Malware Analysis Report

2024-09-23 03:59

Sample ID 240601-bwt29ach9z
Target fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e
SHA256 fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e
Tags
metasploit backdoor discovery spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e

Threat Level: Known bad

The file fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor discovery spyware stealer trojan

MetaSploit

Drops file in Drivers directory

Reads user/profile data of web browsers

Checks computer location settings

Enumerates connected drives

Checks installed software on the system

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-01 01:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 01:30

Reported

2024-06-01 01:32

Platform

win7-20240221-en

Max time kernel

118s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0059dd70c3b3da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005938183fdb3b334f8d6c1003c6bc32d90000000002000000000010660000000100002000000090913276cc5839c114bc2fc8ea508e6bb710494092753dc18545c7ca35bb6f40000000000e8000000002000020000000975969e2646d8699e3de5a04cdfb9d3cb033a01c50a2e8f3592cc7b4d309d96690000000236520d504b4d42c747d5679287f08d7175802ecfb342c2143904791b151911fd8311868ecee2be0864362d87e80b13152171439bef262ae9e88f1a21b43f72eac0f789e9ee8c6a4f80261a31d17b503cd0c78e39f15ac83bd92d30d704ad8db8dde3f6ee6efed25663c7a2ecccfedba21654d7406bc5d61fef124a8c5a05ffe85fee7c63d8f7f769791414a83d05378400000007035a14ccf3391a7f4afbeffac98670ef922050b713e79ef2dda33a46841bcae486746ae6cb421fbbda3fc77a083d4bd4dc05f38005817b21609101ddbdb0148 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8330B8E1-1FB6-11EF-9371-CAFA5A0A62FD} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005938183fdb3b334f8d6c1003c6bc32d900000000020000000000106600000001000020000000988ca21e229f5e4dd13850489b5a427ef6173370f54c32ab8c6a43b2443694fa000000000e8000000002000020000000ecb19ba5257040879f1a03c76dd0b71c532b81e471d5b2ec478304d2306aa99c20000000a950183f7dab5b40e4149f790889023ed311adcbfdccfc558b282b54a188a2a14000000069f0044fcdd2cece1cb6809ebcf987ce1e3453d521d142d580a3d853b7bad5627c716e095fb4dc8bbd5afd901a35e70d140a2256705334c7b81a12ec2c3eaa7a C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423367294" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2088 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe
PID 2088 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe
PID 2088 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe
PID 2088 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe
PID 3048 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3048 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3048 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3048 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2592 wrote to memory of 2448 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2592 wrote to memory of 2448 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2592 wrote to memory of 2448 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2592 wrote to memory of 2448 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe

"C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe"

C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe

"C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe" Admin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
CN 1.15.12.73:4567 tcp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2088-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2088-2-0x0000000000250000-0x0000000000251000-memory.dmp

memory/2088-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2088-4-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/3048-6-0x0000000000280000-0x0000000000281000-memory.dmp

memory/3048-9-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/3048-11-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab37C.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Cab84F.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar864.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51aa27cb23425f0a6ba0754bfca34f32
SHA1 2ac1143f7c0cd6478ef4d575aa936ff8eb9bd1db
SHA256 6ec058b8855e260ded57318bc2c617ea1a9368ee7825883c4a21b8c5c17a0401
SHA512 16889850079ca8c34fcd92dfa3084245fbdb1a81c5fe565959ad2dc6a34616c595692c2e7ed21bc49bc4301e9bf074ec481fd7ee49b5df483a73bca3437b3597

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15a397df4a70c245e2d5c71f174cf2b5
SHA1 786acbb3a05dc0d7a89386e7cf70d29d30c9d939
SHA256 64c1bd771cd3ab9d1b053ac2f4564f3e4289b62562a223bd529eebc3bb374519
SHA512 b24e8b2429bf9f2d872a6dd10a92897634cc627e5536e6272307083535052808ff09f3cd8b9db68232086fa1cd42b114546f003e0a5ddc97903d5bf91d497813

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53fa7e128ac1b8bfa9533b2ad2cc9168
SHA1 6017714f32e3fc48b84ba6c6dc75503634fa2780
SHA256 0d058e8c6f32ec2d6332b6bfe446a4ff787d7d0c0533f04b3d70331d822c4a09
SHA512 51e148760a08c7be7ac823a09e0bca42a0a4a605f573b99ac05a67ed7529a1d3ad153aeb4166afc73e23961c685a7e18462f9d03ef57a4ea3b84b0cde0fb984b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96c6c5d9d23a805701a98907e39e7a12
SHA1 6a641daf4b4ce19bb7f8fd227d80b3f38f3edb8e
SHA256 b3ab12490e8c89f3012f8f1a2f62eca2f8c74e122ae1e6e580d4bca633fc5328
SHA512 861321e8b5bab52b91c89d954cccbee9c67df9eaaec0bbc914c3f1cd89e3793067e6a7688c91cf42ef40fb5ec78962e57bded1d6e8d3e3666965c4b192a23cea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 afd0a5edecdbe1456206456ebce68a53
SHA1 f1afc00b8026477741581e00aae745d3abe4e3dd
SHA256 e0e34c783e54248152cf2ec1e11ec3f8bd426f3aec8228e594c0d83843bfc31a
SHA512 d1a79ce71a91f1103971c8c1affad487fa8b83498ddde198073cedf8ed0b7865d884c736adc089a629dcfc0bde044f8b263c1877584f32a007d5413c6a756ba4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 723dac8c75f08536207c11896052ceb5
SHA1 01fe295b895578c4ca5261c5ba89d37f3199f105
SHA256 8be4b70e96b0d9df134d74151c62258f393aefe5e8873e9558301ebbb4a39023
SHA512 1c174ebe650770b30f41b3907394b493dc40151bc66b6c95710158b7b660f670bd1080a2599fb3d86c9ad729d806198537bd8b6a5b7581aa27f112e7239cbb35

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a8494663e65fda4d0676d4ef2f97db5
SHA1 724fe3761eb65b286644864e9575344640c225c3
SHA256 db99502027f72cd51c9500eca3019015286868c638b6152a0eda4c46444fda44
SHA512 a9e207da81f82c1cf432a5303b374f081d86150dbb0900102a00000b7d6bf1cb8b5096c687f320ab91aa4e07b9926339d0186f9b71e090e257adcf45b5611d91

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dfbab3c6524c41aa356883a840929c2b
SHA1 4bda1d9af782fe59b4f41f370e933a8b59721996
SHA256 9bfe733eb687869eb578651cd1b25bf2a45cb94a48139cee1042d9987a431bec
SHA512 b60beb3390b79a0b4c75239d800013778820fedae12ea7b50bee97a9b49a7b97c75af89a314b9c0aac0d048c2fe326e648d946c556ef077852a4bf7ad2da52d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eb116c817ea95b08fb98e4c4ddbfb5c9
SHA1 65d8b2f0d0951c09eabfbaa3184f9cb35980f114
SHA256 c811c8ece23d2b5fe45504ff54fd8e4a7ad52774f7f79a653608202b8c3fffd7
SHA512 43690af678d06de7c6b5e3bc4ae1e12d9e0c4fd2bdef726a26107ab5be36447ae6fe4534d153f91cb02d42a366eeff136b8b7412cbe659ba37e66e5c30f1e7a3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fe546615a22082af5a3dd5e8f35cecd7
SHA1 02e8172ad3d46d9ff2762ffe7ac547e635c21031
SHA256 5cfe8a394df909d5b6745a2e2717c7efce6ba25c96bb4afac3a1195dd6645442
SHA512 983b69ef621e3dee0d7cd3ced5c8c5d6cdaa826d6006602a8bb84c3243053363d1055e6040631e02ed06a00c4cb026e87bbc0bf0ef5dc811628fdc2616dfe2d7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 328700724ada4e6c574f1f9122af5ba9
SHA1 6c2181726e44d5f80ca09bcca4209b1342b794af
SHA256 dc37e879f9d2d26e1ed93700fa256ef0d0ef6d5434b6e5eca571f79e226dca02
SHA512 3db1c2fffe4fc239b88011bac90473cd9d38382c6e0dc7daa5cb1175e68ae24ff350003186eb9cf81384b35735a6037999364d540ccebcfaab09d144e830c8cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1316b07db8ce6194fa458f6acceb9606
SHA1 fb4c83ebfb642519a41762815437c64c51b1bc09
SHA256 b8af91f62524b15f9ad3efdd2dd868d27b27a144c247dbe46bd562d713e62ec3
SHA512 1b5257d6abbbce83676924722ffab7a67bdeb56483fb5f26e38821c5f6bc0f16bb6af338525b8f7212204ca564f90ffe9035c2856ced77fd7f7d630be6d07845

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 835d7158c5ab33f35f32c9d76ee70c18
SHA1 d9f1393a904d2ea519aa099326bd3a73532ecad3
SHA256 dc37036dcc5a3be1cc1a8f347ffebbbb040617e356cd544c254853bfe7bd5aed
SHA512 6a5e1538ed1752dbd8cb7fbeb90c866df939a300e7eb77b0f056112b9b6a584e7fed6906b09912b8f7b9c84c706d65062ad227f468dde03405cc730f8418137e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 70cc20381eec4a157cb082e038d435b5
SHA1 464eece93066d11968653282672629fd6fb18847
SHA256 08e23b26e478ce0afa4e0ed8ad11b07cf22bcc53f50159951ec710584909ca55
SHA512 d427181e31e5491d54f20ece0866e502b00364d6eff0f4bcc4a7c5a98efd460f7330d5b561138c07f56d306c015debc976a1fec600fccdd27637e1ff03b3dd88

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 52b8505e632569e1a230085c14bf12c0
SHA1 8514fd7e8da85699fc77323f63750b9a6dcf83ee
SHA256 e06c3bc0183ad07b592aaf046eff3ff96a02a1873333a4aa784c444625536db3
SHA512 1a7cdc238c0a088e7fa2e41650b355dc00159a7b6900f8203e20bf99564cfa44e876bc6cbecd2f1eff7c07621df790166753aa2b27cb51a93160ebe7bb497738

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e628db881603567d6b351bb53eb97d8
SHA1 19840be4cddffb61624c30f8055cb68d9d7d5f8e
SHA256 55be314bef57774bc8b60b8c54152a4c4095e98321abe128b3bb9c12f7dcc2e6
SHA512 e404c8ec91c2c6f6500d07614a19a7fba1010dc126a5e2f4099f79dfb38afdbcf807acfe8e7d405e74079d95fed008b315d9a9266fa3c7206c4dddcae0d8e4c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 523950147f4928d8d01ff2bbc317d863
SHA1 168ab762bdb248eca58a55207d3888d5efc8b40a
SHA256 c89169c22c44968a97f8bd1434bf69c590f1b5d614c9ae4ea3e4b5e0eafac7cd
SHA512 459428dd957225a5ab055ada8e9d1b0fbc5eb450a462e9c9ff23b0d84f54ba439a4e4c9ead383e1b318cc0b6461db95823fe540e14297bba89c42e15931b39f6

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 01:30

Reported

2024-06-01 01:32

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4520 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe
PID 4520 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe
PID 4520 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe
PID 736 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 736 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4988 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 3924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 3924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3468 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe

"C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe"

C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe

"C:\Users\Admin\AppData\Local\Temp\fb036674164211701ccf5c7d3668d3e7378d16b1238d0cc8876977b52c83db2e.exe" Admin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85a0d46f8,0x7ff85a0d4708,0x7ff85a0d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,17641003162014346070,9547057496294306487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5944 /prefetch:2

Network

Country Destination Domain Proto
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 arc.srv.lan udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 174.117.168.52.in-addr.arpa udp

Files

memory/4520-0-0x0000000002330000-0x0000000002331000-memory.dmp

memory/4520-1-0x0000000002330000-0x0000000002331000-memory.dmp

memory/4520-2-0x0000000002670000-0x0000000002671000-memory.dmp

memory/4520-4-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/736-6-0x0000000000900000-0x0000000000901000-memory.dmp

memory/736-9-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/736-10-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/736-12-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

C:\Windows\system32\drivers\etc\hosts

MD5 03450e8ddb20859f242195450c19b8f1
SHA1 9698f8caf67c8853e14c8bf4933949f458c3044a
SHA256 1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b
SHA512 87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b

\??\pipe\LOCAL\crashpad_3468_ZOSLHICOMLAGVYFT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 72019462ae3444defb3b502d051fc42b
SHA1 ba0bcb2890708ef81c07f70a508a8853dc4fd1f7
SHA256 2683bac61e00953801967bda51eb67359bd2c6841d6119047b36790ad77ff564
SHA512 1f3febe386a1cd509a84b5c6791c125f07a1e45d130ffecff0a65e214e179f6bf168fdbd45b36d3a63b85864ddaddde337e2f631473a2e30f88ea9c9a7336532

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a3fa6e742f9cdf701cf7c5b2c7598e77
SHA1 458f79437ea8d69f77a4dc3f2e357d96cfad9823
SHA256 e6fa2e64e90d0b15c19ae94486d9904ff1528e0d414238225c9129de1f4cec0a
SHA512 f8c829b3b1e5695c4d7cf9ee8d55bfdc9738826ac60b1e0ef0184c76fb37670cc905ed1d2879061a4c1dfa7e9b88b4ba718691cfe09912ae913ff54e1ebb7fa9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 80faa4a2ce9b85cb42d37f6067928658
SHA1 ae28927f3511e45e017aa9b76346263649c44057
SHA256 ad14580b128fb66e8092cf8ba6d0cbb4ba0265b7883e8226b4530fde226fb540
SHA512 6b0356b11d83b692eda6c14f907264ef1b6afcd1c746b44783c2f81d2daa8f78b6eb5d4d438b78ae6625a73b2b273872c9f4b610a5446f1ad0615d9950bad5f0