Malware Analysis Report

2025-08-10 12:31

Sample ID 240527-scprvshc94
Target 050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246
SHA256 050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246
Tags
discovery spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246

Threat Level: Likely malicious

The file 050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246 was found to be: Likely malicious.

Malicious Activity Summary

discovery spyware stealer

Drops file in Drivers directory

Reads user/profile data of web browsers

Checks computer location settings

Checks installed software on the system

Enumerates connected drives

Enumerates physical storage devices

Unsigned PE

Modifies Internet Explorer settings

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 14:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 14:59

Reported

2024-05-27 15:01

Platform

win7-20240221-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD927B71-1C39-11EF-9C59-EAAAC4CFEF2E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5091b8ab46b0da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dd70bf089e6822439c4e9c290ef0245300000000020000000000106600000001000020000000f3b03506ec855af7176cc83a133fa981e3e18e085929e362947edb507b2c4046000000000e8000000002000020000000ca17a5607d7753b701a69fc8ea410fa0543c6189098db036da87cab33a69b6159000000024fe2dd2bbd2a72db5461aaeaed7a7e62bebe2b77d4f495da0e64688f6304705e2f620b9911013a894e893c2f7c53518fb4e41e6e45b8919df0c7b5af053c5c8e56f91c52f45ccf5bd9ef05b7a7313919ff7f30febfed00267d0bdb5c1ab430a7ef263d467bb4b588aaf7c6dc2e33d20d1dddc706fd7327c9a4cd0265c5a018dd18128f26f70f009a364fd4a4c3f0a72400000001e6c20663b7fbeb03d4b815f8f78dcc5e7bd75b3a8197e439eac1bd3d70852fb33b16acfd649f73666bba95014c069e7f563567fac87acd7902a3fb695f0eb7d C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422983849" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dd70bf089e6822439c4e9c290ef024530000000002000000000010660000000100002000000030dd795a65b197a658228a62637141e2eecef7a703cf94e71c5d5165f21b2d8d000000000e8000000002000020000000938d4dc1e60510c34b474d4b8503ceea076e65e0840d7b52efd3875fe98d618520000000071d3017dd1729927395f6a70be0f37497715a7a0b809f4bb76813716f34b1194000000050909117e3237c087b15123aa1cb21759f32e086e77b8b6e04cd936ebd89ff7c37785059838a11c33a05f50b3ca9caefcd90b4c6dab6f418283dd0c78236cd13 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1100 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
PID 1100 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
PID 1100 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
PID 1100 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
PID 2176 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2176 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2176 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2176 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2396 wrote to memory of 2764 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2396 wrote to memory of 2764 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2396 wrote to memory of 2764 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2396 wrote to memory of 2764 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe

"C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe"

C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe

"C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe" Master

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/1100-0-0x0000000000310000-0x0000000000311000-memory.dmp

memory/2176-1-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1100-2-0x0000000000400000-0x000000000069F000-memory.dmp

memory/2176-5-0x0000000000400000-0x000000000069F000-memory.dmp

memory/2176-6-0x0000000000400000-0x000000000069F000-memory.dmp

memory/2176-7-0x0000000000400000-0x000000000069F000-memory.dmp

memory/2176-10-0x0000000000400000-0x000000000069F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabCD8F.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\TarCE61.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 24376eda6feb1a8c83c4109efefb552f
SHA1 add794651a20e8f012cc96db1c3ee2efd730faa5
SHA256 a16d25d5392a78820a40743e9e3515c5d2b9beb51dba4e11912521cca5fd03a5
SHA512 139cb80558399c301104f993dcb26866f43fb2863c6436a9190b08d67fa6d9ea9c0ff5db4721bd82a50edb061018c68aeead1e0ae3286f4a8b48e195ad40fed0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2dcc441c510bd37364d71df2e709dce7
SHA1 d6756e02e07ce17865a87f31b9dc80c3352ea45f
SHA256 1f888b456c411e36559d762d49ca0441185deb34acbb46d234df30452e9f15b9
SHA512 ce81dd66e0e5da3c30f1747d53e319ab6a391753f75533cd5c98b8a2462c108af65ee5c4c2f090330e1c4106b251073b9a30daf01ed7ce58eaa44e8eb589aef7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e45c2114c269e4dc03364d3dc0ce5aa2
SHA1 ff7cea894747148699c044438778fad9b98b7fed
SHA256 a9f3fdabf9326315169111e65789d7b49f3109ab4304f0aff688383929988b04
SHA512 d77bcd5ef72eba141972e761310cef50e293b23d52f6fa2c9bec77f8afaffcc98e9ed6449e6126df08f186d56f4fda584b360eb208218b684ac99c577dda708b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ff012caf65b99399ba1d4a5f0a20d7a
SHA1 1fbaff5ddfc3f1f0591de0f7476983a32f0acf5a
SHA256 4386e0a67577e7523ac2754d0739e6a522d7cfb7445d0d0c592d0960e374300a
SHA512 f9e40870bfa5fccc30c19aeb3746be320fd0fa244b0b79a3c743d6ee6b1b6258c288d4a463e41ad2898d3bc06f583e2811f0bee7024a38842d20598d9fdecc5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0566ca9838a102b0366e3b33ac89f9fa
SHA1 a12cfc81e752e9a6b18280adae5d1480ceeadd89
SHA256 2a91f44deb3e0e2cb20d11e7c0fcdcd745f35d1f171f1cd3222faa36b8563c4a
SHA512 4108668e9ea0da61daf0fba93a413dc6f93edfaba71cf997d2811d415db1f0134dbf21cec53aa90d9f31c5980880d0eb2435edca493c8e3b0f4a6df4e8263ff8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f6a27d0fee518eb823e6f6354b31150b
SHA1 518634e7fb02222dc0f09dccc6aacd6d675cbe58
SHA256 0c138b79d4ffc481fdbbc4ec56cb8715ad5f36e40280e6f7dfb1762d6384074e
SHA512 d638fc0d06ec361cf59e8efbf6825b3a5dda05eaf2449d4bfa93c6d53e8d6d685f1caff1231026082b31fe390f355eb726824b3bbd5baae06760fb5ad5c21305

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53b0387ef5df23f4d0c1e3f79cbe46e6
SHA1 83ef31b1a68e9ea66056b35a07d9a4edf68ac6d2
SHA256 cfc5ab3ab216025e21bf9f97c7bec642a14aa7b821e0405eb6d47ed1a9b0c6cf
SHA512 c07f5a34660ebb7dfc1cac47b7afc25c1011cc908be6374785ee4ba623399dc5f20641102d52a7bc7ff2b40debac8d795061183cda1a539156a3e8e277eb6e97

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c4f572da275fa73f5685d3f99ff56bea
SHA1 5a0d7fb7c9167911740881ae560d7424fe1e0af7
SHA256 6b1c5c9df9124b62813762de3219979b0184602c98f9c016cebfd1bdd4ade341
SHA512 b517b2adc9ab8f267b0493f19c972cdcbe802b80cf6ccc76972baff911028ea8fca8d48ca54f6f46dd49dfb1d7ce0be1a97db002dd18a3ab5fef78fc5a359214

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 74acd5ad1f35332f979fd9aae8e03230
SHA1 4ff25e43d5d5a0c9f2c1b056d234cb43a776b8d8
SHA256 5c31b798fa4bcd44f213d5b32187c98c917ed6747282887e02d596c04842360c
SHA512 a8c2396953bde23d5ab9de2186376c63cf717d7201e8567bf13d8ed80c077091aa2ad9eb8260f3d09d0cb3fb082cd65f3e6537d450c63e471575f2f3ff402e70

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a1d18b139cd0ec966aeb9d4c29471931
SHA1 ba88eed7f9c28f2e5472ccea92ee7b5a52b3aea2
SHA256 a03784f6837b871752f5535838576b736ad7257e57dffadcc94333afb98cb1d2
SHA512 206f8690f1878d1f74ac543e1816b2371aab97492b1c061f7c60da4aa56b86b48ddbc1583d5f9a4a14543708e8b82daebb23fc89351b68a5b2d84ea9e657b262

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2bfca42e97ed847f814cfe434067327e
SHA1 131145d71036789e5a9b4fa381076f66fddb22a6
SHA256 eabea7f2efec3f222fd541b6afece96769f26fb4fe3f334c403140d3d44b4149
SHA512 0375a1467cee0c836dc0e927a242bb0887be808fc2e1c850daa2beb88f7e0c2687dd300d60cef007ec3617c5ecde3307b8aae2b1225f1f381acbeb3813acab41

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96e5dcd82e8d329b2158a69647acf839
SHA1 6282454a73ff77168a84802cd2edff521738797d
SHA256 afe042e25e4169998d5c38beb75a608c32d4bf3c090c88a353c058ab874851a4
SHA512 e4e3395b05741d6d418cfb770ea947956330ac2d0394b2eb6f590e0564f607467274b08b663417ad098dbecd35852ea5786ae83d405974da1a3d66d16b13e5a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8d7ecd49c88cd1a88459b6b37d159a17
SHA1 91c960218785814368f278993750370709867c57
SHA256 eb6c6786631ef61a8fcda9b8e7997b0a46d03c4ee226015580c1c572d64e5764
SHA512 e988dbfc23b6e2111d077c9c75fcdf8fa8ca01b2d09b1d2ddab799efde3473266eebd4bffbef0881ef06583545a719a3b2866a4c495b0368718eaad0fc7df397

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5459da6fd15fada1559fc5e176be6cd9
SHA1 277f2c8726f1823eec1bfdb6068da3171ebd4cb3
SHA256 b59e9c4412d03845a03747350298d52360b029478e8d0131be6acd0c8a7a1aa2
SHA512 44c8113f68de8489ae3a972937f6d6bdc9e50842828f2ac6fe6048c92ebf8e6391ea895502e989211e825ecac5280f1dc87bd277c2060f193968a57661834ee3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 add71ed040b64a58345cb576412d90f4
SHA1 22524ec11532bb6d67535b6cb420de5d899fce99
SHA256 03b005bc65286813c135ec7cd1733f6612438f18f7b938bc5aaa0e92527bace4
SHA512 65811a7ec538c8d826ba67c1757c5b6fa94e916af18711e7a4d57d49500700ac463e6374f10ecb9d696454ccc76bc63571cf4f61955beaf1c4a696a16dc98b53

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8bbc0dae6eb03e3e3c697856597a72dc
SHA1 c8d18adc71c20e8ba3c7b79d3a975ea407216ff7
SHA256 0dcef4d7b4e84e4541ac42d1de98b6f47fd107a505259ef15a3dc46d58dd62a1
SHA512 58fc31592d1debc71c1b2c171324783eb87c1c23036301dca6f009ef3149086bccea589822796284d87c29f18fa2a86b34bbb32bcdd285998d440d2b546ac7f1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 01be9c8e6c5b408dda8bab828309bab0
SHA1 38a29e00b3d5193e558a639be54fe4a653acedc6
SHA256 5fc852d3fb4ebaf0162e3e8b4df93534a3b0ce89d2d3a16ab3b0e13e65338929
SHA512 f00f48821467aa39596c6a7ff48b9d27d70fb5364cfe10ac3036fa8d255b037aaf7b80ee46d91ce5a3c3c9a7c1116226b25898b73449606d643e38c4847c7612

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 416db7a09f3a8b2930821bbc80767135
SHA1 d5d20b08b25d83f9b96b1b998ee92fd0ac9181ed
SHA256 a59fdb527d104868cc358b54f85961ce81195cf860bfd1f8d4cd373b1be96c63
SHA512 b99ff65d33b3bd6f70592540001e23de4891b5decf0f84acba1b4dd8a89407a17d26dfe3f2e391cb616c3ac7ea1cfd2ca573fe86f25ee3e9de0d3f0df9cb4df6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 047061d29705ba1d427b099fe13009b3
SHA1 12752daca9a3ee94864cda0f5b77f4447a1eeec6
SHA256 a991865e44d75f67a1f0bd35b1c3aaa777e46c1e0ff739128912b931ef02c580
SHA512 31d21e7e8483868d01351a281824b878172f3591e88884ff75c82cac85e2e3c7302864e2fe435a2e2062688bcd0c841fa8aa8e2fb5b7064d7f41248b27551d8c

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 14:59

Reported

2024-05-27 15:01

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4092 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
PID 4092 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
PID 4092 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe
PID 996 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 2404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 2404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 4852 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 4852 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3444 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe

"C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe"

C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe

"C:\Users\Admin\AppData\Local\Temp\050a19f5f1c10b53f08e4422b0f6786f4aa8033affd07b76758152665e101246.exe" Master

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff677d46f8,0x7fff677d4708,0x7fff677d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6269742580619939383,7841050313340515262,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 arc.srv.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 41.173.79.40.in-addr.arpa udp

Files

memory/4092-0-0x0000000000870000-0x0000000000871000-memory.dmp

memory/996-2-0x0000000002480000-0x0000000002481000-memory.dmp

memory/4092-1-0x0000000000400000-0x000000000069F000-memory.dmp

memory/996-5-0x0000000000400000-0x000000000069F000-memory.dmp

memory/996-8-0x0000000000400000-0x000000000069F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_3444_QMZFFLUGAAGWUJMT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 419930c3e5877e8376c6edc55bf172f9
SHA1 a69b9bb8490cf0389cda8b52333c238acb68c5b7
SHA256 ab637930f331665e92aa694fba9e5d14571ea9152cb230bae2a1a27891589011
SHA512 c17b6a4b0b38f5ff5a5fd930435c913fb795cc0f9958e8ce7b3363e2442a8470d2498ba982a859f3a6e97c02bed6c265217aa0bb9901c5cf55d9d3f6f2c6167e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4c89c1fa8cc579ffeaf681129c5c973d
SHA1 beb7abd24ca3f1469b66593fb3294917dc30df6f
SHA256 9dce704ed0adc5763f48883c8a4cc5149f9e6191abd618109659c518e891a36a
SHA512 0ac31eb64a789dcee73f6e7b44001f0d9ad714717415a984070b9454c9e3fbdf1563e44e5cd548e4a3f86ce8c838a2ba61f664edff899a18bf562f0dd53a1211

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d96a65edc44883ae6c86627403242d79
SHA1 736698678db4de32654d28f1b685bdc97022ba8a
SHA256 a2548fe0f329a44fe43ba77cee38cf0ba13543d10b1759edee31d80be56d6bb6
SHA512 c6d5d767cb5d670d2a2abeb75df8f66c9ff79779530cf7a16bff5e7035323f7792e47bb544aa62157f294d9f408ee9c8504ed80a430d9ba84176434a2e6c8d99