\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\sk\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\sl\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\sr\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\th\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\tr\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\uk\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\vi\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\zh_cn\messages.json
%TEMP%\scoped_dir_3448_1684\crx_install\_locales\zh_tw\messages.json
%TEMP%\dump_proc_1769561383\default\cache\f_000017
%TEMP%\dump_proc_1769561383\default\cache\f_000018
%TEMP%\scoped_dir_3448_465\crx_install\manifest.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\ar\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\bg\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\ca\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\cs\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\da\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\de\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\el\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\en\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\en_gb\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\en_us\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\es\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\es_419\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\et\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\fi\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\fil\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\fr\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\he\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\hi\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\hr\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\hu\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\id\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\it\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\ja\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\ko\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\lt\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\lv\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\nl\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\pl\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\pt_br\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\pt_pt\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\ro\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\sk\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\sl\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\sr\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\sv\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\th\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\tr\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\uk\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\vi\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\zh_cn\messages.json
%TEMP%\scoped_dir_3448_465\crx_install\_locales\zh_tw\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\manifest.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\ar\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\bg\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\ca\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\cs\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\da\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\de\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\el\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\en\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\es\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\fi\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\fil\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\fr\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\he\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\hi\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\hr\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\hu\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\id\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\it\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\ja\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\ko\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\lt\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\lv\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\nl\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\pl\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\pt_br\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\pt_pt\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\ro\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\ru\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\sk\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\sl\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\sr\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\sv\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\th\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\tr\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\uk\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\vi\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\zh_cn\messages.json
%TEMP%\scoped_dir_3448_28030\crx_install\_locales\zh_tw\messages.json
%TEMP%\dump_proc_1769561383\default\cache\f_000019
%TEMP%\dump_proc_1769561407\crashpad\settings.dat
%TEMP%\dump_proc_1769561407\crashpad\throttle_store.dat
%TEMP%\dump_proc_1769561407\crashpadmetrics-active.pma
nul
%TEMP%\dump_proc_1769561407\devtoolsactiveport
%TEMP%\dump_proc_1769561407\default\chrome_debug.log
%TEMP%\dump_proc_1769561407\default\code cache\wasm\index
%TEMP%\dump_proc_1769561407\default\code cache\js\index
%TEMP%\dump_proc_1769561407\default\gpucache\index
%TEMP%\dump_proc_1769561407\default\gpucache\data_0
%TEMP%\dump_proc_1769561407\default\gpucache\data_1
%TEMP%\dump_proc_1769561407\default\gpucache\data_2
%TEMP%\dump_proc_1769561407\default\gpucache\data_3
%TEMP%\dump_proc_1769561407\default\code cache\wasm\index-dir\temp-index
%TEMP%\dump_proc_1769561407\default\code cache\js\index-dir\temp-index
%TEMP%\dump_proc_1769561407\default\cookies-journal
%TEMP%\dump_proc_1769561407\default\cookies

Deletes following files that it created itself

<Current directory>\edge_tmp.db
%TEMP%\xc7vityg
%TEMP%\dump_proc_1769561383\default\732d.tmp
%TEMP%\7a23.tmp
%TEMP%\7a43.tmp
%TEMP%\7ac1.tmp
%TEMP%\7b10.tmp
%TEMP%\7b40.tmp
%TEMP%\scoped_dir_3448_28995\crx_install\icon_128.png
%TEMP%\scoped_dir_3448_28995\crx_install\icon_16.png
%TEMP%\scoped_dir_3448_15528\crx_install\128.png
%TEMP%\scoped_dir_3448_1684\crx_install\128.png
%TEMP%\scoped_dir_3448_465\crx_install\128.png
%TEMP%\scoped_dir_3448_465\crx_install\16.png
%TEMP%\scoped_dir_3448_465\crx_install\32.png
%TEMP%\scoped_dir_3448_465\crx_install\48.png
%TEMP%\scoped_dir_3448_28030\crx_install\128.png
%TEMP%\_mei18162\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei18162\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei18162\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei18162\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei18162\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei18162\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei18162\base_library.zip
%TEMP%\_mei18162\bcrypt\_bcrypt.pyd
%TEMP%\_mei18162\certifi\cacert.pem
%TEMP%\_mei18162\charset_normalizer\md.cp312-win_amd64.pyd
%TEMP%\_mei18162\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
%TEMP%\_mei18162\chrome.exe
%TEMP%\_mei18162\crypto\cipher\_arc4.pyd
%TEMP%\_mei18162\crypto\cipher\_chacha20.pyd
%TEMP%\_mei18162\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_des.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei18162\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei18162\crypto\cipher\_salsa20.pyd
%TEMP%\_mei18162\crypto\hash\_blake2b.pyd
%TEMP%\_mei18162\crypto\hash\_blake2s.pyd
%TEMP%\_mei18162\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei18162\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei18162\crypto\hash\_keccak.pyd
%TEMP%\_mei18162\crypto\hash\_md2.pyd
%TEMP%\_mei18162\crypto\hash\_md4.pyd
%TEMP%\_mei18162\crypto\hash\_md5.pyd
%TEMP%\_mei18162\crypto\hash\_poly1305.pyd
%TEMP%\_mei18162\crypto\hash\_ripemd160.pyd
%TEMP%\_mei18162\crypto\hash\_sha1.pyd
%TEMP%\_mei18162\crypto\hash\_sha224.pyd
%TEMP%\_mei18162\crypto\hash\_sha256.pyd
%TEMP%\_mei18162\crypto\hash\_sha384.pyd
%TEMP%\_mei18162\crypto\hash\_sha512.pyd
%TEMP%\_mei18162\crypto\math\_modexp.pyd
%TEMP%\_mei18162\crypto\protocol\_scrypt.pyd
%TEMP%\_mei18162\crypto\publickey\_curve25519.pyd
%TEMP%\_mei18162\crypto\publickey\_curve448.pyd
%TEMP%\_mei18162\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei18162\crypto\publickey\_ed25519.pyd
%TEMP%\_mei18162\crypto\publickey\_ed448.pyd
%TEMP%\_mei18162\crypto\util\_cpuid_c.pyd
%TEMP%\_mei18162\crypto\util\_strxor.pyd
%TEMP%\_mei18162\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\installer
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\licenses\license
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\licenses\license.apache
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\licenses\license.bsd
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\metadata
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\record
%TEMP%\_mei18162\cryptography-45.0.7.dist-info\wheel
%TEMP%\_mei18162\libcrypto-3.dll
%TEMP%\_mei18162\libffi-8.dll
%TEMP%\_mei18162\libssl-3.dll
%TEMP%\_mei18162\pyexpat.pyd
%TEMP%\_mei18162\python3.dll
%TEMP%\_mei18162\python312.dll
%TEMP%\_mei18162\pywin32_system32\pywintypes312.dll
%TEMP%\_mei18162\select.pyd
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
%TEMP%\_mei18162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
%TEMP%\_mei18162\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei18162\sqlite3.dll
%TEMP%\_mei18162\ucrtbase.dll
%TEMP%\_mei18162\unicodedata.pyd
%TEMP%\_mei18162\vcruntime140.dll
%TEMP%\_mei18162\vcruntime140_1.dll
%TEMP%\_mei18162\win32\win32crypt.pyd
%TEMP%\_mei18162\_asyncio.pyd
%TEMP%\_mei18162\_bz2.pyd
%TEMP%\_mei18162\_cffi_backend.cp312-win_amd64.pyd
%TEMP%\_mei18162\_ctypes.pyd
%TEMP%\_mei18162\_decimal.pyd
%TEMP%\_mei18162\_hashlib.pyd
%TEMP%\_mei18162\_lzma.pyd
%TEMP%\_mei18162\_multiprocessing.pyd
%TEMP%\_mei18162\_overlapped.pyd
%TEMP%\_mei18162\_queue.pyd
%TEMP%\_mei18162\_socket.pyd
%TEMP%\_mei18162\_sqlite3.pyd
%TEMP%\_mei18162\_ssl.pyd
%TEMP%\_mei18162\_wmi.pyd

Moves the following files

from %TEMP%\dump_proc_1769561383\default\data_reduction_proxy_leveldb\000001.dbtmp to %TEMP%\dump_proc_1769561383\default\data_reduction_proxy_leveldb\current
from %TEMP%\dump_proc_1769561383\default\extension rules\000001.dbtmp to %TEMP%\dump_proc_1769561383\default\extension rules\current
from %TEMP%\dump_proc_1769561383\982f.tmp to %TEMP%\dump_proc_1769561383\local state
from %TEMP%\dump_proc_1769561383\default\9959.tmp to %TEMP%\dump_proc_1769561383\default\secure preferences
from %TEMP%\dump_proc_1769561383\default\997a.tmp to %TEMP%\dump_proc_1769561383\default\preferences
from %TEMP%\dump_proc_1769561383\default\extension state\000001.dbtmp to %TEMP%\dump_proc_1769561383\default\extension state\current
from %TEMP%\dump_proc_1769561407\default\code cache\wasm\index-dir\temp-index to %TEMP%\dump_proc_1769561407\default\code cache\wasm\index-dir\the-real-index
from %TEMP%\dump_proc_1769561407\default\code cache\js\index-dir\temp-index to %TEMP%\dump_proc_1769561407\default\code cache\js\index-dir\the-real-index

Substitutes the following files

%TEMP%\scoped_dir_3448_28995\crx_install\icon_128.png
%TEMP%\scoped_dir_3448_28995\crx_install\icon_16.png
%TEMP%\scoped_dir_3448_15528\crx_install\128.png
%TEMP%\scoped_dir_3448_1684\crx_install\128.png
%TEMP%\scoped_dir_3448_465\crx_install\128.png
%TEMP%\scoped_dir_3448_465\crx_install\16.png
%TEMP%\scoped_dir_3448_465\crx_install\32.png
%TEMP%\scoped_dir_3448_465\crx_install\48.png
%TEMP%\scoped_dir_3448_28030\crx_install\128.png

Network activity

Connects to

'localhost':9222
'google.com':443
'tools.google.com':80
'tr######e.googleapis.com':443
'19#.#32.214.172':80
'ss#.#static.com':443
'go#####agmanager.com':443
's.##img.com':443
'fo###.gstatic.com':443
'fo###.#oogleapis.com':443

TCP

HTTP GET requests

http://tools.google.com/chrome/intl/en/welcome.html

Other

'google.com':443
'localhost':49698
'clients2.google.com':443
'tr######e.googleapis.com':443
'localhost':49707
'ss#.#static.com':443
'go#####agmanager.com':443
's.##img.com':443
'fo###.gstatic.com':443
'gs##tic.com':443
'fo###.#oogleapis.com':443
'csp.withgoogle.com':443
'localhost':49733
'localhost':49735

UDP

DNS ASK google.com
DNS ASK tools.google.com
DNS ASK clients2.google.com
DNS ASK clients4.google.com
DNS ASK tr######e.googleapis.com
DNS ASK clients3.google.com
DNS ASK ss#.#static.com
DNS ASK go#####a###ytics.com
DNS ASK go#####agmanager.com
DNS ASK yo##ube.com
DNS ASK s.##img.com
DNS ASK fo###.gstatic.com
DNS ASK fo###.#oogleapis.com
DNS ASK gs##tic.com
DNS ASK csp.withgoogle.com

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\dump_proc_1769561383'

Creates and executes the following

'%TEMP%\_mei18162\chrome.exe' --target all

Restarts the analyzed sample

Executes the following

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --remote-debugging-port=9222 --user-data-dir=%TEMP%\dump_proc_1769561407 --headless=new --remote-allow-origins=* --disable-gpu --no-first-run

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial