Malware Analysis Report

2025-01-03 08:22

Sample ID 240705-fykc2stbpq
Target 92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706
SHA256 92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706
Tags
metasploit backdoor discovery spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706

Threat Level: Known bad

The file 92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706 was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor discovery spyware stealer trojan

MetaSploit

Drops file in Drivers directory

Reads user/profile data of web browsers

Checks computer location settings

Enumerates connected drives

Checks installed software on the system

Unsigned PE

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-05 05:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-05 05:16

Reported

2024-07-05 05:44

Platform

win7-20240611-en

Max time kernel

121s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426319987" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000b4f503526270b3e637399c8c9765493a3bae1ac79952ac506af296d0a8df7132000000000e800000000200002000000066ead85c6bf36e03caafd8cc9be7b027a44fed31e337fcdd684c1cc9b1f6c3682000000004f762d9c6e717df22f54ae70732ef82ba7978ff6c8017d2f6bf14a8553833c2400000008cffa358264f6a384eebdaf2a0b0517dbeb35e7877f6681f8d8f41fa76db60bc2051ec7e30605fbc370e9b59feb4bd61e3130c1462c2cf7ad3baaaf8004dcca6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000071950ccdba7e98cb8f1b9cf3f77e1d368a1d72bd39924ed4de9056480717acf8000000000e8000000002000020000000c0867c6517ac00fdfc884633f83cd7e312024c23967492f61e33c8f6a6591ce49000000044a35d1eab04dab2316c4c8a44cc47aa9eefbfd7d8e1137d1fa5e3e301e70d82566193b319f1fbf938a74bae959b450e0582b3020141f0cfb37ad46c87c538811b430d14a50fc48ca184bcf3ff089698ca34f364661d0b34b310240ac9af6e5b976fdfa5aa52e874e58c662a0ff6adb51a2402c6ac079019ce2920fe9e3320cc04f4df19fbb0e2979246d66c0c935fcf400000008d890703f4a6a8c1a0c5ace3322a5092fdec5df6da8facbbb739923fb6f5222ca26c14c1ae1c9d63752b26d1c488a35349578e508704b856250836e5a95ff0be C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C6560E1-3A91-11EF-A0E1-D2ACEE0A983D} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08ff5399eceda01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2484 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe
PID 2484 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe
PID 2484 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe
PID 2484 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe
PID 2216 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2216 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2216 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2216 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2840 wrote to memory of 2896 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2840 wrote to memory of 2896 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2840 wrote to memory of 2896 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2840 wrote to memory of 2896 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe

"C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe"

C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe

"C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe" Admin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
CN 1.15.12.73:4567 tcp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2484-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2484-1-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2484-2-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2484-4-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2216-6-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2216-9-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2216-11-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabFBBE.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarFC6E.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f65ea90a14ddfaed369f6376f237607b
SHA1 855fa0eaafae1f8c6c939e58076470315597ad6f
SHA256 9fdf0752fbeb518e2d4d6af5d57fc59c48b7e1f0524eba9a3f5daddeced43c41
SHA512 91e368ef7a1ee1b8e7d26c288f578ad31c0a8e40c2dae701f5b2270acf8b1abe5f83ed4c84a7389f1d03c42d59cc0482af4777fff1a0d36adeb0b20f3b8d398b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 71806e1928eeb7cc2f92997c7f8a88d4
SHA1 75f120b16460fbc4a83503700fb425f786653f0f
SHA256 7507ff6ba01eb8e91ddae752b23220ff9b4500460cc58082a76e8c15f3e48ea7
SHA512 1094785ad0316e8423c19e5278e63c02fc39ac739f3d5c5a0ce0e775d608d4816d393d629221469c913dd414ea49b9fc2ed619c25e2c69f8bfd6a8712c915a7c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d762b619e57ea1109b36b1b68e8c9b80
SHA1 c1865355eed415380004e3f376d5724a7677441e
SHA256 44f5bc044f49914f7363dd755d9c4222e6cb9839737670ae5eef6b110bbcbdcd
SHA512 f488ed4f41db5c13a19ffefaab0812a1007b9b941238de60873ffca3f6460435beb0dec89945bef1b7f52acf583d5f3ce3457d2fea3d38b63038a6dcf8f2cef4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b58e0891f1840c951f4660dbc19aa823
SHA1 886bdcadeae182465fe0a5f600aeacef73d8f006
SHA256 990a1d6ede17ff4c49308fc3ed520cec08a5ba0e8139e4d2a18fd13dcf6434e3
SHA512 30f04436f3daf98627ec7e8dd4d76fac6b753022f696ef017e60ff03164cb68091e65ec72ab0fceec4a6d457c04e6d6142f2a3bc84b01f2587b8bd2dbc91e71e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e9357ec9cf64e1a9df26ac27e7771366
SHA1 6d91aab4ba7258b28acee5c96a685522c1e91f0c
SHA256 2b83bf21482c43341b1d60e0f7847cce60deea33b91a1c804fef0ee455be5403
SHA512 ea6277e04ae2289dcb675c97a1f79ca74d74f0629ee2264c10d4eaf299b94bc4fd7464642d86aed66d8f591e3bf5afcb0bf846a1d6ddee3b9e8e4be70aff1859

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7bc53bc6d4b3175d4e0e339ce4c76efc
SHA1 323a6cf7923af2e8780ee14857c9fe736a01d7f9
SHA256 8dc56110f448fbec91370c67bc99c7a031798ac57cc230c1a28c54b9502883c1
SHA512 18abca2b7af766587022c787472f331dca07d1837af429cdb365f755c60bf1cdb41f381799bf39c848a11a56cfee9b3f5e3c47ba281f2106fbf68d4ca042fcc8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d492b14260e3e86a2186f7956bdafa80
SHA1 004f6f3d4402888ce35792718a612c7e73b40789
SHA256 7c923d655718806ea89aa4072817614ac1949b31e7a27fd757780d505653a2cd
SHA512 5a3e4858827b85f154c29ca5562329bb1c8b98d07668b576d6c595445bc04a8e96575e14f97afbc7925a9f380e1d8772efffdb810dc675a4cb62d0cc839666a0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 400b211c4ff714ace98d3d4d34c908d3
SHA1 4ce85f40ac1c40c0177036245842ec9d3cbbdf16
SHA256 28fa81790388a8b05813d780d9edd62af1a4461a7db7a58ee4e52224aa083800
SHA512 f66064c226002ea47b2ddfa75420f3d36581ae3e1faf9f9dd027d47c9748f3e7b5c8289016ae1037ef0a4d616e1b5fce7bde400fc2087422abe17510d8363f98

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 edd3265fbbd2aebab3905a602626fb24
SHA1 ffd8d8fb44857da46e345e7f5d8129d340a67b3d
SHA256 7213e0d883e42cace43b32fc625a14e33bbd6f8e1dfe6f7230784a0d1d72c0c1
SHA512 7adec779349758df44ebc8a60db935244756770a2a4ea7986b60147103a4c44f9a049dc883707ec9a4bddb1699cf7cef4ec541015c4afd27a86388c9504345d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 18e1bd37c599b04ee27b1b99c943938a
SHA1 43af38487f42fe702631b45fbd0ffe3a3b5cefc2
SHA256 ff5caa12bdaa674718c08720f2966d598d200759cfaddb98b1522805fe5b0ca6
SHA512 41b0e728305f1fa1a6bea429d3575428e62c22824842560f3b560862bea6793c5bdaf630065b746b0f559d03cb5488ad6c6c3f579e064b7005ccfd57e4fcb3b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 97ea49caf0f5fb9f20e91fc64bd8f973
SHA1 b10630f13bc1595c45ffcbfe9773ca9ed9231d7c
SHA256 265873e9991b17b4bb140dfc805e7ec5b6cc33e5a9fd5080e10da8f08eead321
SHA512 825f248d4929247168942b91a9e67765db549c5c6e57aa9863311ae86cb6a633aaa946720e40d97f9745cacfd5ef72f8f3ba33665a85bf36077c4fbb54fa6c34

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ff1ffa809d9322d0e5f27f70df830a07
SHA1 680575a3249f7dd7848a1e6cf54a0c8ec2e97ecc
SHA256 b0fa34a7d3869e39694db61471f79310c85e241d23aeb279e9fc31bdfd85f0af
SHA512 edc6091e9769ba75cb2bce2605955557b2ea7e208e605db84ce14c0f6ea13acd6f704f85be2c674fc30ef76a8d5dbeef139de617dc63eb0cdb8b559efbb08eda

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7bfd0adee7c696a74a34771219b2584b
SHA1 c2b909cb63aed55f92d2996de1b1252532c6b5b2
SHA256 05c2219454588f38100f240188f9276df101cd24e7d98c0d97a19ce8a864b92a
SHA512 387545155b979b294c4dd97b0a023641cc61fa782132b5881c0d932cd99fab49264450715fea99e994402d96bc6662dd581a5b756f08ce7778380b07ce40511e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f454559f9f4f6db7091ff300b327ca14
SHA1 e59e5442cb2d5f9e7cd5e478b1110e53af7a23ed
SHA256 f91087f533f1c2949aba15014ea2012ac6c933a28a150b79cee60994eceaa103
SHA512 bca37ab06ba3bc3da61d21646cf9c8a9616c708b827dbe2532b4e06feffdc1aa57ff7769008e3b78808f7843280abed7909725557fd9023e38e392c632bd2981

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 14140f3531f98259f705507c892e6afd
SHA1 26a82f601ebee6e41ef8b465f6b00c0eb6b66555
SHA256 9d372bbfbdc97be5ae1334e5dca6f87b07e96ef3585118e2f7d442f71b29c415
SHA512 cc152e9549f9075444ca4492e1a7a2d01f2b92bd82fd4caa8170d8b8fddbdd761ab00345549e7a38ef7672ea056a8dbee601bac2a607b9652b9125582749d829

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fc96d0401b1a6f0a0ac816069550899c
SHA1 febe35617dfdfb3295fdb3d0f481ae5d666a890d
SHA256 b7e8ccf1724a8639f94ec2338a177ba3d5850f45fe94441d5ba7f1527e3bd92c
SHA512 7964fb14a72148a6f86512548a7ee7654397930e9064a2dda577b8b93b5ff60e6a94d5e5975c4ab39aeded6a03031118b72b02113c5cf4d2d870344f2345e502

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9164a0f534d4389ac61748381a0dc324
SHA1 e9ba298504ccd60b2ef0708f910cfeb18d3acc8f
SHA256 007b83f7a5c45e1248df36a353888f0a44f0a3e20ef488547ebea5765a30b204
SHA512 26682a3ff7bb324e6ae9e9fffcafbce5bcdc7dc2337298f5d23b07aa7242316a958c381478e2a63567ad91a4bd7acee57a56e4adf66defe48d5eec4c88fc8285

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6302968d2e9ef4e7c251b52acd7a9cdd
SHA1 1b83a1d031c94a6016c4181a0d3afd5abbb26494
SHA256 879f6d378409e294cb808f20820ab916fdf34780f64516a61a210c4a1bc42bbf
SHA512 56a38d96f039e564a65d3c5dfc74d8783211d9fc09448764830fea786bb068232daf0e2181ebd19e50c74419d405e2b034113fdf3a4bc9b5338e0a1b32d132c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87b63c83b979c6ecf95ed261dc5d3583
SHA1 8314eaec8a5ee60b5a36bae09a921ef7df71177d
SHA256 a77434dfd709ae8efe9513e256c01f9967cf6123ba4c3703f391d5dba05e5759
SHA512 edb9cc272c9d09d55dfacba04c7acb4ef5607138ddcd5e5da3215ca698f3e542512a19168c216d6bb3aaa6f44802cb272210cde7b2080dff0258256d246423f1

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-05 05:16

Reported

2024-07-05 05:45

Platform

win10v2004-20240704-en

Max time kernel

146s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 452 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe
PID 452 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe
PID 452 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe
PID 2476 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2476 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 1712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 1712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 3944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1784 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe

"C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe"

C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe

"C:\Users\Admin\AppData\Local\Temp\92307cce4aba6c947859d5a5a06b4955a509500eb9e440bf61935930f1398706.exe" Admin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd66ed46f8,0x7ffd66ed4708,0x7ffd66ed4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2784 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17211506825148483168,8852935439087798732,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3640 /prefetch:2

Network

Country Destination Domain Proto
CN 1.15.12.73:4567 tcp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 arc.srv.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
HK 103.133.93.52:80 www.178stu.com tcp

Files

memory/452-0-0x0000000000670000-0x0000000000671000-memory.dmp

memory/452-1-0x0000000000670000-0x0000000000671000-memory.dmp

memory/452-2-0x0000000000790000-0x0000000000791000-memory.dmp

memory/452-4-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2476-6-0x00000000023D0000-0x00000000023D1000-memory.dmp

memory/2476-9-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2476-10-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2476-12-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 2915233ace3b11bc8898c958f245aa9a
SHA1 68c6aa983da303b825d656ac3284081db682f702
SHA256 b2cb442f2ca27619c8df087f56fcbbb53186c53f8fd131af886ee3712220477e
SHA512 e3f1b70d39b615e212f84d587ee816598236ee6ce144d919593894fcce4a0900343a9e8b837a0d1bd10921fff1c976c84c4a570eda776fe84d374a69e7a54890

C:\Windows\system32\drivers\etc\hosts

MD5 03450e8ddb20859f242195450c19b8f1
SHA1 9698f8caf67c8853e14c8bf4933949f458c3044a
SHA256 1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b
SHA512 87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b

\??\pipe\LOCAL\crashpad_1784_HDHPELOFWOGJEKDK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 69fa6ada7b55b70e9db8ee3600cc98d7
SHA1 78d3c8ab72b090d7a8603cd8610939a74915f35c
SHA256 d3645e769352bee92cdceba30a0dfa96237f7161ca16b0cdca708812f56a2864
SHA512 4354566a1401e30aa99cfeeac687b8853c91ec585553218b41a1651f52ec1e9f69d90758d75d8ba7ad45fa855d7d2ee8e89c44f415300ed37dc0abe2ffc1fc35

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0c60515ccd23353326877d4a30d347f7
SHA1 fb99b15b55360e14a1a303c7722ccf73d0f60afb
SHA256 d3e709d620deaf0a2b0a10e91777799bc4cb29176c90d7d7b524c9c6527f3588
SHA512 19d1e61941d0f7d466971bfc22d0b69baf5377e5f2470846dc4a551b0417323d63f2b725959a6063c5428b1e75953c877212296bd122b12e814c1b5e6115dd05

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 454c902600015fe6363165cfa2e78562
SHA1 039a6834c51cded5a3d2ca16e947c31a512532b0
SHA256 420f7032ca531f41aa89e9cdb7163077882097dca9b185c56a6196454bfbe3f8
SHA512 2650de6c05fef1dade05836fe9321f4d6bcc18186a54ed27c558d36f47c7d70e6b5614abe7681f40e41a768b0c4c153b706c057481cc2b4881bf5b47fdd23009