Malware Analysis Report

2025-01-22 12:51

Sample ID 240521-tzytqabh21
Target 63f797c21eee2be3c20bd64c34732d9d_JaffaCakes118
SHA256 dc1ebbb7b12eb3505b1cb173e77fc802a7f064946673d1c06a9e53d1be8e1fab
Tags
vmprotect
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

dc1ebbb7b12eb3505b1cb173e77fc802a7f064946673d1c06a9e53d1be8e1fab

Threat Level: Likely malicious

The file 63f797c21eee2be3c20bd64c34732d9d_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

vmprotect

Drops file in Drivers directory

Checks computer location settings

VMProtect packed file

Loads dropped DLL

Executes dropped EXE

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious behavior: LoadsDriver

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-21 16:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 16:30

Reported

2024-05-21 16:33

Platform

win7-20240221-en

Max time kernel

122s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\DRIVERS\Mslmedia.sys C:\Users\Admin\AppData\Local\Temp\87.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\SET6059.tmp C:\Users\Admin\AppData\Local\Temp\87.exe N/A
File created C:\Windows\system32\DRIVERS\SET6059.tmp C:\Users\Admin\AppData\Local\Temp\87.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\81.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\_ntdll.bak C:\Users\Admin\AppData\Local\Temp\87.exe N/A
File opened for modification C:\Windows\_ntdll.bak C:\Users\Admin\AppData\Local\Temp\87.exe N/A
File opened for modification C:\Windows\hllog.txt C:\Users\Admin\AppData\Local\Temp\87.exe N/A
File created C:\Windows\Setupsti.log C:\Users\Admin\AppData\Local\Temp\87.exe N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Users\Admin\AppData\Local\Temp\87.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\87.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2240 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe C:\Users\Admin\AppData\Local\Temp\81.exe
PID 2240 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe C:\Users\Admin\AppData\Local\Temp\81.exe
PID 2240 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe C:\Users\Admin\AppData\Local\Temp\81.exe
PID 2240 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe C:\Users\Admin\AppData\Local\Temp\81.exe
PID 2240 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe C:\Users\Admin\AppData\Local\Temp\87.exe
PID 2240 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe C:\Users\Admin\AppData\Local\Temp\87.exe
PID 2240 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe C:\Users\Admin\AppData\Local\Temp\87.exe
PID 2240 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe C:\Users\Admin\AppData\Local\Temp\87.exe
PID 1268 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\87.exe C:\Windows\SysWOW64\cmd.exe
PID 1268 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\87.exe C:\Windows\SysWOW64\cmd.exe
PID 1268 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\87.exe C:\Windows\SysWOW64\cmd.exe
PID 1268 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\87.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2012 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2012 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2012 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe

"C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe"

C:\Users\Admin\AppData\Local\Temp\81.exe

C:\Users\Admin\AppData\Local\Temp\81.exe

C:\Users\Admin\AppData\Local\Temp\87.exe

C:\Users\Admin\AppData\Local\Temp\87.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_lm_delself_.bat" "

C:\Windows\SysWOW64\PING.EXE

C:\Windows\system32\ping.exe 127.0.0.1 -n 2

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\81.exe

MD5 930e16d438c4bf3f4b1b12c4d1fbbb24
SHA1 aefca05fdad45b77a1eda04ea5c9f74526d4f048
SHA256 c75be5467243b5ba610386fa4ece8a76324f5ac7142130a52ce44b0d1632a653
SHA512 ba089584371ea86dbf36f3edf735a9bb2d634766821902012f0e3c33078dc968bfc3666e0d8ca93bb611c642bc4d15f84709027c8b1d461246f48ec890a8c4ca

memory/2240-8-0x00000000022B0000-0x000000000257E000-memory.dmp

memory/2240-7-0x00000000022B0000-0x000000000257E000-memory.dmp

memory/1036-11-0x0000000000400000-0x00000000006CE000-memory.dmp

memory/1036-20-0x0000000000400000-0x00000000006CE000-memory.dmp

memory/1036-18-0x0000000077580000-0x0000000077581000-memory.dmp

memory/1036-14-0x0000000078010000-0x0000000078011000-memory.dmp

memory/1036-12-0x0000000078010000-0x0000000078011000-memory.dmp

memory/1036-24-0x0000000078010000-0x0000000078011000-memory.dmp

memory/1036-23-0x0000000077580000-0x0000000077581000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\87.exe

MD5 493fd3fea30ec04f504651751bafe15e
SHA1 3bc4cea48691bb2c47aae2054d1c909c802d52d6
SHA256 ec786e2604aafa308a84c0b1c321651f4981fac9f96973d138bc79bb8c54fe6a
SHA512 cb501015c3ac6cb8e9933a5219f9c5a6dff05a50079865635e203bab98a0824ffd4bc1d5928a2ef3fa49b22eca853cb8c695c0a6120c324586fdab13a0627f88

C:\Users\Admin\AppData\Local\Temp\~tmp_hl\mslmedia.sys

MD5 9d9dc0cdbf3e6be3bdaee95872f7c5b3
SHA1 ad74265c02507ebf5a4e283a4b24000fd946b4f2
SHA256 a3442dbb95c96bf15f40f84dd80eacdd02a2b8511a64c0827ada0e3484da026e
SHA512 c105110cc57c25089d9e7feeae2e1f4cc9730351f05d7ec947e736ac3c8d51b02a9fd4c279bc0484770a38980a8013ee05f440b9e44a8f6b5e3151f7a404a6d1

C:\Users\Admin\AppData\Local\Temp\_lm_delself_.bat

MD5 fc1cdcc5d72d2511dee0662b9b342312
SHA1 84571afa30f31970fbedb424eb51b833831b1786
SHA256 21dd8777689643a0839941573c5254c8967be4f129e0f9ad7b2d6c3b9a3c67ab
SHA512 6f52b2a150b1ad706ea4da9f01d3dae670ee77b9b4cf0963c69c14e23e7206a275e6cb39fd543f7d8155f993254cc63e37ce444c79b3d869c4790aaa0d1a56be

memory/1268-55-0x00000000010D0000-0x0000000001107000-memory.dmp

memory/1036-57-0x0000000000400000-0x00000000006CE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 16:30

Reported

2024-05-21 16:32

Platform

win10v2004-20240426-en

Max time kernel

133s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\DRIVERS\SET78BA.tmp C:\Users\Admin\AppData\Local\Temp\90.exe N/A
File created C:\Windows\system32\DRIVERS\SET78BA.tmp C:\Users\Admin\AppData\Local\Temp\90.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\Mslmedia.sys C:\Users\Admin\AppData\Local\Temp\90.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\90.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\46.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\_ntdll.bak C:\Users\Admin\AppData\Local\Temp\90.exe N/A
File opened for modification C:\Windows\_ntdll.bak C:\Users\Admin\AppData\Local\Temp\90.exe N/A
File opened for modification C:\Windows\hllog.txt C:\Users\Admin\AppData\Local\Temp\90.exe N/A
File created C:\Windows\Setupsti.log C:\Users\Admin\AppData\Local\Temp\90.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe

"C:\Users\Admin\AppData\Local\Temp\刷QQ音乐排行榜.exe"

C:\Users\Admin\AppData\Local\Temp\46.exe

C:\Users\Admin\AppData\Local\Temp\46.exe

C:\Users\Admin\AppData\Local\Temp\90.exe

C:\Users\Admin\AppData\Local\Temp\90.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_lm_delself_.bat" "

C:\Windows\SysWOW64\PING.EXE

C:\Windows\system32\ping.exe 127.0.0.1 -n 2

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\46.exe

MD5 930e16d438c4bf3f4b1b12c4d1fbbb24
SHA1 aefca05fdad45b77a1eda04ea5c9f74526d4f048
SHA256 c75be5467243b5ba610386fa4ece8a76324f5ac7142130a52ce44b0d1632a653
SHA512 ba089584371ea86dbf36f3edf735a9bb2d634766821902012f0e3c33078dc968bfc3666e0d8ca93bb611c642bc4d15f84709027c8b1d461246f48ec890a8c4ca

memory/968-4-0x0000000000400000-0x00000000006CE000-memory.dmp

memory/968-5-0x0000000000400000-0x00000000006CE000-memory.dmp

memory/968-7-0x0000000076800000-0x0000000076801000-memory.dmp

memory/968-8-0x0000000077FB0000-0x0000000077FB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\90.exe

MD5 493fd3fea30ec04f504651751bafe15e
SHA1 3bc4cea48691bb2c47aae2054d1c909c802d52d6
SHA256 ec786e2604aafa308a84c0b1c321651f4981fac9f96973d138bc79bb8c54fe6a
SHA512 cb501015c3ac6cb8e9933a5219f9c5a6dff05a50079865635e203bab98a0824ffd4bc1d5928a2ef3fa49b22eca853cb8c695c0a6120c324586fdab13a0627f88

C:\Users\Admin\AppData\Local\Temp\~tmp_hl\mslmedia.sys

MD5 9d9dc0cdbf3e6be3bdaee95872f7c5b3
SHA1 ad74265c02507ebf5a4e283a4b24000fd946b4f2
SHA256 a3442dbb95c96bf15f40f84dd80eacdd02a2b8511a64c0827ada0e3484da026e
SHA512 c105110cc57c25089d9e7feeae2e1f4cc9730351f05d7ec947e736ac3c8d51b02a9fd4c279bc0484770a38980a8013ee05f440b9e44a8f6b5e3151f7a404a6d1

memory/3708-35-0x0000000000E60000-0x0000000000E97000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_lm_delself_.bat

MD5 20839f38a7605f8b67a1521a531407ff
SHA1 91903f6ebe798410eba115a078dd5fcabe03abda
SHA256 5671cab2d881c099ee5f5dce2147de818f620c1f6a1276c099ca66b64a84566c
SHA512 3dd855ab0521aa758a0498a8699ef73dd590db1714ef8d53524902b3f7961f0d40d8dbac205c36ca9e4e0a6011f8d28fb6c15fd667ad22be9da68324ea929d44

memory/968-37-0x0000000000400000-0x00000000006CE000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-21 16:30

Reported

2024-05-21 16:32

Platform

win7-20240508-en

Max time kernel

139s

Max time network

144s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\极速下载.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422470891" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C27B331-178F-11EF-B27B-DA219DA76A91} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000abcec900aa32c6cba9d397c5bde384186b209d00cf440a36c49bff3b2cdcb712000000000e80000000020000200000003b805614299782834b7c9d6019103589075654ddcb04bba6f7d5ab9e3205be34200000006f27791723afc5be4d93440f6f9f3fcdfa539827e217db9cfa2114d93b06ccad40000000436f178c1d524337cccba3d348faa703e591a76a6bafb22cd3952e53675024388db0c27240ba4b557f774095a20e9d7086be33a6aee9de3257251a8051fc33fe C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004093c852284ca02d22462384d393702468e76b70404cfc0359f18902767b335d000000000e800000000200002000000043e655a737af8f90db26a5136356dbcd8635f31328ad5fdb6f551b2bb8f7721a90000000f8c00fbffdaeebcad84cedab33f95c05da307353315cd5c0ba6228de42c79ddd7ed65954fd3505c82fe087413c90312025b950c913d1407be52146a27d2c77c301af5eddc5b3974e53fc273ae8739a49b9ea6b5de8aeb628310fbe72555ae368272701b58c7571b15482861200146cb09c9383729adf16e90dc9831428e6be11868fd89435771b08e56b87a7c779f45b400000003c408bbf89fb4270fffadc46d714024e7ae9c5887185282a0da91fb14b5a0b7a49e8166b5e31a151e5ab2fc455470401c00378656714f7e0fa5eaba16d5b47e2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a3d72f9cabda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\极速下载.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.jisuxia.com udp
HK 103.235.46.40:80 www.jisuxia.com tcp
HK 103.235.46.40:80 www.jisuxia.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab3CC4.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar4908.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9c70818c56ff2dca0100d1b332c5d6fd
SHA1 a940e173ede06880cae15859c81bf4489bd3256e
SHA256 c8ec4a767d09f9e95d623dadf6c151174c5f78e2634c8b66b8362d6822d045c2
SHA512 d8aee435cef642e4ae53034a45b4443d649460eed8a4094d63f628051c056f292785b28e4113304a2e2bbe16c3dac1a34439ce3d0f2c1f67c70cdd7d079061a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7b8272f58434d1dbe72c457534776260
SHA1 3f51825f93f9c21deb8164bf8d02110e5cd14963
SHA256 476fd281e3c0d1ddc260249d66e25ceac670b5badad1f2db9dad4041a2c8a3f2
SHA512 b118678abce4dd653d7128d6ebaf9841701dd10f09f9dc3fce5425740ee456632b299c314bdcae9484781d0f09860d51eb1034282dbf6054fe081f7d2abb6aa2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 898b8e911a1b62f23a21335b5063a12e
SHA1 143d02803cd2148b9cd323e6eac06c1c0b788607
SHA256 8a16ba68dbe194e48427a95e7449435d99df8f54f9bac9c5252b1c8c2f896f5f
SHA512 132c338b2ef5dd91103282906e0261dc5140035138c4351be3a099eedcbd5584449330518c6af0820ca41d6a76b675b009357e8e92c3b48f1c08bb722d7524e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 83cb297fe57c01c3a65f69d7bb5c3ae9
SHA1 1db77f901c0ab7d1733993726184c741a372e182
SHA256 1304d28aea4f990e66720b56a880ef321dc37debe7386ebee41bdbbb0d10b5ce
SHA512 54e47527fdfc6be5c698a46c772c686fdc1899b9a4cd0524667dd3d1584185e70c0955f75984971853f0bd198fc3dec273948e40850c95a442182cf03efdc5f3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5dba3f324315f0ce2b17876447f7413a
SHA1 4f9b01cd65f63e4999c2fe952b5e19f3651ed9dc
SHA256 85bee37ffb9f80bb1a3f82a9b38a024f8dd634fa3f14856194480de358d6f363
SHA512 56a36afdc664aaad66b96e0f3261d5f4eee5cd58561738eb3509027889bd11dc9e2dfcf525d91925395bde50bd53667db81270dc3208231ab089befc054f96f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d6251de9d1d8c2951c99544b5b4b675
SHA1 fa6b3257a665101806243deda3bab9da510205f7
SHA256 1b4ac08f6cbcfe4eb329746a8bb9f80e04617458d5a06932895bf86507318799
SHA512 b7748e29bdf797d5b84f528c40f8404b95c254c65d829d56f9806c422de23f247def27648bf31abba37bd7111323398ca839bd2371ae8b3f51dc9cf44a547f5c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a4a40540695af554c38a14f3baf9ed28
SHA1 fba8efdb7b79a45c273e33c4dc56cda4ee84e4e7
SHA256 07b9e5c9f9b9e24da1f09003c4f6d25bfdaaa845ab7d0b760f741c35cd13cb8c
SHA512 e0a08d5b3390c0899d8290333f87c5f7bcc735774aee762e635a9e2d03d4437bc85ae9ffdbd3fc51d1981d68ce26476dd499016b14f834876874ad2b848a6da9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e57e7a311cae6a905ca9ac992405d96d
SHA1 3549c8b47b4818d4ba7db035fb3ca1186722b990
SHA256 f566f0df2ef9db54af6a9443c15c2d90bb8c75acfe12a4bd37f3b8a23491c589
SHA512 e7fa2280e859d59d7206bde42c6fd88b84623481553ef984b1a4be7fd31617256dc65d0bb75f1381c021621199f731d38b5e50cacc0b001ebbcf75527840d70c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2321d5816ee228c72bc7887f035ee78e
SHA1 0719453ba99d6cf1b277fb2b1f7f0c911854731f
SHA256 8c2f3066842423bfaa2ef0f6353604ca5f5d250835e41f8fa2135294853b73a5
SHA512 f84b1723dc16e7530cbae6c02d6028c4239d2d97cc26b9ffe7a98b81a508092eb39383e5d5e5d47a4e83a70c870e9d35537783c75654b033834285f4b9436138

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53cecaa69b5e8f032c229cb4e91aea39
SHA1 056f08c82a1c94b7c58af252f81a8a8913a39dd4
SHA256 546e04a5b1a62847b775a0a6be38b849e15b9a9394f1a1a493713f4e8ef7da3b
SHA512 61b32df93bd8776de8071eda17ba825015cd64c2f9f885553951b877f820a9d581930a5c414c7f91b1fb0d3e0de697b94106a0bc5cf13db54a960b59ccf513a2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c4bf566e03ce075fb03a771ee745a46
SHA1 9c413ef6a5e11e24edd54ed8f9206760eb2347ff
SHA256 e896d276e6aba621ac157ecd08c7ea97b8b34445913452c8202a7531914e3cbf
SHA512 390ef763c9918da45a4c09dc5510dc747388cfc909e9c4e716efb4e1df55941de1aa4dd9115505c968d49c2e359ba4a48298500ccae4eadfdd40866098e8681d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c4824e399ec9a257d830a38afd890aad
SHA1 74808cea82c4dbbaca52495728bede97e4044d5f
SHA256 38769f213390079fbcef3f1b4d13518fe1a26e9baf53e946d16f430974c33bcb
SHA512 d0b70b01212954f42ca59cd138f72c8a7b9a0462a877e55ff12fc3ad29bc5b388edd21fdf450a9762b64eae0a559eb04a20886984366e5539c26ad529ac73bac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 acf8c287a4ba8aa0a5d929483d44be5b
SHA1 85919c694422be9509ed58b8852c7d7ba25719b5
SHA256 7692781453b47dd699f154f6349d0d5f48c91af8dcd7a579a642a8081387424e
SHA512 6c2781cca04737168cda9960e3d6ed01cb6a85d952603b9769b22644f7e06faf36dba14e05156a5f51ee51025dca2ca09a0c582b79e7d1510f1d7713922348a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f970c94a7b334adf122ec05f47034041
SHA1 b4cd1c762c2e70212536f33a85163f269dc95e60
SHA256 ddfeb3b065b061a77df0fd220386b890e13a33422af31e3f21481c49b2a30769
SHA512 8ded15428174ca086bd45a2a9db89d2201f3b09dad8f22db4feb0eb0429dee91a47b1656da43d8f3d4ac34a1be1474b2ebf319940cfd03b646c5bb0fb5039adc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 daa2b99f553c4ee9fe1ca0c40a4c5ed8
SHA1 1808c276d3f3ce9831e1d922980651a382bee9c1
SHA256 e96934f2b957310d6e141b768ac7c6eb3ad3834dbc9fcbe24b9622b85a108777
SHA512 c788621be16d95c84b25b31f69923e87d316497573703a2e711a38ed9002e15ba58738d748fde273348f0d10d660445f888ba782035982654dd444c8d75b3b9e

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-21 16:30

Reported

2024-05-21 16:32

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

130s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\极速下载.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1636 wrote to memory of 3300 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 3300 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\极速下载.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8e0146f8,0x7ffe8e014708,0x7ffe8e014718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4295028682470750121,5926034885753317593,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4976 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.jisuxia.com udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
HK 103.235.46.40:80 www.jisuxia.com tcp
HK 103.235.46.40:80 www.jisuxia.com tcp
HK 103.235.46.40:80 www.jisuxia.com tcp
US 8.8.8.8:53 40.46.235.103.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 52.111.243.29:443 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

\??\pipe\LOCAL\crashpad_1636_UTVUKGSDGIBZPPIP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 87d5ff0f304544e9e5772ca645cc27e0
SHA1 b00ba024173addaca70b032491b86be0a13a87fb
SHA256 c9c566679e834db6d4f76e05d1c6d4704bf7f97ffa0a65d0831e862fc842e826
SHA512 550f81e8ef651f55c321f7061dd7d4155505be645d1f8c0221ba706501a5285fb7edc47f6a51c4de07f725c4b292d629b1237f78bdfeaf59fff068df3151ce5d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 debc6727aa6a3cf85c360755c469415c
SHA1 8804c66f663a2d91920e6bd55cc9694af471af02
SHA256 1bc65daf6741c37cd22921fab7d71439d3b9b19e583a128793bcd0e595439444
SHA512 084f165fd89c4fabc15e7d856968ffee6387028c69648b6f427bd40a16de2246ccae401d26f7007cce2b4129d293d587d73858857aaaa7c88bf5dc77f658f435

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 705d53cff4b6843b1e2683e42da5fb43
SHA1 a42f36a7934b9f47db5fa3fbbb345cf7116ca402
SHA256 3da437d2253d840c7dd8c3884b19464a02d76c83a1d2fecb7c44e907a9da68e6
SHA512 d8957c1e3d6af1262d6edc0894912d73e36eaff6f5ae5f606450ef8ed915ad5a576c00f0158b0c8da2eeb8e5c1f459d05d394a5911109d8d756cf2c2d9b0133f