Malware Analysis Report

2025-08-05 12:47

Sample ID 240122-ya1n8sdbf6
Target c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339
SHA256 c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339
Tags
metasploit backdoor discovery spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339

Threat Level: Known bad

The file c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339 was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor discovery spyware stealer trojan

MetaSploit

Drops file in Drivers directory

Reads user/profile data of web browsers

Checks computer location settings

Enumerates connected drives

Checks installed software on the system

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-22 19:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-22 19:35

Reported

2024-01-22 19:38

Platform

win7-20231129-en

Max time kernel

117s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77BCE021-B95D-11EE-8D71-5ABF6C2465D5} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002bfe4c33e8dcd9014bae93d97afe3641ff62971f2b4be94a4b04915607a2b09e000000000e8000000002000020000000773c4781469ad6000bd03d2fce2aca48980ed65a235788d32e9fa63b126e55939000000020e3ea2fa0fe71f353b9edb5e6dc1b1fe54b8597a87a4dbfff2ee8a90bed5574df4ed28394e7dc2c97eab807f541e88150cadc07e964c700938381a804b2287df28c3ca46760d7552640ef24724b161c405e75d902cf457dbc142e037fa83dd82ea5fbf4f618a3eedf673063f8082b33f45798e50e13651b561b0b2c6aa695be297e2e462c4a671ced4312b06c9f524e400000004fa4881db226d4aeeef6c584e57c8411820f3ec8533cb9953fdb95377fa2323dce34b5f62a5efbfce625e90fa17d7cb73f57c5f9cf99d83e7520c4cdd50e44f8 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412114026" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000eade91e5820903d878b47eebc7a3f4b016c1f6a972cc5d2e7d42092136b3bbae000000000e80000000020000200000002fd7fd837395399d58c2460a0b7e622bfdfda30dc7828abcd68089baa0b00c502000000027f72cd5c4be77746aa0317c4ed12e17d796aab525ab78b14846836eb22c18714000000024d2075e1e7f105eb1e921a8fcdc3d311f39acb6bc0bb27c8a6bc7304b306af6abaae96b4b34abfdf5c8d4cdf63a4a9f39f6d4bf8a7727bc38712849a1a5a037 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08f69656a4dda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2860 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
PID 2860 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
PID 2860 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
PID 2860 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
PID 2972 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2972 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2972 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2972 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2484 wrote to memory of 2480 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2484 wrote to memory of 2480 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2484 wrote to memory of 2480 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2484 wrote to memory of 2480 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe

"C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe"

C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe

"C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe" Admin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
CN 1.15.12.73:4567 tcp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
GB 92.123.128.194:80 www.bing.com tcp
GB 92.123.128.194:80 www.bing.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2860-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2860-1-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2860-2-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2860-5-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2972-6-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2972-9-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2972-11-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarF7CD.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 91e8e233261bb32a93cf66d03e18d837
SHA1 d9ce36056c368f47555c7f008954048cf523da9f
SHA256 b4ea8166a70f8e892f5c3c61a27a378921f3ea5abc0015ab5824c77d3ec681ca
SHA512 09e570f185e9d9aba4fd98280a12975fddeccb8035d9a795a6fb773a2c7ad1a7c5b72870a6bb672e8c2b231bbe8e0f0b0abccc525783e62a5f632b367699055f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 36a9d09a27941e1d5eb688a940d97605
SHA1 eb515cc0ddfb27d669caa26edbf25429c78285d9
SHA256 c8218f64dc73619332c32ac78639f5315d50411cb149f66806fd816ad7b3b21d
SHA512 797e131cac9cf119cb445ab4ab87aa846dc5a566f447c6f20f254657fc4021393cd636620f1cacffd2efc5829f6b14537ba7984fc9c94c27408e15a1d6e1b82b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7386151d966481ea78bfbab53fc5bc4d
SHA1 d138e36131a2a911339d8b3c54cf6cc869f912b9
SHA256 434981036aae1915ae8dc9e79e8af13a91e6715e209667abf46d20c4ef93c515
SHA512 96129caad66065cb3475e0dce672198cf3982cc068366af7a3f7ee5e0f8f42ff75c95d77c4d836d53856d3082d34e9a0ffbd8a9615c41a38cef10bc7bef809ab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 3eda1ead0587745986e64ce6e677f9a7
SHA1 ac0cfb2e5bae68624419a98299d9cf31afd3c5ba
SHA256 6ec4e17f71549e7eb9f33fb01de5af4dabca283524fbf98d70c534db24e0a976
SHA512 45b1794a4dd6a9282685d7433c8d47e616171df36502fa18bbe35729c3d3b192283a128ed6beb180dbb91b1f0c091b0f7e094a278011bf6f681c6117c85da955

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15bd0e2a43acd0a4f5891ef303b36015
SHA1 5738d180d2e2d900068eb58aa80f18dd47b98a64
SHA256 9984a24e381fb36e7db2cca787f0de57936a345e5c69bc137316da3e6b66d809
SHA512 a5d0220e6862f936d225d20f84b7342da164e0f1c796ae7cc40a0355175df9ae6f07826dd4361f6291e5573e83984bbc2954b0050b4b6061b3a29c4bc710aa35

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8f299765e952cbfe08e5bf67013c02df
SHA1 cdefee02ac462c5b8ff217dd556378e6f86ff247
SHA256 c54b807114a87343aa9c11b8672ac47e6789708855c1598f6114d4ca3e233062
SHA512 1a861c8249045fbfd95fb63a394abcb7d16567218ae02e6392f6c8d8bbe0de3c275059a1d312339e895be5ef61877b686f063c44a32442f35f0265bb9c36e4b2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 1d0ae6e61fa9fde964664f66a9139a4b
SHA1 888a7e629278237263a1e717829b3683d1063c6b
SHA256 f5b88dc5d8a4f8b00956dcfa3fb39a83f5d7db225d7ede9709537969ff574307
SHA512 590766e98221c04dce5755121674e4b901166fa50fdfbd3a58473e66884a5aa242aef8f0b2f4870f46265cfa95e682dd9c6addccae706798ea97f56ccd533e98

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a299de81c368cda7fe2075caab4d986
SHA1 fca4441b54e9b3f6b7da90a64ae055cffd998a86
SHA256 46683abedc22dd194311009c6d424b3bf115d7529c6674e05d40142cb06f76e7
SHA512 7a7fff2c3fcd3eb11636a1d4326f63543fbed98e0c839bd79280faab81fa93882eebe90fe743aeb9367c7eb25cfbbeb901f248c8fe67d54264fe8a807a12400a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fae262ea51d4110dfd1fc57a7b1d30f8
SHA1 d4e6dedf027ac8dc06d7feb243009d01bfc23931
SHA256 8bf9d5e6dee4b6335b7d3f654a91593af3be94194065befc62064b2913f95f54
SHA512 5b4333459bc856578e00de5fe0921513f9d38a5001b4db0e0ac2f3ebaf443c1db6523a28ff9fe083c9bc52462e7c506b223a2b3f67cb8ea6c919180f095c8c17

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79db35651cc29635f821db731b92f5e7
SHA1 a6d97ecc7c20362f99f00c9f77fd3a5ddb8b65fd
SHA256 eac5ff9470b01f900aa1883ced11afe6f615a7a2ac571afc6dcebc6181046f7d
SHA512 a4e977cffb14c0b1c5dade33ce6834a4ef6ad986c16e45fabf2af933b3d11c7ab38d80f52d250321c2ca0329d14f74c3c48c2c2db676f019d75fa9fc0c32eefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 873be43b915996f1b3995f7252a93e20
SHA1 f6a4ba801804a85ae3a9574a00461eb1626f9c73
SHA256 75436a5e61853e0d7597b39093da20eac8c876527f7b1ef7ed04f1d5e9ea6131
SHA512 376bab509307b88f1133e27ec73cfeb0bd76c491df1618007c2b62f9bec2ad22cae1e02d7d2655cd2dcea3da401f82fbacb26b8cc45fe6181260bfa71310d182

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3de31f51dd2272f3babb5d463105ba40
SHA1 ff197dce8d88a3877df3e16ae11696b04239c4f4
SHA256 0db0abbdf3ee59df1aa4a4d99236cba41d4db90694ad6cc7c98550e82224f017
SHA512 5d33c4a9d40bfe66e554a3e6b0cc44bc5750f41537aa81d2d6ceae7f1ab8bee6bb3b400dd65f83962d07b84c3234911873114862a1b8664089e2266b12c1339b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cb685ff10fab5e1967349efe304c32e6
SHA1 02bbb750e18783c69d02a3ebf7e0c9d21f89020e
SHA256 b3de4b89d47e2788beb19dc2f64c2930a444d69ced5ef63de2f1ce23e7ccad3c
SHA512 de8e7abe7d665f00015ed8a985289de5fe9aaf4d2b81aaec580f2100f77677724a477ad8ebdbd7319cc8c3de1d31f85d9f4f53a6c42c984d8c0bfa2f1afcfff8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a4f01c37814a8aee05a0c7359645b21
SHA1 c4bdbd3a9cbd9b05007969f02be0758950b39587
SHA256 f8840531506b9e37ac671b82e8d75382f3ec46e6691d46791e29808bc8543f21
SHA512 c065e515b8a0d6940adc2277fcfeb9f4aec3dc7455f401ea56746dc4602e703c20d3dc28c50c2428a3af49295bbdc55460dc3dd4c85981689bc512b1e73006cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b852111b15dd4a807c717eef05f51309
SHA1 7c4d1eb07ec4225d7849e050a760f4b9feb3c45c
SHA256 8fc6cf64ee81cf1ee85fe968bd1ae380dfe468ff004ae3d904c8f3d8dc71aa57
SHA512 83a6309f5115780a09bd6d6cb8aae77b2ce1c69505b97478027cf9396a4912bcc6f59d7fc046f899a92c0103d811db2de379f5654ab127e82aed5de688a7aa5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f6aef1570c0540f83959cf596856011f
SHA1 19c4589c2c79f35debfd851cbdd584f49fb458b6
SHA256 3c7491404a326fe3a3f9f66249d050fb0cf635592125916a92f92f5c3085a1b6
SHA512 dea355d14100aecabee1708c9187ab92d3d842cf94dd44c62f5d73d14fab565a8017fdad60f5bf1acb03f6d85ac1ec78f2a8eb12ff83fd361965e5625dbe6781

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ba87d6cc990ae36b72f0e8aa1829390
SHA1 edbbc0cfd32fa440453c0e5d6e746771b26cceec
SHA256 cfb0efb8652e42c14fc87402886e63e17097012ba6fc35f01d50be99049268de
SHA512 6ec34fe6ce8e4a99ea23b664552eb487d8f75076e7f0a0de7082ff1abad1f145bdc22685ad34b9552d46616cc09744c1afe2730a3740102dee23afff9137aae3

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-22 19:35

Reported

2024-01-22 19:38

Platform

win10v2004-20231215-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 556 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
PID 556 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
PID 556 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe
PID 3256 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3256 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 3076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 4392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe

"C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe"

C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe

"C:\Users\Admin\AppData\Local\Temp\c2c1a3a88ba9df719c73a2f2bf6d71807731b8f091c658562d5c5924a32ce339.exe" Admin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb95546f8,0x7ffeb9554708,0x7ffeb9554718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3008 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16580667452405786087,7172780676456895191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 16.234.44.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 59.242.123.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 arc.srv.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 203.178.17.96.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp

Files

memory/556-0-0x0000000000770000-0x0000000000771000-memory.dmp

memory/556-1-0x0000000000770000-0x0000000000771000-memory.dmp

memory/556-2-0x0000000002530000-0x0000000002531000-memory.dmp

memory/556-4-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/3256-6-0x0000000002290000-0x0000000002291000-memory.dmp

memory/3256-9-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/3256-10-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/3256-11-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/3256-12-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/3256-14-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 fa070c9c9ab8d902ee4f3342d217275f
SHA1 ac69818312a7eba53586295c5b04eefeb5c73903
SHA256 245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7
SHA512 df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc

C:\Windows\system32\drivers\etc\hosts

MD5 03450e8ddb20859f242195450c19b8f1
SHA1 9698f8caf67c8853e14c8bf4933949f458c3044a
SHA256 1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b
SHA512 87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b

\??\pipe\LOCAL\crashpad_3464_SBJWTBAYSHJPOKWT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 056352c8efa4bae213728ccea238fba2
SHA1 fb3f56265d04be8c1f7c81e85d9767832fde7f49
SHA256 82d4d361590932b81049e11f374c407f0eaaa57f1cda936beaf2d27b37504c4d
SHA512 3a36d6086ff3784ebe711bb2636b2d60450c9f5782b178c141aba2c92ee26729ff3c7b92a368f2a29bebfa55a979ea2611a762a8ed0aad125e9e04e4126c9581

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 17c5f1cc92f3d32918dcc2180f436f7d
SHA1 4617d51e696f0cbe32d7a599cabcab96d000139a
SHA256 701e15f755492dc9be4501829db20c69510ce8140389fdabee44958c98d79731
SHA512 a0452c670a52b9d4b0ff4560b1989c430beea0880347b4f0cfa65d864e16513f84d6d9e9aa91f9bba604d07de396582f44e513e8bab2fad5cc12d7602fd99e8a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3802a059fc41279ad6b0876423304512
SHA1 5c9b88c9dd84741ab933ce84d6b7822474b45b8f
SHA256 89d554d4e88e1e2939872bedb9ea1a0ffb02adea086d4b26abd11d1241ab87f8
SHA512 e00ae1e7d7816d3cb9b7d21f537cb3ae56e6af8990e8eacfc198d0075f46988aa010669dab573846929bf21a479b0bbcbe48ef97feaebebe2ff6e06e5f5f6fe1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 917dedf44ae3675e549e7b7ffc2c8ccd
SHA1 b7604eb16f0366e698943afbcf0c070d197271c0
SHA256 9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37
SHA512 9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d