Malware Analysis Report

2025-06-16 06:44

Sample ID 240120-kqj5jafagq
Target 69fefc7584266eb0fe60c83e3cfc0adc
SHA256 48ac6535a5b415175574538f76ac51a6ecc0bc89f6091e1ed8328f92215cfe26
Tags
darkcomet persistence rat trojan microsoft phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

48ac6535a5b415175574538f76ac51a6ecc0bc89f6091e1ed8328f92215cfe26

Threat Level: Known bad

The file 69fefc7584266eb0fe60c83e3cfc0adc was found to be: Known bad.

Malicious Activity Summary

darkcomet persistence rat trojan microsoft phishing

Modifies WinLogon for persistence

Darkcomet

Drops file in Drivers directory

Checks BIOS information in registry

Deletes itself

Adds Run key to start application

Detected potential entity reuse from brand microsoft.

Suspicious use of SetThreadContext

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks processor information in registry

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-20 08:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-20 08:48

Reported

2024-01-20 08:50

Platform

win7-20231215-en

Max time kernel

119s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\notepad.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3088421-B770-11EE-91D2-EEC5CD00071E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000003b8badce54b9f1e15257ff9c6df3fd6468009ef6ecfb00e6fb711231eb6cdc76000000000e8000000002000020000000cf54e63366bf51d41e4c0d60b9ed46c0d2f134d853e763385d2fa77a7ccc1f9e20000000f6c372c1a3db028617ceba48252064045a05c83f02ed19e5f58bc95885615c3540000000ca9300b19d58bf5d263f96842189feab46081cc2b52c208d26c6d10d6788d8d1e97c7237eeb880c1cdb7d44a11827914cb44bd029186fa0da5f739af345d6ef4 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411902384" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09c6b887d4bda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000009f502a6a0a3ed161058cdf436a7fd7eaba82b42bdb014b89cb5c8d2cc2b91c53000000000e80000000020000200000003723d3c59b34e6894c47585f6c505461a828edfe8f66faf5d64340d6c66ff41190000000038492cf70a8483260e6dc40af1ac7a0cb0606502ea9831501921b3f3ee26d52df3a02f9c3a6258eff53a43e9762a38746a4ac332124d1198bc4c98be40b678e58a96a5992df9ae262c483aea2ae9145df8e7ab2f73ac28a2e581a1b25baaacddd8a90ef4e325fa14645b560308d213e074327729e58fa4ede563e673067130dab3acb4676e1343b2644c89db2184aab4000000088034a411b81bc882df68a0f2d1758046836100f5fa2bf92bd31ba9282f4a01dd430b08ffe30711e427ae2c3d48b7b074274880e633422b54890edd6cda2740f C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2540 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 2160 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 2160 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 2160 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 2160 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 2160 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2160 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 2628 wrote to memory of 1308 N/A C:\Windows\SysWOW64\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe

"C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe"

C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe

"C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 learn.microsoft.com udp
GB 92.123.242.110:443 learn.microsoft.com tcp
GB 92.123.242.110:443 learn.microsoft.com tcp
GB 92.123.242.110:443 learn.microsoft.com tcp
GB 92.123.242.110:443 learn.microsoft.com tcp
GB 92.123.242.110:443 learn.microsoft.com tcp
GB 92.123.242.110:443 learn.microsoft.com tcp
GB 92.123.242.110:443 learn.microsoft.com tcp
GB 92.123.242.110:443 learn.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2540-0-0x0000000074A70000-0x000000007501B000-memory.dmp

memory/2540-1-0x0000000074A70000-0x000000007501B000-memory.dmp

memory/2540-2-0x0000000001E30000-0x0000000001E70000-memory.dmp

memory/2160-3-0x0000000013140000-0x00000000131F7000-memory.dmp

memory/2540-5-0x0000000074A70000-0x000000007501B000-memory.dmp

memory/2160-4-0x0000000013140000-0x00000000131F7000-memory.dmp

memory/2160-6-0x0000000013140000-0x00000000131F7000-memory.dmp

memory/2160-8-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2160-7-0x0000000013140000-0x00000000131F7000-memory.dmp

memory/2776-10-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2776-42-0x00000000003B0000-0x00000000003B1000-memory.dmp

memory/2628-50-0x000000001EE30000-0x000000001EEAE000-memory.dmp

memory/2628-55-0x000000001EE30000-0x000000001EEAE000-memory.dmp

memory/2592-75-0x00000000004A0000-0x00000000004A1000-memory.dmp

memory/2160-74-0x0000000013140000-0x00000000131F7000-memory.dmp

memory/2628-53-0x000000001EE30000-0x000000001EEAE000-memory.dmp

memory/2628-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2628-46-0x000000001EE30000-0x000000001EEAE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabB56B.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarB64B.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e8666807e490a2f0918560e06beb6e46
SHA1 cbdcf7f8bbd8a9ef9bdf6d43a9dbd4323a0df213
SHA256 fc6db485ec5add72b7f2134c2542dd7ad0a50fae1511484ca9811e05b4bf8183
SHA512 ad5fafb03109ebd97b8cedc9b8bffcbb14c04e3cc099e2d0051ed6ab546e68f60f4b0b576a28c10e522b7cf1b2ada87a985ed3502fd943b506a26504934eaa4f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25e0e4d46ef1bc3c8e75813604003d6a
SHA1 629a6452b775e9294d178da5ce0522e7f5a325ad
SHA256 eb22d1c2f20d46821ff7eff20090f6066dee818476f0612772a96150496714c9
SHA512 0f7b2c3642b956d798abb83a8c3cc5d06b3b08099c2593d49b5a54f09ed3769471d5609c1d2a4605a6cbc416cb30498520724a45350f98e002dd05e7f5947937

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7e5ddbf7b61d706a182fae5106c6e2c6
SHA1 9939d00a80ed14165dec4aa3524e6bd6804e111e
SHA256 fc64d15a9684d04f42fea4dc60e08ad2dac520278806d63c2d9f1dc5f917ac96
SHA512 2bac0e9fb76475de3f5923af9efa903ad16cbd8812b866ee861995712a99843dbaef761f2118f61ef3873b143219ee641f6889be206511e18c2b0bf0907d93c2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8ec2cece48fcbe41d7a8b936b83319d6
SHA1 bf4b175817f7fd65c0be48ed62ed5a4f19c2a24f
SHA256 74e38508a284a4b6486eca1731e4e8d9781b4053226ec5995e825bae92057d72
SHA512 80d00e2137290e28fd29413ad8c93e1304a653842b99523d971e32ec4d4ae7c72d1f17b554c72eed910cbe2058b187d87af8f00c16e26f896c8a9ba9e5439a99

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d97b9d71e13e0a57e528cda9128ecd9
SHA1 e9553d19ea8a25d7a50c25c09ce6bd4864f6c6ee
SHA256 cef37db05d832f9dc343d1eaac65ef1fbee4888507f63268a9a427123d429a13
SHA512 d5a1232219b41ae1976d921895f9586fb2d9c81c5097c375a55b1e678d65a72b2229147d69684a03de633a176eda617e00f1f65033d34189ddbc9cfedcc1819c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cc189c37d601045cbe53cfd2a2a029a5
SHA1 99af221cc94be3255b8ccf16cf05c9e580b7470f
SHA256 4dab3260088205733c3155babd80fe0d4f77d84e5dd2cd51abfd1a0ccf3f77fa
SHA512 72620b08900b412648c76db9faadd6eb52e807a6c53e4d7f6277e931f5650522bc6419485fa9b1ea4c636940ec257fd291740445fd229b5f70fc37a719ce175c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1622958d481211215b9139efaca82d32
SHA1 065492c9944209e5864ece6e4ce6915dc3798018
SHA256 e1ab61baf47999dd8b677e216ada3d866978e0b5e7ed39afa5d0eb96b82fbaa4
SHA512 e033330e600bab8f51af4f448d0c54a3a6d54f017f6eda57d61acebb69f24da3ab3ebe0747cfc071533a056443762e51909a33877320c2a9d13d3de78591301e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d162e80db873ed20199d7e86389e7cab
SHA1 f54473fab5779276e1edddc658a7be26f1e5d305
SHA256 d9040ead11d5b824f903ab8c648f885e7ceda5537128e6f8baa648c22554c9ba
SHA512 762037fa8dc2a7be2316a72ea2e3c50013afca97217d49e0a90b14c63868bda9a85fb09f82e8b78dd73461604bb16c7ab6e8d9bf71c6f1807e4ce3ac77177a87

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 615889a0858eef3829f43cf167fafb55
SHA1 c836c79a850e604d72317c9c0654360518f004ec
SHA256 79bf68c3e81974ac94b588b853632281cceaf1b2158094fd4171baa59be2ba26
SHA512 8a1f0706916bc5a9eaad63bb119e050aafc5f58303e5b4a197914f1e3a4c21b1b1a3122732fa6635f38d2097bd45114aba39e9a7e2f2d0844e8daaf5849e9135

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e79b486545165afdce9d05b2314fd08a
SHA1 31d3112d7a582f46ef411153f6b611ae4a280930
SHA256 8117d3a0616a4105973235c39902eb515556debc336a467c7280082255b9a2dc
SHA512 100b07217de2e72292ac43c8f67ffba41f157ee886c56170e19db1e6fb37577007dd40c19b29d8abe51b6dd14b1c03e5c4478f69bcf73e062c9d74bee0b670c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 025122a15140c68643fbea5cc70ee68b
SHA1 314032b7e8edb1d505afe7dcdf2345b8c3e992f8
SHA256 5f2951797db77159c6572474b3f48818a13be1137b22411354eb81ac03326167
SHA512 de7bf0b5fe00fe83bddebb764031eba436d8c65aacfa26e42aba58f82cb24ac87030bace98c7305115c539a02807f1d6dcec96d76177a87e9fcb9fea1f8a6e57

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fec55c16bd777a0def2f7d19260e9818
SHA1 3c1334531cdb819e40f5231d7ac6978f4ac8c50e
SHA256 c69b24a73c4b986caa5102c4ad285ee8aa4bf1f3438f8ee9d405f1bc556197e7
SHA512 201ce8dbca4f6cd74768d537800b5a3e317b52e2636b80ce66e23989cd19f0df942d71cb47802bd6404cdc5a31ef518f5303515d30bfbcae0434d6a254627582

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 089686b3c3d79824c6d19f4557538892
SHA1 be9ec7233cda93e39b7eed373fe5f83d3e95f0b5
SHA256 f7900ba2cb579275a544caa2dc6004b2a22ca488901b48cf40347325ac3a3975
SHA512 9bdcb01db45d7e657d5d13766ff72179b74bcde192117eb7f0848c98c60a61530c9ecc6c28a1e4ea9dfce727bc6e83b87019fa680782cecaf8ce01505fc8c156

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c51b14951f647ffb0c5d9c92156f842e
SHA1 32d5ab95d185e351e75892b7a7b9f04618e4ace8
SHA256 d642e410e4b691263dce40ff50466503d269e266dbca04fff10dbc42b38a4241
SHA512 8dccc6e687eb684151d7d8e07f4b8fc9c52bb6e669d7590b6c15c3a635cc46e465919f277a1efecd7ac6fc66c3f3c3192a938f76dd906e9eff638912e5067c5a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fbe519749cd22105f70b4e0950521143
SHA1 a96da27a54dcac66d1f7cba55c37b41a8582352c
SHA256 a0027291e1490bbf624e5722621780686ad262597df07c4f1a9f2240790670ba
SHA512 4e37c2ce08dab6a3e92be63da1c04b153ab03f3614f53cbc9246e159db6b377b494d96b5e49d7aa103fb3bf15e30c7505d811529ec1de5e48d19a9a7a555660e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7323fcf04a7c308d06c8e362955c7229
SHA1 b2d889236bede0e729661ea23e28296f83c4d3cd
SHA256 3d7f634aa9a68c80022aae34ef195999d683ae7c105ff260199d61b14ae7f02a
SHA512 403c7382ca1274d03bc5e3dca9c03bd69de8357f0d13b295f5f239ed19129855bb85c25e7d398e6579b5e5b2859411a67d432a487b13c009491a0d0eadf7a951

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 71249aa8e1567b3ac991f3ff56b8d9e0
SHA1 0bbab237e003571d4de59d28f38cdd01a2427958
SHA256 2f559222d992ef28d11110a8ba207f92b971125d87010839f544f7c06bd42193
SHA512 1dafe16b0949aaa241b37df2a43383585f55dceac8e53a4ccf5e4768aa88a765755492c13d18e437acf8df386c9cd6cfb2a7954e0451894aada47d7fc4d62c86

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08f4578bdaac4f1e915e7d3c63857b11
SHA1 eb5ff1d8331ea5fff49bdd83144e9ee228ad7349
SHA256 8aa279e611ed5e1d630acac80298beb91dca28bcabcf83a7136fddb70d804dc4
SHA512 7e14be1b10a45f18dcfbe6e329c7ec3f249cb8b0e817ba1dd94df7a9b705d18c82051a171bd4639fb74ac88ccf051f1a0fcb6e374547689e7fd030d4f71a3a9d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fcc32eec1158827ad7afa371ca235043
SHA1 b38985d550748c3ad12580ac3ad5c6c5f487d31e
SHA256 bc536fd9bfac3f9efb35accc447e87f8cf4479d6f86ca5fa783638147b0cf67a
SHA512 c5bdd65e9712ba39055d0f1e68ac79e4e7fe0213ab837dcf6d519770a92fd15c25d3df359cd1b857dec2b0961f20b13951cae85b8ceec5f37488726e808ef302

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fa2dc0a509a5129957f4e2d2f842e6fd
SHA1 5af1509794f09728efbd3ae5149e6a7bdc7e6ab3
SHA256 3c3e04d368bd2e54d3c0eeffba28d08e44fbc00f65b07d1f79dd5715b5585057
SHA512 4fb5a42a6636909c85ff645b95ef8bd9db96ef00f7d291d11dab00fa0cdc1b76e13abcd70f2267160adf05e893042b6cc916feef9ab160f0f6bef027afc9be51

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 62315cbbbd0d1541f4740dd9665d9354
SHA1 d24c4e20293610b5aa1768cf912335de47afebb6
SHA256 f13c0f37d76f2274565508e3e48cbdd2c43d0a1af289d0d75d32a20e67763819
SHA512 9101ea46f999c6f6a18e0d94364825db1dbfaa50f1996eb5f284f529858aae63704320eb7062d3d1fcc8d7eb61d1c5135b0e185131bbe147709a792b603a3f0f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92c85d78ccd5fa579181cf670803d542
SHA1 ea4ab8ea1964b09d1f6ba46806e64b945b94de48
SHA256 5180882741a842c9fc1dc12175c5e1000aa1e056d4892f7c5de6653c098eb1f8
SHA512 17ff3d23cbbea983322289f8cdc173c190445d333bcd9810dc7fdf11587c45f8a01edbbcb13adb8e5dc4592415f64c33b478cae3018f408dea63d3e929c6a130

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a300ca1389511ab1f5f88bcf1ac5b0ce
SHA1 0837f5d677ab0bda61d46e08e03a5566fefb5b48
SHA256 fe886a1f39c36b8eec5a0fe5cf8ffcfa1a437bd92e15e2e2b2c3cb7396f9725b
SHA512 c3ee4dbbfc7c0c863c358502fee981ada9307f559858ab625678841443aea40ae31845f00bfa141450493a42657dc42a17f3c43537fab5bfc037435df54d4563

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-20 08:48

Reported

2024-01-20 08:50

Platform

win10v2004-20231215-en

Max time kernel

143s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\notepad.exe N/A

Detected potential entity reuse from brand microsoft.

phishing microsoft

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3544 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 3076 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 3076 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 3076 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 3076 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\explorer.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 3076 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe C:\Windows\SysWOW64\notepad.exe
PID 1592 wrote to memory of 4280 N/A C:\Windows\SysWOW64\explorer.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1592 wrote to memory of 4280 N/A C:\Windows\SysWOW64\explorer.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4280 wrote to memory of 1340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4280 wrote to memory of 1340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4280 wrote to memory of 1012 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe

"C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe"

C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe

"C:\Users\Admin\AppData\Local\Temp\69fefc7584266eb0fe60c83e3cfc0adc.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0ad046f8,0x7ffe0ad04708,0x7ffe0ad04718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0ad046f8,0x7ffe0ad04708,0x7ffe0ad04718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5300361902073298758,13481599648336509684,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
GB 92.123.242.110:443 learn.microsoft.com tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 8.8.8.8:53 mscom.demdex.net udp
IE 54.220.146.23:443 mscom.demdex.net tcp
US 8.8.8.8:53 mdec.nelreports.net udp
GB 88.221.134.26:443 mdec.nelreports.net tcp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
US 8.8.8.8:53 target.microsoft.com udp
US 8.8.8.8:53 110.242.123.92.in-addr.arpa udp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 23.146.220.54.in-addr.arpa udp
US 8.8.8.8:53 26.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
GB 51.104.15.252:443 browser.events.data.microsoft.com tcp
GB 51.104.15.252:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 252.15.104.51.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

memory/3544-0-0x00000000748C0000-0x0000000074E71000-memory.dmp

memory/3544-1-0x0000000000AF0000-0x0000000000B00000-memory.dmp

memory/3544-2-0x00000000748C0000-0x0000000074E71000-memory.dmp

memory/3076-3-0x0000000013140000-0x00000000131F7000-memory.dmp

memory/3076-5-0x0000000013140000-0x00000000131F7000-memory.dmp

memory/3544-6-0x00000000748C0000-0x0000000074E71000-memory.dmp

memory/3076-7-0x0000000013140000-0x00000000131F7000-memory.dmp

memory/3076-9-0x0000000002360000-0x0000000002361000-memory.dmp

memory/696-16-0x00000000012C0000-0x00000000012C1000-memory.dmp

memory/1592-15-0x000000001EE30000-0x000000001EEAE000-memory.dmp

memory/3076-17-0x0000000013140000-0x00000000131F7000-memory.dmp

memory/2352-11-0x0000000001140000-0x0000000001141000-memory.dmp

memory/3076-8-0x0000000013140000-0x00000000131F7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d6e17218d9a99976d1a14c6f6944c96
SHA1 9e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA256 32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
SHA512 3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

C:\Windows\system32\drivers\etc\hosts

MD5 761587764329452e06635280ba83c742
SHA1 6318d7819bb385f7c9693cbc7cfe0d16310cc4a3
SHA256 b4654195eaf6d5191c7f350e402a9372c72d7a629bd9a2b256d17a7767f01434
SHA512 262ba6f2b904f23eab762fc0134a8c582b3142854966753736e4bdbcb6b8a84a8c812f1f8969fcf12e3176f686a32bc2b60bb25611daa313a5b970afb4683b68

\??\pipe\LOCAL\crashpad_4280_ISFXRKSBCPBBSSZI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\64c80631-2f76-4ffd-8e5f-e794f34b7bf4.tmp

MD5 0d2b340d19f04b8e9250712ad63dd391
SHA1 562cf1249ef9ed5e08c822f7977c4dd6701f2950
SHA256 50ef7d82a67b6a510035a2fb84251c32f3faccea980261cacaea35396bec3695
SHA512 5ce084f8c472814292c8266e2d41aaeb2ea1fdfd50839c1afbcddbedad66c350f607725b025da581fd8f670864d3fac23df1edafadfc56e65335f7aacf6a09ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 62555072202e2ceac0ae537d0491dd90
SHA1 c49aaeefa8d67dda264fa4c4f19a967bea142674
SHA256 a38d13f8bc1c463a41dce751e7a7eab8cbc9dd72181dfa149badbad9df27ac7a
SHA512 4cd9acb8e3a5b76c422b4ec50fa360695fb00714c6cc45432370a1e2cb21dfbe1b21610b153051b4eb947ffbb898edf428a2468c894e112340e30774aaf5b369

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c990fcc725a9b029a11d6726251b203f
SHA1 1e6f4a865d44afd4866adbe16ec07988f21efdb8
SHA256 e60adfb57ca27ca099fed7b688114bb5a9815c149a7bcaa65ebe07240f1aa040
SHA512 160bdf32f3a9dcc77792c305937941d4ed0a4a3a4ab6b9e969dc8a8dbcdc5cb9c25051cebcf9f74ee53271b69d0b5048387ac8a9ad0c88b025ce5bf53eb8bd28

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 c2ef1d773c3f6f230cedf469f7e34059
SHA1 e410764405adcfead3338c8d0b29371fd1a3f292
SHA256 185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
SHA512 2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6186b204c4579e8a157df0158d8bddfe
SHA1 3226664146aee465038c355d8bac617c6990e152
SHA256 ef034407d8bde2625c95eb0b0a16eed3e47940b5546c147265ccbdf885959e8a
SHA512 ab3da7bf607c606b924b1b44558975259e9976e5e0e9a0e21ad529d57187e224a8b249899159ad1b29c5ef57673ffa566a3b004fb41c9b2e6fbed405166fef0b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fd5f65ac2211e192d250ace835921743
SHA1 7261cad7d69306a80b1c3de3502b876b09f34d2b
SHA256 d0b7e6f882781be98620a7bb685d172e1fffce3a36081cbdcc4eb40a3045b092
SHA512 dcd17306d9571160d6fa4eb2ac579e5cc821915886a0790ff13aed10e1a704bab9232362ffb16dc51762b509fa2ff64e83a1f8a024b5eb5da8d33f191d998d92

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d561.TMP

MD5 7005cbaefb179ebf265c2f02bd565350
SHA1 770fc6c385244f944fbd4299adabeea3e8ca3e65
SHA256 ca491a1cd15981100ffd6d5ca64bcdb46a757ac774de81d6145bf9dec2bc254d
SHA512 1382e9d62f5c0a9c472ac372341e98d4cd560493e59d19456d8d9f1eaa34d30209e631d37e97c5c71a39a2f4ca48261ac90db7c4461e51dba3e16b952a6cf860

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 07291b67fb7f2f3997d511034e11234e
SHA1 1b934f53d709b465426bae7b8bd5798ceeed5156
SHA256 1b7f94d66325f9b4ed3b7d76c45b391019c4c95f18331c31b62b8279302bb9f8
SHA512 851e31406d03c68d389958ee620c047474d0b2c8b44ad3864a1638e7717b1c190b34a808cce02c004bd544be2fd9053b68e489362ddf099a25c7a3f8d405e35e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f75bb07420cf1d066b2a5c2f6faaf474
SHA1 cc5294ad983e842fa5a8c30d694bd85d2d73691a
SHA256 adc067d62306d10514737a30460a91ed94f66de2b262542fb8f4ce2263b09619
SHA512 67d9c07e53edd32165ff08e5f2d90761fb3e3ff10b15280078816521942146e702344eda507674eebb987f7883380dd018a21acc62d8648e10cdddfe5ebc5197

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa