Malware Analysis Report

2024-09-23 03:51

Sample ID 240526-gsk8tshc9z
Target 2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172
SHA256 2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172
Tags
metasploit backdoor discovery spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172

Threat Level: Known bad

The file 2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172 was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor discovery spyware stealer trojan

MetaSploit

Drops file in Drivers directory

Reads user/profile data of web browsers

Checks computer location settings

Enumerates connected drives

Checks installed software on the system

Enumerates physical storage devices

Unsigned PE

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-26 06:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 06:04

Reported

2024-05-26 06:06

Platform

win10v2004-20240426-en

Max time kernel

140s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2724 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe
PID 2724 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe
PID 2724 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe
PID 4480 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4480 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 5048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 5048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2192 wrote to memory of 1984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe

"C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe"

C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe

"C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe" Admin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7b8346f8,0x7ffe7b834708,0x7ffe7b834718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4356702888068019372,5188382055437255876,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5764 /prefetch:2

Network

Country Destination Domain Proto
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 www.178stu.com udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 arc.srv.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/2724-1-0x0000000000640000-0x0000000000641000-memory.dmp

memory/2724-0-0x0000000000640000-0x0000000000641000-memory.dmp

memory/2724-2-0x00000000023A0000-0x00000000023A1000-memory.dmp

memory/2724-4-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/4480-6-0x0000000002430000-0x0000000002431000-memory.dmp

memory/4480-9-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/4480-11-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

C:\Windows\system32\drivers\etc\hosts

MD5 03450e8ddb20859f242195450c19b8f1
SHA1 9698f8caf67c8853e14c8bf4933949f458c3044a
SHA256 1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b
SHA512 87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b

\??\pipe\LOCAL\crashpad_2192_NHWVUNTEFPSOJIGH

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9a04ae487973d03e4dd4d25bbe3c694b
SHA1 32e1912f9f8321c3b953bb83248fbf04e7d6d4f9
SHA256 28089884edc65bac21fee9dbda9418efbafb8b9ca6ef91c90486df13de1efdc3
SHA512 cb5fd4224c45021087bdfc1d039d8e86ce2959e9095d28b8e6ab9d4fd4d3d95a4e6e83a9701cf4329a45c50631c435a39ec9b639be9797d6460119901006b624

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 83c81f5843b117b318db89284cb4e5f5
SHA1 e50595fe0ebc38760486803ad210a0cdb2cc6aaa
SHA256 042b7d1150db03a3ed644d6e148381f2f77ce1b652ae6f6ecc590f217861348f
SHA512 77992cfeefbbd4386614197cec33110145ff780f471206363924d9b011c20a5e2663d46a2b578d802d36d5740b8020a511acd84ec311fe55b45cf146cff3e2f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 35d648b520491bba7da2b7755a223e4c
SHA1 f49183495220eb5be90f1c80389a79c88f7e731c
SHA256 99806065613cb5ff08e8c1cfadaba8d1c3a4da724471fa46fb1ae51f67525e03
SHA512 cecde80ae7ba97d25d02b5e49a3aa2c9f32a6fb06055e0809486e06c1754877c245392cff311ddf8189a3a45b149ab7083e967ff8e1e82cdfcd198a332bc5450

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 06:04

Reported

2024-05-26 06:06

Platform

win7-20240221-en

Max time kernel

122s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422865327" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA828511-1B25-11EF-815A-6A55B5C6A64E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bf91e7df4e4794991c347a1d7f0818800000000020000000000106600000001000020000000e1bc0feb3c2e20117fa1cdb81be71a6b74b931839073a24d0fb4004f147bb25f000000000e8000000002000020000000438b7bfbeac4de9fe961dfc996512fa27b41746b115aee0dc097dde0e319f2719000000056a61808a7b9e0692603121e7d8f3004979887499c227389b0baa42023e9f2afc1399d50c094f0217227153f872dc85cdc8617cea78562dfdb45f56b63c05a05cd96727ded6970feff60a4241c58369c6e20d1e2581efa8b61f1263c54a3e63f5a07f8be7abf128e9d7778fcf3a582d4354ba342154ce6b694c9aa9999c3e2e1962f8dd65edbe9cea21f222c13a5b53940000000c43db271238d47a5fdd95016f215f864c4314f0ec1290ab0c28937a090065560b281bfab62f89ece90f8f8c8c9ccf72b68ef6887135dbd0afe313122a6b766c8 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80233bb832afda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bf91e7df4e4794991c347a1d7f08188000000000200000000001066000000010000200000004c60caf87f65756980c6c8ee002a459726895b22458e9e6411d9535133b82f18000000000e8000000002000020000000726f19d310c90dc2d4c0d32d6eaafac84605ad15a073d078573eae7537bc017f20000000aab7531a30443289d31f9ddac42aa07936b9359173319a6835a21911e1b86f1f40000000a775a832fb8569c064bf8af0533d5ed5a5e4fc68dd5691199e6f97ecad0f1a1a3a9b5481c81e8bcd34e359573cb9b75dc127fd724228c4766c6689dace64d3d3 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe
PID 2244 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe
PID 2244 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe
PID 2244 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe
PID 2228 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2228 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2228 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2228 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2632 wrote to memory of 2240 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2632 wrote to memory of 2240 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2632 wrote to memory of 2240 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2632 wrote to memory of 2240 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe

"C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe"

C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe

"C:\Users\Admin\AppData\Local\Temp\2d5e24a64ce7641682b03142a206974d85a0e856d41795ee87975c3640f38172.exe" Admin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
CN 1.15.12.73:4567 tcp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2244-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2244-2-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/2244-1-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2244-4-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2228-6-0x0000000000280000-0x0000000000281000-memory.dmp

memory/2228-9-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2228-11-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab1039.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar110B.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 74417e7a1e9fd3b26c8a4afa796dfc01
SHA1 4caa5b9c661e2f4226c0f99739c3bdbd0fc1effc
SHA256 ffe9b8c685f8e3ff966020f7db7e4cf659c1bc9eacb0ae13da59a95be1276f82
SHA512 935817883b92bf906ea8d2dc1a34691f36aeea23827fbab03e0d54c57413c00bb75d5396c977dc1dfb1410320b75fa4b614555370a9059ee7d8c5b431fac237f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cd4fc1373efe20bee3edcef13c3c943
SHA1 6d0de2d6454538354c9291ccd0b998a9e6f1ccb7
SHA256 31745c66346f7baa27af182137620dc8d4dd892b77888372cd07adfdb9d70e6a
SHA512 7e779878e3c2196b430c2fdef93e46f02c621ca0cd91a980decf9b2d26ebabe2bcc54576966d23beb0d833e2f0d8aa975d696d42cf2a7a063620e44bc600d7f0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f94df85d7f9c0590e5724874ddac2ae
SHA1 2ecf68cfd647f5557615b0c9dfcfc079e204f0af
SHA256 5822e2aa40ffedaec195b87943e4399c99dbf45a33e80f6d18f4296c62488975
SHA512 eb31cfd73ba052bb37b4979dedb1f020dd0ffbf2af2121af19a72ad2b679870b819dd2435e7150b333687fa4b0d870d270d5f16d2ee1d80a2fa2862608f600d9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2efa21b31dd14601e9f109d6f138c128
SHA1 6e9ab94bd03c3b4184f3e81319d6655c54441869
SHA256 00eb38e85fb278552635164cf4a309bd98cfa54d2664b92d6182ddfb6226b0e6
SHA512 80a2684aa3a32a623b3ee3c58a1153543b8bdeb79e3b0d093a6b75141958b2de88a79f1d07d8807c3f6269fb53eb30cdc8e6917c96334a4ddad1d933bbe72fe1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75451262e0a2b0af9bd79e8380240d85
SHA1 1647ea34823acead72b894844450913ab4b6ad6f
SHA256 1e2a5a786110cc934a35c981f5c7d2e500c1e6211add431e5940a29da5032ab4
SHA512 ce45b0fc4b8ee5ff9f20e084501fd50ccd19a5132b8ed0b814238e34f510e3aa314d833ef9e6276644c67705ba516b157c32778956dacbff8c2e114f2f81004d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a749daa7ddca935b3cc097e701ea8db6
SHA1 fe7975495d30d3e70385dfdd4bfe9f56aae942e5
SHA256 3a9643a5298131ec9873574986ada7320fa688a86d3b8cab319e55c8fa81324a
SHA512 0face501623fab99d5b1da39a816768094d35aa28a36e86243783af41a1ae2a93bb9ffb5ed64a5f8a32e33f55caca7c890968f2baa46b8a18fb2203fa6d65b68

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57f8bc011cde1078447f123d279460c3
SHA1 eb7232a20293bb2e6ceb29011ef6db45f6ec6b03
SHA256 868e1303894baf3aa2f45e494e12dd41c3970b9601274b23682765ca9f88f6b7
SHA512 f2d42f19b6b02e90e74de85e695925fec3e0772d5147722e9478e076980016c99fda1bb3873ad1dc5a887170b63fc5bf29f48e0675c122ae762878bfb3059580

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f606f4b31681adc3987c4b5224b2930d
SHA1 7c654381fd76c54bf1d016efd15dde997fc40cfb
SHA256 6dfe2cba370ebeadfe577b5598d16e878a57504086d58379f976b29090bb67a1
SHA512 6125560af603f9f0f432978de87bdc6f3ad202b67ee58af1fa3dc8dd0f3c6119b531445055e199b568fd74e387e241bae4da32f9072bf6cebb24fd69560735e1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f4ec3e6d1b839f1b9c63eda51dbd653d
SHA1 9d8107fdd6460aed97f3949202f79c13b8fe10e8
SHA256 53e3568b8d7d5e4887b959c91e7523c515c1d3ce492e125f516f4d5c083cdced
SHA512 78d8f8d82c0174d36fadb6577b6ddf3fc179f7906fda1a58e79698ba9a510c3fecf711792aa2b281f783a80c4bbb4dd5d91a3a0665da4462401b80ff61c017c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 829f3493580e427794af89ea532778c9
SHA1 c1a6c0e3522a6925e24eb6f5857343b3b19908b8
SHA256 8eba3cce8f33f8b31480c3de59d4dc17826a2eccfc2763e92f4b9c58d78c7a84
SHA512 401859234f71a0e5db00aa6379ed9b57ae36288f8e3d6663d0695b3340bfd8000ced1a1c604820ce914db661a0ac53d04b71131d28cc7e8049a0eeb5c7528450

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ae5797c8056455d6f99a17232655ba8
SHA1 8027f967e3e55f18032f516c063cf73f6967871f
SHA256 2a4231f06c2f530fbcf125ddd3c47b03b9aecc1f629bb6122d3301cad7794bf6
SHA512 b6a6e61d5971264cf645be33cf66be69a02cb0ea4962c423b9d4101652b205e4cc27cb1a3453daca0e3ad7f9904bd971ef2f20804aa9741568b17a943e8fd982

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5b1ce1beaf76dff776ad629da0f6be27
SHA1 aea1217c34120ee6643ad9ae2fb45412cf7a8227
SHA256 299a0709f17bd2cb5e3d4ba81afa55b0c6b2edd293e5bb9ec528409834b3e637
SHA512 fa4876d6ed2b3c60c1ac94c056a570173d9cbe3990ea659c60dfec8c734e2335a4225bf124f9c9d09a0d56930475fdd5e9a883d2066522d77ac63da3f2851ea4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a254e156814a67596090dfaf0e9c958
SHA1 986334a2236091e50c92fa8a688991e32cded017
SHA256 5174cb012db7ce0c819d9b0b32e6163ceaea9133596bf219c3d99010bba4122c
SHA512 5ad3db27c7992f626c9875ee58f2573d3c41e6ab451c6015bd14ca74d9261ca0f75391630893e89a2b5b098d9f076fde57a3794d7c29abc78082a5a6cf589c9a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6c62e638d15485a04dc8273075303871
SHA1 2b3b673a6bd7f4b4e83ef77c6420876dce995a42
SHA256 bed0a2877861b511f2129e59493c2a3112bbcee164141a55e9aa3d45b22997c5
SHA512 257905b09c07cefe2bbd73760cdc66ec0a9b059ae967bc57f0d9aac59df7a89ad2e32c6478628fb1ca02e0f89bde31e88945765144aa0012d62e38655cbce97f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 54a5f5a04edefbdb917824d661009e67
SHA1 79c76db9c3d4ee2717d41966ca5e4a527414fd6d
SHA256 be4b7491a77c35506c15a52bf80366e0e596cb9a1b1ac7ed6f8b318093f0cab4
SHA512 fcf25f344244be41cdd4b7f7d3a585fb8216ece6a4d85a6d71b041aa015b098770ddfb14a980601d16e4592efaa81fa8a3604a5ed165fc680be439ad4252fed4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 371c5f50ff2aa0b698ac08cb03d7bb43
SHA1 0b0a56ca30abea2c7cc2b9c366a560d8bb5915d2
SHA256 7db4a6f5fdd2964742ed366fb2e4cc5ba0fe5ddf24295b62694cff2baf970c0c
SHA512 6b16bbde1babd9d1323b1bebf5d34d6c003ed265303a0a631e48589f88bd3bcdc9b8e8d492ca2e5dc374e40f11b9932699cd49c0aa9888b6ca0e692b94ca03bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d3091fd97499603fb5bf07af0b15210
SHA1 c1628e9db5781f4a67cc4c69a9c5407d63c74afc
SHA256 da0f3af3dd753cc79ac0d925d1b99e23f4756570519f9bd60ad494b5d7ffb480
SHA512 1449fc4e250e7d12d950721b9e85b24a373f9705235b9a62d9f18b520e523be68177c3bc430e1df79b69197f763eda634efaf1be886f897d7c57adc45ac9f6a4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 82352409a0d2104c9cd9be88f96b7176
SHA1 0e005e76810f7d592ea129232af5c1ed851d739d
SHA256 3948d6f1502df90f69b6205c6374d67f240ef2969b20d28fc7a97ebc0dbe8ae2
SHA512 c1278de8404cd54d3da016f645e45a67a252ca0cdf2fa36ef8e9e39d72b83063e30e435b8334c3b41f942fb9cb788c508685531cb59ad228907632654bfc865a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ab557a52a51b3d1baf323458ceaacd2
SHA1 7f20720ee358736bf8bf1fa1392f4c93135e003d
SHA256 234ff696a29f471b05b024d6d2b639c36017fc4e0d35b7fd2534c048062ab373
SHA512 f4756919f13de2404bb08e2addd0303fcd299ce5db87c64793bc826932226fd513986878079816cac67f066dd388ce7be2ec52c911eac5707ebf50aeb3000329