| File name: | furmark-1-37-2-0.exe |
| Full analysis: | https://app.any.run/tasks/3716fdcc-62a6-45e9-94df-ff9fdbe6df8f |
| Verdict: | Malicious activity |
| Analysis date: | November 23, 2023, 09:28:43 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 30B9651C64BA030BA3D7E9D2FA2A11E2 |
| SHA1: | 43567196FEE0A32751C2A582548B1ABF40CEF1EB |
| SHA256: | D6590FF8C3E8E8CDBCCE7DB9BB0E7F481286AC463F20B1EA0CFED067BC812514 |
| SSDEEP: | 196608:D3sCW3mAD+fNIwByLrk1R1tP/K7KMsAWY5:D89mniw8r+pKKMsAb |
| .exe | | | Inno Setup installer (53.5) |
|---|---|---|
| .exe | | | InstallShield setup (21) |
| .exe | | | Win32 EXE PECompact compressed (generic) (20.2) |
| .exe | | | Win32 Executable (generic) (2.1) |
| .exe | | | Win16/32 Executable Delphi generic (1) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:02:15 15:54:16+01:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741888 |
| InitializedDataSize: | 89600 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.37.2.0 |
| ProductVersionNumber: | 1.37.2.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Geeks3D |
| FileDescription: | FurMark Setup |
| FileVersion: | 1.37.2.0 |
| LegalCopyright: | Copyright © 2007-2023 Geeks3D |
| OriginalFileName: | |
| ProductName: | FurMark |
| ProductVersion: | 1.37.2.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 276 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3848 --field-trial-handle=1368,i,13281323261734966053,16263965823829086346,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 880 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4280 --field-trial-handle=1368,i,13281323261734966053,16263965823829086346,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 900 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3968 --field-trial-handle=1368,i,13281323261734966053,16263965823829086346,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1228 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4668 --field-trial-handle=1368,i,13281323261734966053,16263965823829086346,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1360 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2584 --field-trial-handle=1368,i,13281323261734966053,16263965823829086346,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1584 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4156 --field-trial-handle=1368,i,13281323261734966053,16263965823829086346,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1656 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1552 --field-trial-handle=1368,i,13281323261734966053,16263965823829086346,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1828 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4156 --field-trial-handle=1368,i,13281323261734966053,16263965823829086346,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2000 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2552 --field-trial-handle=1368,i,13281323261734966053,16263965823829086346,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2232 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4628 --field-trial-handle=1368,i,13281323261734966053,16263965823829086346,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| (PID) Process: | (3756) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3756) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3756) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3756) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3756) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3756) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 1 | |||
| (PID) Process: | (3756) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault |
| Operation: | write | Name: | S-1-5-21-1302019708-1500728564-335382590-1000 |
Value: 8A1A1F2B695E2F00 | |||
| (PID) Process: | (3756) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge |
| Operation: | write | Name: | UsageStatsInSample |
Value: 1 | |||
| (PID) Process: | (3756) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | usagestats |
Value: 1 | |||
| (PID) Process: | (3756) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | urlstats |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3512 | furmark-1-37-2-0.tmp | C:\Program Files\Geeks3D\Benchmarks\FurMark\is-9P32E.tmp | executable | |
MD5:DC8C84BCFFCD54C3F9D3F078A1907B84 | SHA256:07CB52467D1FAAEAB0BB3AFF6A3F6E9BFB0C2F699DB36B00BEEC137DBF652A63 | |||
| 3512 | furmark-1-37-2-0.tmp | C:\Program Files\Geeks3D\Benchmarks\FurMark\is-60IM3.tmp | — | |
MD5:— | SHA256:— | |||
| 3512 | furmark-1-37-2-0.tmp | C:\Program Files\Geeks3D\Benchmarks\FurMark\furmark_0001.txt | — | |
MD5:— | SHA256:— | |||
| 3480 | furmark-1-37-2-0.exe | C:\Users\admin\AppData\Local\Temp\is-FR4UL.tmp\furmark-1-37-2-0.tmp | executable | |
MD5:1B548005D5F1CDC0977B4BA2CB341F51 | SHA256:9BA006BE3FEB7166D431916EDE133FFECC7CE7D8E5BF29BF26FE096746B42539 | |||
| 3512 | furmark-1-37-2-0.tmp | C:\Program Files\Geeks3D\Benchmarks\FurMark\is-2PNCE.tmp | executable | |
MD5:C0BE838014EEF663659AE256D37CAA90 | SHA256:CA80C658E7679061AAA1D9742DCD309F5B23067BEE20BB96C58C887E072FE2E2 | |||
| 3512 | furmark-1-37-2-0.tmp | C:\Program Files\Geeks3D\Benchmarks\FurMark\is-J429K.tmp | executable | |
MD5:8A2A6B3AAAA5B6162C6085EDAC54D5F2 | SHA256:589C0DC8076AE39E3C40FA091C8B91F748E34F7099C94BA5EBB4E0EEEFEB9019 | |||
| 3512 | furmark-1-37-2-0.tmp | C:\Program Files\Geeks3D\Benchmarks\FurMark\EULA.txt | text | |
MD5:412242D768963FA9B10DBE8F5F97242E | SHA256:B7088B145CEA26E22418052C0E1574D25771D634427005D6042B481608B0351D | |||
| 3512 | furmark-1-37-2-0.tmp | C:\Program Files\Geeks3D\Benchmarks\FurMark\is-K2UBO.tmp | text | |
MD5:412242D768963FA9B10DBE8F5F97242E | SHA256:B7088B145CEA26E22418052C0E1574D25771D634427005D6042B481608B0351D | |||
| 3512 | furmark-1-37-2-0.tmp | C:\Program Files\Geeks3D\Benchmarks\FurMark\core3d.dll | executable | |
MD5:DC8C84BCFFCD54C3F9D3F078A1907B84 | SHA256:07CB52467D1FAAEAB0BB3AFF6A3F6E9BFB0C2F699DB36B00BEEC137DBF652A63 | |||
| 3512 | furmark-1-37-2-0.tmp | C:\Program Files\Geeks3D\Benchmarks\FurMark\unins000.exe | executable | |
MD5:C0BE838014EEF663659AE256D37CAA90 | SHA256:CA80C658E7679061AAA1D9742DCD309F5B23067BEE20BB96C58C887E072FE2E2 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3680 | FurMark.exe | GET | 200 | 83.166.138.97:80 | http://www.ozone3d.net/benchmarks/fur/furmark_version.php | unknown | text | 34 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3680 | FurMark.exe | 83.166.138.97:80 | ozone3d.net | Infomaniak Network SA | CH | unknown |
3756 | msedge.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4024 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4024 | msedge.exe | 83.166.138.97:443 | ozone3d.net | Infomaniak Network SA | CH | unknown |
4024 | msedge.exe | 20.103.180.120:443 | nav-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
4024 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
Domain | IP | Reputation |
|---|---|---|
ozone3d.net |
| unknown |
www.ozone3d.net |
| unknown |
config.edge.skype.com |
| whitelisted |
nav-edge.smartscreen.microsoft.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
geeks3d.com |
| whitelisted |
data-edge.smartscreen.microsoft.com |
| whitelisted |
pagead2.googlesyndication.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |