Malware Analysis Report

2024-10-19 08:23

Sample ID 240613-xbfj1sxgnc
Target .
SHA256 26ad319d3b36bb071a81f3aee4c2bfb987cbe574f596a5f6008862ed305399e9
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

26ad319d3b36bb071a81f3aee4c2bfb987cbe574f596a5f6008862ed305399e9

Threat Level: No (potentially) malicious behavior was detected

The file . was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 18:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 18:40

Reported

2024-06-13 18:43

Platform

win7-20240611-en

Max time kernel

118s

Max time network

127s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000095e71be8165c7cd7cd19fe1c2b66481d0b4200cb27ed0e055efad3078c4cfdbb000000000e80000000020000200000000dad64a8be57ca220499edbd57b3a71b2faa41d770f5ab9de5a034de06194b9290000000a1292eb573e1e943ac4f15a3dbca408c40c2c2ea62249226cf25f5f103b42af8a4cd7f48edb99da17294a6568a2953ae45a0959e1f97fa5a38947d3359e45e507a98f65c842f26a91b04c8f9d6acc5cebbcfec38241e0fcaa47c8824f505eaf96f725265be04482d2a9508bb31d40e586b128bd9aeffeb1d758eef0dec10da5a6c6010495c0ad0eea7edbc359b950071400000000d16d41155917584d75cc4e41b6c3b93d9225366ae7f6023ef89b6d87df622549ff36c62c22217f4a0af747e332f6b20fb5656f7dcf73c24af3b32c23654b761 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424465901" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B50CBE1-29B4-11EF-B9DB-4A2B752F9250} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000d633a20cbc02e7c0b1b235ccf81ee1d87ac9ccc1a07117a0277603a00a795f0c000000000e80000000020000200000007cdb85a05cfee28bae9a19847688f20a6a4ac5b6b6c495bde5fa9d1de3f25aa9200000005d3ad94a02fae0aa0de50fedb9fa297c87ddc98301336cafa4af32a980481c094000000007694fea9b574afd9530e49d9ba33f372a8c5e348dc527bc0a987bae9837bdda05512beda8e291c94f67e40683bb2404f9467c8bf54b06d586e5aef526118a52 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e3aa40c1bdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:472078 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 store.steampowered.com udp
SE 23.34.233.45:443 store.steampowered.com tcp
SE 23.34.233.45:443 store.steampowered.com tcp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 cdn.akamai.steamstatic.com udp
US 8.8.8.8:53 shared.akamai.steamstatic.com udp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.162:443 cdn.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.169:443 shared.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
BE 2.17.107.138:443 store.akamai.steamstatic.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 22cd2dbec665f8a774d4ddf96a197cf4
SHA1 b4455411a67bb4fc0f66d9995b46da43a6f111c4
SHA256 f076ff78d9bf12efa1a338ea0ea6f4501dd73c37974c5178824ab4dfdc1e8f08
SHA512 e7c00e4f5dffba08dbc079e0a79c5a362fdf1d450da4fa9d7c3147267f770365332a3c6d39f89c4c51065db5de656b3f04efd0280983a8545c1da158614e77f0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f8aa1a291d20db704aff8dcc99c0782f
SHA1 52ce8f8661c98ed78ce5e778da3ee0a6063eee0d
SHA256 67e07cd7b225a0c1e39e6977f6c9605db430dc8bc953f619b8e6576c0bbc7d0e
SHA512 ad9c5756b501c2ab332eed9f82a3d8ab1efa36c1163bf875a249071ebc3ca12866c470396b42510f73a86117d56e074bdb4e82e55d8ce14f7028168a5a350cc1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6d8b2c574fe75d510f17bfbc962ca29a
SHA1 c2c4c8f37b52e1a586d323f0278070d5c8c5ecfa
SHA256 473f3e4e34e07a73478ece9d7172b85fe2742eeeb50055d27021511fbd5f7176
SHA512 53a9ae0fe0ed54922813f16d0d9d0472aa12c82f49a7adfd2ee5198d092a0a5129d32a292fbeb2c473d3dbbcca3694c54cdbcf770d0f1e78d99d095d4cf72ecc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 94a0bfc64dee2b9b24303f70f92aa473
SHA1 df3498d38152c2c7ad7ae690158318b4b87f6f03
SHA256 b97a607d11220ce0cc976b86b2035473ff26ae49c01c36afa20f83989de10a2f
SHA512 20046d463596a17a7c5b37a5ccb0db9c11b9ee27322d7852f1298252d32a93eae3396d60e89a20b4b00750231812626030d1fa31509b15e26aad182490dcdbac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 32a3e6b6590bdc19c4f24c6eb1af1fea
SHA1 9d19601c4cf7f3913f23462f01a45c780e20eb3c
SHA256 0b874201ea1335487b6e2037748e8c6adde6826bf564cc2ba7304c4dd53105b0
SHA512 3636b532a33bebfcd21c549a5dd69fe4654a69d0f8be29640cccde3bc4ee082de1f8382e0b27ed76a3b1bda2a319d6ea791d5cbdbd51264423bd7f21232b04c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac979267694c47cfa59ac59d7a63c1c0
SHA1 e3a59a2fcbbcb0bef77336ff901ff5f1b306da46
SHA256 b05b8772edf598704f1e7c52cf2f6ea0cac62b782856d813874d03ec9f3e048a
SHA512 443833338e53380c9452fb830d43be8c0f2b89c4536880caf89587fa4bc7a862e763d18216c717e49bc89be11483795c55f7c585f3bcd09dac68b33b00dae725

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ffe9777277ce31defa7f84ac307f5c30
SHA1 df1c549ece1a782e7695645417085e882c91bcdf
SHA256 3f79f97d0d565ff96bb40408f9f03d541776cda6f729d059873f365a724231dc
SHA512 4ac4fca82b02ec0d019decb5f5b0b73912bc620c6dc0e5bf30a17aba19cec578bcf3fcac4258d908cc00e6e16417abdeac195f4c4180782b59242fcee1b95292

C:\Users\Admin\AppData\Local\Temp\Cab1057.tmp

MD5 2d3dcf90f6c99f47e7593ea250c9e749
SHA1 51be82be4a272669983313565b4940d4b1385237
SHA256 8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA512 9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47

MD5 48258a41069ca160e71fa1cb36013865
SHA1 1570e36e7561a9bae11aba5ead190f5a44a34b2e
SHA256 5ad2e7f0c6a1bb5186cb1de65b82d3437ac1f1d50ce3963d537753cb774ac116
SHA512 20af8bc2760742e3f1b2516a23b4cc507a9c396e4210d3cbb53dded27c91b07710d57ed87e332b9ff12f02686c5a131923dd88f4e0f499330faafff334709198

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47

MD5 31c72108356bcbb5569409aa463923e3
SHA1 647712555d187d6763bdafc3e9c2ee9645bae56a
SHA256 16c8fd04d2e7f175e0092f4e468aaa9b762e79720e99683c787e4ed130404cdb
SHA512 4768ecbf85c6c15bad385b1c5b6937e4243aa4bdd0163ef49bf219047b6d9920a535a860cb29cc02dd5a427f170ff43d4e6e7fb5b3505233d24d671e84205e60

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47

MD5 e66a20645f8d4556a458e2b03f5d590c
SHA1 93066f77d40e5ae7b9144ccc3b2d2b597d7a855a
SHA256 bd1423d622d7af9abc6d11f95e19be80908fc64aed23a0b65f17898a571f7404
SHA512 efbcb38e463061908bde863b723a1814cfdccfc774262cc15fa838cb69ed72b8e2c5b2c4f51ff51dc28d3cdde1c12aadf0d077dc7367d306a2cf1e53586faa6f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b6947ea82d30c8d90e972eca70082b2d
SHA1 9cc61cc147962fa9c2db9c6651951b00cfe7ae00
SHA256 0b0dae4e690070493e1059b60d2d6aa82b9382e4e99c5c65764efa5b7551ad25
SHA512 785ebbac19b5a66d1aea374328221cbc6d427104649245b51c46bab64dcfe7b6ffd480b7b12db86d253d08d2103bcc87a4262eef513f7de4e44d1ec36c167c8b

C:\Users\Admin\AppData\Local\Temp\Tar29E4.tmp

MD5 7186ad693b8ad9444401bd9bcd2217c2
SHA1 5c28ca10a650f6026b0df4737078fa4197f3bac1
SHA256 9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512 135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b927d3c651838177228c4751c9b5bd1f
SHA1 9f56a2be819f74301632ac1aff657a4cf969385e
SHA256 a8613f493ac7de9c67c957b869042f2573b6dec047e1678eae507e333158f4ca
SHA512 56b9070a6a021121ed5ca4a8298eb2a2ca74c82370471ab07a5aac5c9ca05b35a19c80b6a90c0904b0a8be8322955e125447c2d7b3567e102dcacbb9b8e85036

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 425a03609f19912ce7a6deea2a35b323
SHA1 941273e26e95b63ff69be4a9719933e2289cfb4a
SHA256 1d185198a6c597857b59cbb61b74a0cc465bf6de3fcd806f6fd2f19c26496af8
SHA512 61c6a6d3e5d0ea02ed8c4a940402c9ec656229cc1bdba26da38f94b7ee6babff9c80cb53f7c7c2e0d169f3607e01e6e805b3c409a61e49231d4aad0270d5f7b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8a611add245ef7698aae03c17874450d
SHA1 099c8a91fed5d1a6a1674538cb30c9eae9b8fe1d
SHA256 0d3d09f134ecc6ce7835d0765b76c1ffd0de8138c701d8312a9047704115f9fa
SHA512 29cb7d3e3dc2507071bd5c984d333bbb40ad47e39c840437b3c72bda8883a2be820713fd4bb5e82de4d920c59c2bf6e3e5a238b53cd2ddba6c249f9646185856

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0158f331889bb70e4b2c1a358f7a119e
SHA1 af8a33b4ec72f2ae5dc80eedeb086cfbb136dda9
SHA256 c83648a0c6f89ec5bea1c8775aa3ac1eebb2275b143d190ea777f0b7e13e62b3
SHA512 ab89951c41dd771e5cb498093d943de724c0619ef5ea9a1a9e06be36ae3bdc39ee10d282e7c9fb7c095308740191c8e71820b1fe570bf639eed4c29854bcfc12

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f2cabfd456105f592e3989fdd71d5950
SHA1 5c978797b75fb919085a7a30121439a8b72acc84
SHA256 11ccc2451da9ab9e9d748c71417800dda88e30f49bef9a0bd90d25d5e4b999c4
SHA512 3301a6a2bf3a36f2a470eca4d896bb661d80d460a92d39fedac97eb91bf124a1b25eab38bca7ecfd1ebfb95704c335a8d83a3fa0f3719774f6a1e7724a854ee7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4a773eb186fa7efeade6574001f37f98
SHA1 8348cfc6f07406798a5330db59fa67c979b9555b
SHA256 5455b253958e5f6fc11863c4294a13c0f1deb989d2511b1e72d190f02bb11226
SHA512 e15a456a93686ec7b695a0858180ec430bf7661dc7cb574fd363b75808eefcd2cae8c5cf0b53f9122afe6d75df8664a8694a20bc0430946e325a166590d45964

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4ac4539f0ee19605ef94c989f624d658
SHA1 8eacf58ffc83375d89211279af0745e1b18435d0
SHA256 0a169d22772ceca8f36bb521e927ac5ef6e88eae6e3e6e46397320d1b9b211df
SHA512 75efb0fad32545289b7e6e9579b990fde8b91e107d6525417a96e971e60f92113b974d7ab975911e7051caaf391a102358fe2eeaaad9c1a47626f7949f2f2374

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91957d4a195da3817a480dfa56ea3665
SHA1 77fd8c392459067fb82d54053fbdf1c469b96c18
SHA256 a35c207adda1fe028f08d76d2c90d35ce48143b051621aae29c2824286429134
SHA512 176ef9d524409f5e8616ecc4acb5ac6234422bbd1abe7ffa3aa3b68947bca179409440418966252ed75b2bf1517a1b59f296d7a498de07db545b2bd7f4eb066a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab8d87b2a6e696c0a6460f8baeadacaa
SHA1 b5b3ec0a849a8e3ee34f0afdc3e8ab05d56acbd8
SHA256 191552e50ba560cc642c0de3405fb6303c3f25ee6f41c8ba09d4989dd12527c8
SHA512 2801d80a33d470642407301db6c75c203b5fdd72dee98e164302c4c8fe519ab5c511e8394b75626358db409943ac5f1b3ac3b8141ca4871ad4155787f2f41ba5

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6F0O117Z\m=HYv29e[1].js

MD5 5cf60f409454e420803875690bc7ade0
SHA1 d6f0e85328f7bf8c8a1934d90d7d0c0858d82c4c
SHA256 8e0d69cb45e09b7503ddfcea35a78db0853acff9b9d0a9a0ecff0a32c53d1bf5
SHA512 4eccbe303afed4f485152a6077aec8e1cf5e11af7931ff2c94ca2f933c59c87fb84b3258913c1f031a73bb10aff1d6520eceb86c8c564f731e6dbf5f294ece14

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 4520bb7a0bb4b05fc1102caf75e02045
SHA1 0c6b1a9c5c4bc0aab7c4e50bb0c478c2f7e7dce8
SHA256 850d5015186c5b4e4f03f0f1b5a6c376cb5e50365358700c7f1dd8720e53dbb7
SHA512 6666c9c039185f3da0d26beaee0afbe0c5cdef6137afeae385c678944364cd855d1af9936d0c68ba7e5c43d9c0be46b88903458ee75e6a3219079f4333909b6b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 be043e600e1ac17b3121c92fce8cfc64
SHA1 faa0d31c61cec906c5060d8c567d0b34faaf82c6
SHA256 07fb79c3c6f96b7a9459e7ffdf6d232f830cf2e520ec877f8edf58929ad50f26
SHA512 68f931f42cfe509b356eaf8c21c77640d7a0a7122a10188e9640b1486650d79ba98b52c59f7a8a488a4342dd3f5c25eebd942acc64ae926d320e2519eb3653d7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1M46YZP1\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\leccqyn\imagestore.dat

MD5 bb6362d9fb2e4f147fa111fa4fddfa4a
SHA1 454fef14f4d862e5b577d3c55166cb9483036d48
SHA256 f741935b4df0a16b5dd6926355d38c54ecb154a0c42e869e8901db3ab154eecb
SHA512 3600febdcf64ed183671b2a1aafdfb3e1a1bb87038b1fc33d9755b008eb523c7715d50ce6a624af2fc207819c7587c49b5dbb9418d6b9e057c803d65629741e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7a97bddf2b6de51086d577d1e984835e
SHA1 a8fabe062b2f591eb33837fd279a6db55fa1237b
SHA256 99a6eb99aa54681d042a7dd6bb46854b4227797dcffaadfbc7db7f0bbfad1005
SHA512 6d52dc2fa266c7320706a876b9e2e389cd6bbf13000ea1189522b85bc25a6bcd5fa4a803f8e42723bd0305778bdb99604731c686111bf64c37b01cdef3a94c77

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f77400a02952263080c8a452bfd1aa13
SHA1 09340064a79cdeafb5461402407d557a46ea4969
SHA256 435f6cc24603702c7185e065e1ba85c856d56dd6b50b2c37b846dfb8b4d121dd
SHA512 9d09e1480bce358e70ee5cbf534c44bf71d823be52c1de740cc331f52ffc3e6f804f82fd942e2ed106cefc34b4689e42455503efec8efa42e4b53ef08895a9ea

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R54TGSS0\favicon[1].ico

MD5 231913fdebabcbe65f4b0052372bde56
SHA1 553909d080e4f210b64dc73292f3a111d5a0781f
SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
SHA512 7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\leccqyn\imagestore.dat

MD5 5919554def161e3f35eef62222ae752c
SHA1 aa7feae581db2dd6ad7ef5542b978267c00c7907
SHA256 68481b977c814e22c816f3b83602a8817aea48857a9bb01f83465b9d8f4026d8
SHA512 51c361aef0300605ab5bc1e5b2e9d831d6355ed8fd869c66e26f01e49ef0f78da3e0c1f52208b89829dcf809c9bf61cf6d8b7e130a6e5f5c1c72789a65d76e86

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 616d333b7f23e6bd33b3753c6d8aadb2
SHA1 3b3c7c03e36dc7622e2fbbbec8dabaaae88225c5
SHA256 3dff21657ffef768269a1e4d3c8c646085fb80bd94d3d0c618c2f795555a09f6
SHA512 f3e2af8813eefeef6d88301aa98bcd3f5ff05437f7f516b415e1002b8fb523a59e6a8ee4ea0c01f440cfc9af915b4f1d2064a1a712c0175b628195e9f087f28b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 baf735389071b3653c0a4ff93e87191f
SHA1 51fbb9fe6bafeab4a2ba086ffaa2d92cf4a650f2
SHA256 94141ca60b79c43e5138de17180cab30407acdc6f635bcd99fa43a1703b49ba1
SHA512 1329c11c40aabd0f7a7bc21def40e49bbc67f18f90edac2a10930ebd8d15bcb3be438ef73c547ccb45a1fe9c9887c47e6758e275151e4ecfe0a4ba08f644950a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59ad5d28789495696e1b207fc2a7eb2b
SHA1 023f812d6647f6e4ddd898842c983ec54a948871
SHA256 afe7540790b7853c920ecdff59a2162cfbdc426941505ded43f67ef271eef931
SHA512 f99edde96e5288ada01e31c1c6d179a8baca39b6e644626bba73eab415c97922cee85e148aa5470caecae3668a46d434f3310f25bf1fa4eb95526ae424a7b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c5e2eb6a16308e4857339bd01eb9098f
SHA1 989301a8501f595d03474e68cc39ef3449c3bbcf
SHA256 08fec2866368e53cd043787d36bc86a6c46a98174575682c6f9e7ea12c989fc7
SHA512 475488d0c23015b6a670d6ecefce4c4716a07806b6ae2cf44769840bf79aa580ce990e29bf88e3968c10eb6fe08bcf0ccd28c3fa685e9d4a73c082dfaaae8573

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 40e45e1b2f41d7a06cb2461104a86792
SHA1 29d3844be721f78dd176202e47196a320843f0c1
SHA256 87f1d47764f68e227d9f0d641f92ef255a89a5659a4baafbff15661056ee0bed
SHA512 0c06551e1b8c0cb136fc7cf1f53ee391e33c8bea928f18a64e03380c3dd4bd080918c6a7e0dc85167d10c205d9cfbea4c814656dfe7e47a21fc1744c1de73048

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75f742b8002aedc0c19e4f59770d162d
SHA1 eecd32e7a515150ca7653a2bd93a594e03984f64
SHA256 66ec3c7a11eb217d14373c4afff42aa7f24a4a25a5f65e6d2973f249455f14d8
SHA512 b69f2fb72c2d54b59e081de10e01bf6471766fa82da620e3e5009d57c2955d1ce9577d37876a5a09a9185d558d29d6aae99f60f1a5b3ea204d84a3bb0dec5ad8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e23ffb9bc76dee9ef74e1c13758d71c
SHA1 833ffc22e1b23e29fcbc121daa3df0995dd1a5a2
SHA256 8cb1d52649b11679ebd2def3c63635663ad3d46a0166b90b47d82ea7f3c21ce6
SHA512 69babadc71c60a6b098c2856b2584586c915f3d4cccbd58c1892ac5f7ea1e8ff6faf412c3fa5e173373e2fe8b8a7d0745b5e9b654b9c7e0000a30638cb1be8ae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 13d734ee90a654fc483a8efb24a5edd1
SHA1 fd1206eb7025a6316a440e901cd2083f7d4f244b
SHA256 42401413589233f100dc8a10bc630f739ecbeda4763b377983509fecde0b5612
SHA512 f0a918c5fd56fbad5dfa8c40be0c9827aef063470dae9fb47cf4eba5c8add9040340d131a80e2609bc0fd8beb664ff939c396752cb94417e322eb537a7fd6b3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d13ada0fce0413c7c23d8e1b05460aab
SHA1 98e05ba32f04301c5d4f82136f53f229abe70af3
SHA256 8da823ffea7159c64e5e18d7bb115eeb78115ac316665969047e60e7b6a0b720
SHA512 fb4976391537f437fd254d7439dee23889680401557278b5f74b7481a8c8389ee25cb6c23cffb80bbe7ab1d991879f09fc7a5edc0a66ffa8e3bafa58545554f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57ae6343edaa0ff6102b3f0c3f458dbb
SHA1 bae40d02be75a6632cce1c5c43b5065e6bdba2f7
SHA256 6d8d7eadd6d3b71ea879ceca2ec798ad859344a5f8826731f3a5a603e0ddd686
SHA512 e2d418efa6b78165366ca46bafe5155b9cceca5e23f6e758aa41f2e917981ec152e4614ad831b2291dc0cd905181beda27d00b65be669e103e7c82e01cbc9b2c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 18:40

Reported

2024-06-13 18:43

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

149s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2324 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 1936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 3796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 3796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2324 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa087846f8,0x7ffa08784708,0x7ffa08784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,2935118262381583444,661382206993980999,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

\??\pipe\LOCAL\crashpad_2324_IGXYVFSJMBANHQKL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 30eaf976e98a4c47303396de3ef9ccab
SHA1 646cbfdcfe9efd84f8a82fd1e909a3cc7347a490
SHA256 4907721f53ec1acfc66c39078f35d251053defa392b71489ce952f5f3c87b6f5
SHA512 3d9bd3a010df1e0157937e55958e7143c87ba79e6d209854cbf386aeb86bebb5923a54f9b458ed755b034439aae8ef1b41d296f1c726daa4089d7ea61b464a1d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b3e1fd358d16ae870dd032c5343866cb
SHA1 1f34e679792352311b92a44a63fc2e6cdf14112a
SHA256 056d6469867acf5967c4b14949c6dfa5a775c25ec3e9d89ab7a8adf60cf56901
SHA512 bef5d4c556d9f5692ad812f1f8bfe981f026478a7c0dbb266e3fb12e14fee0f7f663d6afb66144b38c12ed584ed18cd0d14892829eecaa69867c88665bf22b01

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e458e2889902e5dcee898bf4a7c98672
SHA1 9eec32cbeab9211149790258ed78b5a5840b90f2
SHA256 0ad325051ba0240255b7be29b6f633b749b06db71eb8370144d99f4311caf072
SHA512 016b000542b5fac208f71d63fabe672c9c9bd29ef871bbcdecb0c1e4d078859cb41bde9ac91afea96cc1998054565a481e90c0737a52a0233074b6bd868fd813