Malware Analysis Report

2024-09-23 03:49

Sample ID 240526-j27jjaca7x
Target 14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a
SHA256 14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a
Tags
aspackv2 metasploit backdoor discovery spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a

Threat Level: Known bad

The file 14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a was found to be: Known bad.

Malicious Activity Summary

aspackv2 metasploit backdoor discovery spyware stealer trojan

MetaSploit

Drops file in Drivers directory

ASPack v2.12-2.42

Checks computer location settings

Reads user/profile data of web browsers

Checks installed software on the system

Enumerates connected drives

Enumerates physical storage devices

Unsigned PE

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-26 08:10

Signatures

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 08:10

Reported

2024-05-26 08:13

Platform

win7-20240508-en

Max time kernel

117s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000050f084fe0b80782f83e0f4f2f8b4c9b58a8714eb83cfbc8bb749e3d0dc0611e0000000000e80000000020000200000009c5b969ad36b6c81013ff071c783dc693c86daf99a35fd6babd642a4fefd6a1890000000f1401d2daee03f2ef20eb122ecc38419b8bafef9072305f3e80271860cc5b5c2e25fab38486a874299a58b2caea3167be87dba397b0738b577b4519884a15275d0d8e9dcc1abcd551530c21262319044ed344537457be3d4afd33cf276722aad85409fcf99b94579e678b84a613c88bd2f40a2c1c8c0576e9d116466cb0d8d004f1a35cd9d22350ceeb94c6592234d8c40000000bf47c779a223490dd005b6071383ede45d7d6fbe3f0bb3e23f3a11208f835a0add053f9dfc903522a82c5266f6ba625432e15da87ac2aed11eb00deeb35ace1c C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e2977044afda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e6e1f6b385a0b3a77b2f5ce3b98c59ceaeb269b7f65d470ff9ce678243737a42000000000e8000000002000020000000755ff4100f1a22afe6fc56ab12e9ad11dc349c44ca37378513fc66631f012e71200000002d1b4184089a28cfd09d1bc054ee6682f8ce4b0881988722479b97334a3fe6834000000099042857cec5d6d1b88f78f20f50c000b0853a79b7a0f22f94227fda4d6a337b2974ab6c571bc420fb0479819d615234ab6620bfcd28b2961b564c433cc0b19b C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422872938" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8307BB81-1B37-11EF-B8F6-D6B84878A518} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2928 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe
PID 2928 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe
PID 2928 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe
PID 2928 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe
PID 2932 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2932 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2932 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2932 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2568 wrote to memory of 2600 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2568 wrote to memory of 2600 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2568 wrote to memory of 2600 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2568 wrote to memory of 2600 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe

"C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe"

C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe

"C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe" Admin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
CN 1.15.12.73:4567 tcp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2928-0-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2928-3-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2928-2-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2928-1-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2928-4-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2928-5-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2928-6-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2928-7-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2928-8-0x00000000038E0000-0x0000000003ACC000-memory.dmp

memory/2932-16-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2932-15-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2932-14-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2932-13-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2932-12-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2928-11-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2932-18-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2932-21-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/2932-23-0x0000000000400000-0x00000000005EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabC05.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\TarC66.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd446f119b083d07cfd246672ea30aa0
SHA1 5a738f98b16e09e5f1e27864be6a8852db3dc0f7
SHA256 77d8edccaca46f4486988b1fb75e4bdbfa4a6ce614cae7498c298fa1b70d1db4
SHA512 43169b2daa955d6d086d0e1a3a1918baa79ba139e63794a74ca0bad0107e62822936622528dc39677631d12a35bc022500a405a90bbc56ef4ac622c11f92c6b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 330e70e10511cc3b44fb2f486691c49a
SHA1 5129ff54a9ffa88eeb38ff847e33e0b640ea617e
SHA256 9e394e21a23b0cc363154a2b82d20c7da76d78c987aec0fa98a6f476512b911e
SHA512 d6d304692ed77d7f00e42b1e32b4ef0f03580e02670d1d4bd05847406f14c3325e2b53fe8762816bbfa90029abf42babd03637ac3e9e25c21d86e059fe994bb7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e033e396f432f09658912b966227fa8b
SHA1 5e5d7b2565beb8006a7a85345cf5a83e5b5470ce
SHA256 74bbf417ac835d686d461273b30a6051315d34d7fe674ae82d432ef4ff36a695
SHA512 439941868acca8f2473c2be03dc858b36666733b1a635c83e4e2259ea0da77a801895b136eed6c61862c05a4293eaafdd76c582020989c61d0e28385e63c0a12

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2024d45df0d292da9123fe00d9bc845b
SHA1 ed7ba4eb4df10d82e331d9683585cbd467c44d89
SHA256 267963a17521bd14b94d01dbedf838bd4e4c30a5937e6c3d91ff81f0d4924cf5
SHA512 65163b98a14a7ff121dde0308f75c84864f465f70ca4ac87399524170cd5326c3c65290072713ac163604e6fdc1746d20e2f691b7fabc2f76033fe616605051c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 89cdeb0817b21b06cf9ecd5cf7e66b8f
SHA1 202818f0807a93c93a31f54bc32e6b507dcf7846
SHA256 5b3bbb2fe09ba6b9d2f3bb4cdaf388444367053ae87a53968ad0fa401ba212b8
SHA512 49eb306f3f63184400ea83dabafda0d5b42f9538eb8a3fe2d6b07ba24686e2f969c8b8a1012f8170167a68da26513bf7fe6d0dff6d829535a63cbb8cd59e2d2b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f57805fbccb26851cd95a4d1dcd438c4
SHA1 2c3e1a115d61d21f8f78ac37f97418823711f725
SHA256 39d8cfef0796f1ee3b606c7c561bfeab1153963e21ed80b16864d8e362106965
SHA512 a6201f95561ab66f95b1de32f1cf579fee8701847a77851c6c154d17f6de8154e27f6ed3c75efc78eedbb84668a386aba4d3d0c29267be43493c222c4067e4f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4752ab45062d6df6b46cf921f0b92431
SHA1 94aea97b63f1c1d55a65c7a0419a77994b5a490c
SHA256 6acdad195fe01ee16a47d1aa5b7d3382049f753c3f16d37e985376d5d4027416
SHA512 34237b397ebfa94cd2e897fb24655dbb78ec3227d2c7173cf978c47e6bb87ea2dd3509d80b814273db7781e3d5cafaa17dc09dd739bdd954faa38ff948640f83

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a4aa96e1a313fea7a02775aa0b5f9b3a
SHA1 d037937a10e3b61078f334071e1b296074d04f4a
SHA256 c7b7bac533f02d0b198cd1dc120c71921be6099c66ff2737d4bf144933db5c6e
SHA512 bda5b6c93c2215dd16519552e778b4bd60e02d8a5fbc59c1844983adccdbe0a065b1cbce86561158e034cc0323121d2ef4ce109a1aecf3167ea02f019fbd139b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ac367ee23d462f87b03da05e1272c49
SHA1 f32e3018be004b53093227193275c03eb8a1f3b1
SHA256 ff9660c6498ce59b5c2b34f39ecc0137eac7f3c56e6e5763b8ce75d25c46da8c
SHA512 280321051fd659e50b285637d23a11d2bc68a51644f71ac0b469c2416430d0bc608de34fb735f7263b2aa774d13e6bc31bb28dfe4b5bc14343a1d1ac531a0b8a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d6d017a2f8a543c3ad16b05e1d0bb39
SHA1 283e4f0ec054295e2c6770a400ed20555d6351ad
SHA256 fe178527f63964c9dd6e01cf6bf7d55031cd8b13f0ecb596b7d7bf1a1cd1b911
SHA512 811ccee4e3017ffdd759a912de56dfab116109d960bed412dbfe80e14981b45f1802ff4e2e729a7aaaa5a290cbbb7c411f78857878296f7dc3ad595a05c19315

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e917cbaa9bcda34111150fd1d472208e
SHA1 bd81db54a601513b8622ad4bd35e4184f39f3908
SHA256 f9f4db27f14cb1662cc7bb6a6c36a79002227bcecb32be7c25cb2ec7e2449875
SHA512 f7206a2d8617550dcc0404b340064108b247f2e5e17bfddae4305afdfa157cc25beac8f4e9963e0ee105ecc0590c5e7cb28ccbf8a4e68a5a96ff75a6a5e4442d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ba822d644edc7d139f0a43df75730513
SHA1 6bea0f930b9af3dfbd950bf0f2f97e7212d93f38
SHA256 032cd13f726aa6d3ffe62682d245912d104f2b74a307da0c6c32140a9df3b8bf
SHA512 10cd31a2c5815217e285e45adc4037977a5c058fa996272cf586b614959469dc3ef6bc988fd27950b30a0383c173c37a33e0f326d68aa31181221a11fbb8c869

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9b789621bd37c146e179acdae2db0b87
SHA1 7b878d8d7b848db2ba4aeb90d0fcc4bca1650f7a
SHA256 d9129cb4f179b3c53528ffe1f851e524f13ed23b95add0db7737bbbdb5a2e825
SHA512 280f7272bbc66ac75c6063523b0120c4c8b309362e40f8d0fe2338954d524df6b17758bab1eb57cc7d162cc19102f772947ef618d8a45a5db84e85a9ddd9d6e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec62859f57a2ff443e6c5c76ce44dc6a
SHA1 7c96768ab076e19db44a14129b5860767b44f915
SHA256 0667b0500744422b85ca01e257504308bb049758933eb9f86462624707588649
SHA512 2be72a95e2b70544f7743c66d03b32d67990d239a700044202615e2e412fdb1b0281c89bed8c33c87801e5db847c870c9ca939c64997534e7a0774daacbaf5bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d1951e589ffde788aac3bd60f56f31ff
SHA1 e01406b34cb70a45ede4f102434c0c20fe4cc949
SHA256 c1b103f098a23ea7e22a76f507b54c8ace90c7f6467171875eff3121f9add831
SHA512 6571a4f16290c3b485b29e33e95c9180574cf0fd7e43191175d76e451cc165af2751d373ce13c1f1649b942ffeef1728bec4b7ec294eaf14d0a58e333560f8f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 418005f78dfea04fc05fdcd5520c5d59
SHA1 f89f4e155d8e81240a9322d5ee87876a0f162081
SHA256 279d839506d6b61d629bba48f85cd69922673c66706227e1ffdac29a3085bc76
SHA512 60678edef3f11fd6b09e7a2462ce81eab98fedfa917addcdadac870755201de81ca28dacb2208fcac3cddbd6b50199c8a09ead3119d557d3d661445d1496a3cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f09c49308ed5c7225d46629822c35ce1
SHA1 21c8b0f295d484dd45c973280f23173751456646
SHA256 74ae9908adad03eef0bd11bf80fe27969430da87be6ff82ad61cc182b669e16c
SHA512 3928b1211f3b803a6666aa828bdbf69593eb3c11daa16da41b3e1e6768844e30f062146f95c84c7af4aaf43931a0558d6fda0472343fa75928a8b1b1275e9da0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 49b654a72cd5d5e69d0020e7c66e1948
SHA1 4bb8a3de162d69e1d823760ce8c6445c20896b90
SHA256 5ced1f2d9cfecd723d48d0038e293931d4cca958ebced2f0c10ed47d1490f3e1
SHA512 3acc42c2ef7462810fe70b79aea898d49fce00719ac70efa73eb877dbcbed8a0038712a0f4650ba32e17da9e1111f102b1a66aca5ad817b1f947a210cc8c0f27

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 08:10

Reported

2024-05-26 08:13

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4296 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe
PID 4296 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe
PID 4296 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe
PID 4704 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4704 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 3344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 1708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 1708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe

"C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe"

C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe

"C:\Users\Admin\AppData\Local\Temp\14eae8dc2f67c918958429dc9166e2551ef0ee7aee51e85fb553c76aaa26705a.exe" Admin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffe445146f8,0x7ffe44514708,0x7ffe44514718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7128074263518506523,10268495703148241955,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5236 /prefetch:2

Network

Country Destination Domain Proto
CN 1.15.12.73:4567 tcp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 arc.srv.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 14.179.89.13.in-addr.arpa udp

Files

memory/4296-0-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4296-1-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4296-3-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4296-4-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4296-2-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4296-6-0x0000000000770000-0x0000000000771000-memory.dmp

memory/4296-5-0x0000000000770000-0x0000000000771000-memory.dmp

memory/4296-7-0x00000000023A0000-0x00000000023A1000-memory.dmp

memory/4704-11-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4704-12-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4704-10-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4296-13-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4704-9-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4704-15-0x00000000022F0000-0x00000000022F1000-memory.dmp

memory/4704-18-0x0000000000400000-0x00000000005EC000-memory.dmp

memory/4704-21-0x0000000000400000-0x00000000005EC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

C:\Windows\system32\drivers\etc\hosts

MD5 03450e8ddb20859f242195450c19b8f1
SHA1 9698f8caf67c8853e14c8bf4933949f458c3044a
SHA256 1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b
SHA512 87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b

\??\pipe\LOCAL\crashpad_1744_RSESYMYPNXBYTTNR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 15fe0524a667c751669727762492367c
SHA1 5d8dee7a68f191f38ef34abec3273a116fb1a4e2
SHA256 d25d1d437ce46771fc1fd6b006563d32fbd7b146a24ef28122de01c0930bea65
SHA512 366520735000532d41500d98d0739176be4d134b7090e7044734ecf440f611fb7a6ba27be3d2b642bf9ec97b885f557d98a79e2391807fddcb6c7b8fae2ca7d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 98b5b9056a97c95d9b6f05f61c80012f
SHA1 ea130ec59b3eeedd8f83ba24c8e215440d819000
SHA256 1591368736481304ae80de78e7a69274748ee82b940b256aa0c89244f883c7cf
SHA512 d0c628b673f8628b1fa3ba44746df849e359475a4a2fdd5cfbc1eba09853e3e31afd38bc0315153fd563b2739c609e3a1b26bd8ad0b56d8b8f0e3276cac33b0f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6498290e37f4736ad3e52194d07ddf76
SHA1 ad682c55f447cb8ad82327841842d51b93374402
SHA256 3336658ec1cb9b8312c123b84c2fca341ddc06ab2601ce50e92ae4153a68e9f5
SHA512 a16916cac5c616cb7e15cfb3f8a4c2b4d7fef9bec564f00edd01e352097bca41b50cc11312ac57152e414b83162a88079df3843df2ba81afc08450b4fad5ec20