Analysis Overview
SHA256
050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246
Threat Level: Likely malicious
The file 050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246 was found to be: Likely malicious.
Malicious Activity Summary
Drops file in Drivers directory
Reads user/profile data of web browsers
Checks computer location settings
Checks installed software on the system
Enumerates connected drives
Enumerates physical storage devices
Unsigned PE
Modifies Internet Explorer settings
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Enumerates system info in registry
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-27 14:59
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-27 14:59
Reported
2024-05-27 15:01
Platform
win7-20240221-en
Max time kernel
118s
Max time network
123s
Command Line
Signatures
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
Reads user/profile data of web browsers
Checks installed software on the system
Enumerates connected drives
Enumerates physical storage devices
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD927B71-1C39-11EF-9C59-EAAAC4CFEF2E} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5091b8ab46b0da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dd70bf089e6822439c4e9c290ef0245300000000020000000000106600000001000020000000f3b03506ec855af7176cc83a133fa981e3e18e085929e362947edb507b2c4046000000000e8000000002000020000000ca17a5607d7753b701a69fc8ea410fa0543c6189098db036da87cab33a69b6159000000024fe2dd2bbd2a72db5461aaeaed7a7e62bebe2b77d4f495da0e64688f6304705e2f620b9911013a894e893c2f7c53518fb4e41e6e45b8919df0c7b5af053c5c8e56f91c52f45ccf5bd9ef05b7a7313919ff7f30febfed00267d0bdb5c1ab430a7ef263d467bb4b588aaf7c6dc2e33d20d1dddc706fd7327c9a4cd0265c5a018dd18128f26f70f009a364fd4a4c3f0a72400000001e6c20663b7fbeb03d4b815f8f78dcc5e7bd75b3a8197e439eac1bd3d70852fb33b16acfd649f73666bba95014c069e7f563567fac87acd7902a3fb695f0eb7d | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422983849" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dd70bf089e6822439c4e9c290ef024530000000002000000000010660000000100002000000030dd795a65b197a658228a62637141e2eecef7a703cf94e71c5d5165f21b2d8d000000000e8000000002000020000000938d4dc1e60510c34b474d4b8503ceea076e65e0840d7b52efd3875fe98d618520000000071d3017dd1729927395f6a70be0f37497715a7a0b809f4bb76813716f34b1194000000050909117e3237c087b15123aa1cb21759f32e086e77b8b6e04cd936ebd89ff7c37785059838a11c33a05f50b3ca9caefcd90b4c6dab6f418283dd0c78236cd13 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
"C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe"
C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
"C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe" Master
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | info.178stu.com | udp |
| HK | 103.133.93.52:80 | info.178stu.com | tcp |
| US | 8.8.8.8:53 | www.178stu.com | udp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| US | 8.8.8.8:53 | www.178stu.com | udp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
memory/1100-0-0x0000000000310000-0x0000000000311000-memory.dmp
memory/2176-1-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1100-2-0x0000000000400000-0x000000000069F000-memory.dmp
memory/2176-5-0x0000000000400000-0x000000000069F000-memory.dmp
memory/2176-6-0x0000000000400000-0x000000000069F000-memory.dmp
memory/2176-7-0x0000000000400000-0x000000000069F000-memory.dmp
memory/2176-10-0x0000000000400000-0x000000000069F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CabCD8F.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Temp\TarCE61.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 24376eda6feb1a8c83c4109efefb552f |
| SHA1 | add794651a20e8f012cc96db1c3ee2efd730faa5 |
| SHA256 | a16d25d5392a78820a40743e9e3515c5d2b9beb51dba4e11912521cca5fd03a5 |
| SHA512 | 139cb80558399c301104f993dcb26866f43fb2863c6436a9190b08d67fa6d9ea9c0ff5db4721bd82a50edb061018c68aeead1e0ae3286f4a8b48e195ad40fed0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2dcc441c510bd37364d71df2e709dce7 |
| SHA1 | d6756e02e07ce17865a87f31b9dc80c3352ea45f |
| SHA256 | 1f888b456c411e36559d762d49ca0441185deb34acbb46d234df30452e9f15b9 |
| SHA512 | ce81dd66e0e5da3c30f1747d53e319ab6a391753f75533cd5c98b8a2462c108af65ee5c4c2f090330e1c4106b251073b9a30daf01ed7ce58eaa44e8eb589aef7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e45c2114c269e4dc03364d3dc0ce5aa2 |
| SHA1 | ff7cea894747148699c044438778fad9b98b7fed |
| SHA256 | a9f3fdabf9326315169111e65789d7b49f3109ab4304f0aff688383929988b04 |
| SHA512 | d77bcd5ef72eba141972e761310cef50e293b23d52f6fa2c9bec77f8afaffcc98e9ed6449e6126df08f186d56f4fda584b360eb208218b684ac99c577dda708b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0ff012caf65b99399ba1d4a5f0a20d7a |
| SHA1 | 1fbaff5ddfc3f1f0591de0f7476983a32f0acf5a |
| SHA256 | 4386e0a67577e7523ac2754d0739e6a522d7cfb7445d0d0c592d0960e374300a |
| SHA512 | f9e40870bfa5fccc30c19aeb3746be320fd0fa244b0b79a3c743d6ee6b1b6258c288d4a463e41ad2898d3bc06f583e2811f0bee7024a38842d20598d9fdecc5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0566ca9838a102b0366e3b33ac89f9fa |
| SHA1 | a12cfc81e752e9a6b18280adae5d1480ceeadd89 |
| SHA256 | 2a91f44deb3e0e2cb20d11e7c0fcdcd745f35d1f171f1cd3222faa36b8563c4a |
| SHA512 | 4108668e9ea0da61daf0fba93a413dc6f93edfaba71cf997d2811d415db1f0134dbf21cec53aa90d9f31c5980880d0eb2435edca493c8e3b0f4a6df4e8263ff8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f6a27d0fee518eb823e6f6354b31150b |
| SHA1 | 518634e7fb02222dc0f09dccc6aacd6d675cbe58 |
| SHA256 | 0c138b79d4ffc481fdbbc4ec56cb8715ad5f36e40280e6f7dfb1762d6384074e |
| SHA512 | d638fc0d06ec361cf59e8efbf6825b3a5dda05eaf2449d4bfa93c6d53e8d6d685f1caff1231026082b31fe390f355eb726824b3bbd5baae06760fb5ad5c21305 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 53b0387ef5df23f4d0c1e3f79cbe46e6 |
| SHA1 | 83ef31b1a68e9ea66056b35a07d9a4edf68ac6d2 |
| SHA256 | cfc5ab3ab216025e21bf9f97c7bec642a14aa7b821e0405eb6d47ed1a9b0c6cf |
| SHA512 | c07f5a34660ebb7dfc1cac47b7afc25c1011cc908be6374785ee4ba623399dc5f20641102d52a7bc7ff2b40debac8d795061183cda1a539156a3e8e277eb6e97 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c4f572da275fa73f5685d3f99ff56bea |
| SHA1 | 5a0d7fb7c9167911740881ae560d7424fe1e0af7 |
| SHA256 | 6b1c5c9df9124b62813762de3219979b0184602c98f9c016cebfd1bdd4ade341 |
| SHA512 | b517b2adc9ab8f267b0493f19c972cdcbe802b80cf6ccc76972baff911028ea8fca8d48ca54f6f46dd49dfb1d7ce0be1a97db002dd18a3ab5fef78fc5a359214 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 74acd5ad1f35332f979fd9aae8e03230 |
| SHA1 | 4ff25e43d5d5a0c9f2c1b056d234cb43a776b8d8 |
| SHA256 | 5c31b798fa4bcd44f213d5b32187c98c917ed6747282887e02d596c04842360c |
| SHA512 | a8c2396953bde23d5ab9de2186376c63cf717d7201e8567bf13d8ed80c077091aa2ad9eb8260f3d09d0cb3fb082cd65f3e6537d450c63e471575f2f3ff402e70 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a1d18b139cd0ec966aeb9d4c29471931 |
| SHA1 | ba88eed7f9c28f2e5472ccea92ee7b5a52b3aea2 |
| SHA256 | a03784f6837b871752f5535838576b736ad7257e57dffadcc94333afb98cb1d2 |
| SHA512 | 206f8690f1878d1f74ac543e1816b2371aab97492b1c061f7c60da4aa56b86b48ddbc1583d5f9a4a14543708e8b82daebb23fc89351b68a5b2d84ea9e657b262 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2bfca42e97ed847f814cfe434067327e |
| SHA1 | 131145d71036789e5a9b4fa381076f66fddb22a6 |
| SHA256 | eabea7f2efec3f222fd541b6afece96769f26fb4fe3f334c403140d3d44b4149 |
| SHA512 | 0375a1467cee0c836dc0e927a242bb0887be808fc2e1c850daa2beb88f7e0c2687dd300d60cef007ec3617c5ecde3307b8aae2b1225f1f381acbeb3813acab41 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 96e5dcd82e8d329b2158a69647acf839 |
| SHA1 | 6282454a73ff77168a84802cd2edff521738797d |
| SHA256 | afe042e25e4169998d5c38beb75a608c32d4bf3c090c88a353c058ab874851a4 |
| SHA512 | e4e3395b05741d6d418cfb770ea947956330ac2d0394b2eb6f590e0564f607467274b08b663417ad098dbecd35852ea5786ae83d405974da1a3d66d16b13e5a7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8d7ecd49c88cd1a88459b6b37d159a17 |
| SHA1 | 91c960218785814368f278993750370709867c57 |
| SHA256 | eb6c6786631ef61a8fcda9b8e7997b0a46d03c4ee226015580c1c572d64e5764 |
| SHA512 | e988dbfc23b6e2111d077c9c75fcdf8fa8ca01b2d09b1d2ddab799efde3473266eebd4bffbef0881ef06583545a719a3b2866a4c495b0368718eaad0fc7df397 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5459da6fd15fada1559fc5e176be6cd9 |
| SHA1 | 277f2c8726f1823eec1bfdb6068da3171ebd4cb3 |
| SHA256 | b59e9c4412d03845a03747350298d52360b029478e8d0131be6acd0c8a7a1aa2 |
| SHA512 | 44c8113f68de8489ae3a972937f6d6bdc9e50842828f2ac6fe6048c92ebf8e6391ea895502e989211e825ecac5280f1dc87bd277c2060f193968a57661834ee3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | add71ed040b64a58345cb576412d90f4 |
| SHA1 | 22524ec11532bb6d67535b6cb420de5d899fce99 |
| SHA256 | 03b005bc65286813c135ec7cd1733f6612438f18f7b938bc5aaa0e92527bace4 |
| SHA512 | 65811a7ec538c8d826ba67c1757c5b6fa94e916af18711e7a4d57d49500700ac463e6374f10ecb9d696454ccc76bc63571cf4f61955beaf1c4a696a16dc98b53 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8bbc0dae6eb03e3e3c697856597a72dc |
| SHA1 | c8d18adc71c20e8ba3c7b79d3a975ea407216ff7 |
| SHA256 | 0dcef4d7b4e84e4541ac42d1de98b6f47fd107a505259ef15a3dc46d58dd62a1 |
| SHA512 | 58fc31592d1debc71c1b2c171324783eb87c1c23036301dca6f009ef3149086bccea589822796284d87c29f18fa2a86b34bbb32bcdd285998d440d2b546ac7f1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 01be9c8e6c5b408dda8bab828309bab0 |
| SHA1 | 38a29e00b3d5193e558a639be54fe4a653acedc6 |
| SHA256 | 5fc852d3fb4ebaf0162e3e8b4df93534a3b0ce89d2d3a16ab3b0e13e65338929 |
| SHA512 | f00f48821467aa39596c6a7ff48b9d27d70fb5364cfe10ac3036fa8d255b037aaf7b80ee46d91ce5a3c3c9a7c1116226b25898b73449606d643e38c4847c7612 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 416db7a09f3a8b2930821bbc80767135 |
| SHA1 | d5d20b08b25d83f9b96b1b998ee92fd0ac9181ed |
| SHA256 | a59fdb527d104868cc358b54f85961ce81195cf860bfd1f8d4cd373b1be96c63 |
| SHA512 | b99ff65d33b3bd6f70592540001e23de4891b5decf0f84acba1b4dd8a89407a17d26dfe3f2e391cb616c3ac7ea1cfd2ca573fe86f25ee3e9de0d3f0df9cb4df6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 047061d29705ba1d427b099fe13009b3 |
| SHA1 | 12752daca9a3ee94864cda0f5b77f4447a1eeec6 |
| SHA256 | a991865e44d75f67a1f0bd35b1c3aaa777e46c1e0ff739128912b931ef02c580 |
| SHA512 | 31d21e7e8483868d01351a281824b878172f3591e88884ff75c82cac85e2e3c7302864e2fe435a2e2062688bcd0c841fa8aa8e2fb5b7064d7f41248b27551d8c |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-27 14:59
Reported
2024-05-27 15:01
Platform
win10v2004-20240508-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
Reads user/profile data of web browsers
Checks installed software on the system
Enumerates connected drives
Enumerates physical storage devices
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
"C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe"
C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
"C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe" Master
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff677d46f8,0x7fff677d4708,0x7fff677d4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | info.178stu.com | udp |
| HK | 103.133.93.52:80 | info.178stu.com | tcp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.178stu.com | udp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| US | 8.8.8.8:53 | nav.smartscreen.msiserver.lan | udp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | arc.srv.lan | udp |
| US | 8.8.8.8:53 | edge.msiserver.lan | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ntp.srv.lan | udp |
| US | 8.8.8.8:53 | nav.smartscreen.msiserver.lan | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| US | 8.8.8.8:53 | nav.smartscreen.msiserver.lan | udp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| US | 8.8.8.8:53 | nav.smartscreen.msiserver.lan | udp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| US | 8.8.8.8:53 | 25.24.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | edge.msiserver.lan | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| US | 8.8.8.8:53 | nav.smartscreen.msiserver.lan | udp |
| HK | 103.133.93.52:80 | www.178stu.com | tcp |
| US | 8.8.8.8:53 | 41.173.79.40.in-addr.arpa | udp |
Files
memory/4092-0-0x0000000000870000-0x0000000000871000-memory.dmp
memory/996-2-0x0000000002480000-0x0000000002481000-memory.dmp
memory/4092-1-0x0000000000400000-0x000000000069F000-memory.dmp
memory/996-5-0x0000000000400000-0x000000000069F000-memory.dmp
memory/996-8-0x0000000000400000-0x000000000069F000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 439b5e04ca18c7fb02cf406e6eb24167 |
| SHA1 | e0c5bb6216903934726e3570b7d63295b9d28987 |
| SHA256 | 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654 |
| SHA512 | d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2 |
\??\pipe\LOCAL\crashpad_3444_QMZFFLUGAAGWUJMT
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | a8e767fd33edd97d306efb6905f93252 |
| SHA1 | a6f80ace2b57599f64b0ae3c7381f34e9456f9d3 |
| SHA256 | c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb |
| SHA512 | 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 419930c3e5877e8376c6edc55bf172f9 |
| SHA1 | a69b9bb8490cf0389cda8b52333c238acb68c5b7 |
| SHA256 | ab637930f331665e92aa694fba9e5d14571ea9152cb230bae2a1a27891589011 |
| SHA512 | c17b6a4b0b38f5ff5a5fd930435c913fb795cc0f9958e8ce7b3363e2442a8470d2498ba982a859f3a6e97c02bed6c265217aa0bb9901c5cf55d9d3f6f2c6167e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 4c89c1fa8cc579ffeaf681129c5c973d |
| SHA1 | beb7abd24ca3f1469b66593fb3294917dc30df6f |
| SHA256 | 9dce704ed0adc5763f48883c8a4cc5149f9e6191abd618109659c518e891a36a |
| SHA512 | 0ac31eb64a789dcee73f6e7b44001f0d9ad714717415a984070b9454c9e3fbdf1563e44e5cd548e4a3f86ce8c838a2ba61f664edff899a18bf562f0dd53a1211 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | d96a65edc44883ae6c86627403242d79 |
| SHA1 | 736698678db4de32654d28f1b685bdc97022ba8a |
| SHA256 | a2548fe0f329a44fe43ba77cee38cf0ba13543d10b1759edee31d80be56d6bb6 |
| SHA512 | c6d5d767cb5d670d2a2abeb75df8f66c9ff79779530cf7a16bff5e7035323f7792e47bb544aa62157f294d9f408ee9c8504ed80a430d9ba84176434a2e6c8d99 |