Malware Analysis Report

2024-11-13 16:18

Sample ID 240825-m85kas1drb
Target Combo Editor by xRisky v1.0.rar
SHA256 28240cbd82865480b8d1e29901c552ed84b2ee8a86eaa421de5ec96b364cdee9
Tags
agilenet discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

28240cbd82865480b8d1e29901c552ed84b2ee8a86eaa421de5ec96b364cdee9

Threat Level: Shows suspicious behavior

The file Combo Editor by xRisky v1.0.rar was found to be: Shows suspicious behavior.

Malicious Activity Summary

agilenet discovery

Obfuscated with Agile.Net obfuscator

Checks computer location settings

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Browser Information Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-25 11:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-25 11:09

Reported

2024-08-25 11:09

Platform

win7-20240708-en

Max time kernel

10s

Max time network

2s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe"

Signatures

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe

"C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe"

Network

N/A

Files

memory/2628-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

memory/2628-1-0x0000000005610000-0x0000000005A5E000-memory.dmp

memory/2628-2-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-3-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-4-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-5-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-6-0x0000000000800000-0x0000000000940000-memory.dmp

memory/2628-14-0x0000000005610000-0x0000000005A54000-memory.dmp

memory/2628-18-0x0000000005610000-0x0000000005A54000-memory.dmp

memory/2628-16-0x0000000005610000-0x0000000005A54000-memory.dmp

memory/2628-20-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-21-0x0000000005330000-0x0000000005382000-memory.dmp

memory/2628-22-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-23-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-24-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-25-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-26-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-27-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

memory/2628-28-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-29-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-30-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-31-0x0000000074D30000-0x000000007541E000-memory.dmp

memory/2628-32-0x0000000000400000-0x000000000078D000-memory.dmp

memory/2628-33-0x0000000074D30000-0x000000007541E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-25 11:09

Reported

2024-08-25 11:11

Platform

win10v2004-20240802-en

Max time kernel

140s

Max time network

106s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe"

Signatures

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe

"C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\Combo Editor by xRisky.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 44.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/4584-0-0x00000000745BE000-0x00000000745BF000-memory.dmp

memory/4584-1-0x0000000005920000-0x0000000005D6E000-memory.dmp

memory/4584-2-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/4584-3-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/4584-4-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/4584-5-0x0000000004FB0000-0x000000000504C000-memory.dmp

memory/4584-6-0x00000000054C0000-0x0000000005552000-memory.dmp

memory/4584-7-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/4584-8-0x0000000005810000-0x0000000005862000-memory.dmp

memory/4584-9-0x0000000008100000-0x00000000086A4000-memory.dmp

memory/4584-10-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/4584-11-0x0000000002A50000-0x0000000002A5A000-memory.dmp

memory/4584-12-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/4584-13-0x0000000008980000-0x00000000089D6000-memory.dmp

memory/4584-14-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/4584-15-0x00000000745BE000-0x00000000745BF000-memory.dmp

memory/4584-16-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/4584-17-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/4584-18-0x00000000745B0000-0x0000000074D60000-memory.dmp

memory/4584-19-0x0000000000400000-0x000000000078D000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-08-25 11:09

Reported

2024-08-25 11:11

Platform

win7-20240729-en

Max time kernel

134s

Max time network

127s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\YouTube.lnk"

Signatures

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000edef1691a1861b6f26a94f638a22db642a5307dde677464ba02bc896a34412a7000000000e8000000002000020000000c507bc69f464006f14e7178bbaf5a0a221f6d55f19f2165e85530936558d2581200000006a88aac12112c82c7033ba36af9bae0de725058d30096a182e134abc8d7b99c740000000b75b72fccc88892ec1b367b410aec8f7135925f61b935b9304f7b519b54583868171b4e82b5373b8c3e3ea72f1b4300410e30b046a7529516019b670db46232d C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02c5c4cdff6da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000049c7c4895aefc492395f1345509f8744b52ab825485490d1487d6e8618979282000000000e8000000002000020000000aecae7d26aea3615e3699f8fa1e54b73a2549ce7d8038be6e3b2ce1e4a9106969000000045c1e2a963dcd238443876c9dea02b8bc0631aed68b1529777b3f2ae06057ff5cfd2e2ee055e57954e1df718da2ce2a0340c35aefd9508ba581feab9cec91ea568ac8998d556a8dc32753ab82b7ca187616cf15f7b2a75a01c24ffd345a407c920ebec2cf8bd4bc039593656e32191783f4156ce6358c0e6b5238c59007046688d199e6fc680480d896a720428df67774000000064469baa8b48701f72816e37766d68f3cb0db3d49f75543c00d6f35ed2f92a60cf0d1c414dbf6cc4147f2a97dde0aa34d0970bcb6994c923208d30310feee076 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{760E8CF1-62D2-11EF-AC6A-FE7389BE724D} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430746021" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\YouTube.lnk"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe" "https://goo.gl/u4VrES"

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://goo.gl/u4VrES

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 goo.gl udp
FR 216.58.215.46:443 goo.gl tcp
FR 216.58.215.46:443 goo.gl tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
US 8.8.8.8:53 www.youtube.com udp
FR 172.217.20.206:443 www.youtube.com tcp
FR 172.217.20.206:443 www.youtube.com tcp
FR 172.217.20.206:443 www.youtube.com tcp
FR 172.217.20.206:443 www.youtube.com tcp
FR 172.217.20.206:443 www.youtube.com tcp
US 8.8.8.8:53 i.ytimg.com udp
FR 172.217.20.214:443 i.ytimg.com tcp
FR 172.217.20.214:443 i.ytimg.com tcp
FR 172.217.20.206:443 www.youtube.com tcp
US 8.8.8.8:53 accounts.google.com udp
IE 74.125.193.84:443 accounts.google.com tcp
IE 74.125.193.84:443 accounts.google.com tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\0WE921W8\www.youtube[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q98GZSGI\favicon_32x32[1].png

MD5 12430f012c4b6b4a91c63cbf1369e1ff
SHA1 a8502ade0c47e23230e5da9d5658ec1f1da309d6
SHA256 079919e3400ba9bc0d569f5634cc41b2fd1b8e7a721b2b473d21f10fe2fa7f6b
SHA512 17b7564088e12cd64ae79e7179ef4b26941370dc442528cb08320fc0d40bec88d2b77124624685acf9ba974467e27a7051703761c6fffe5468c90217cac5a4a6

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t6u9s4b\imagestore.dat

MD5 f69bf9ec4ade62622c63fb8ed0639157
SHA1 1d415914c07444c1ae2590677f27c1c9941c3a54
SHA256 ade3f3f576c0ad779487f57e9866df0008c555bc2b1c0417d4fcdbec3cea99e9
SHA512 2be6c95b4a5e572b923e23373ad75cf91176ffaaec5c3663923209fa78909f9ad5dca950b3800a661ef54198c1c29122e122dc142783eb27b20d0898d68e68ed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ccbd639c0a9c0575ce7909e2aad162dd
SHA1 b5eb8b1826feb60034c5e7bfeffa2408162bbcf4
SHA256 07b9d0bcf8f058c4d3db6a60b6fc227b45f514ab1e6627adb5a6b8c075d12115
SHA512 888ab260b478a5a6a13723a69f3510c8b5fbf48d626196b17d8c6dfab60de29b283e0e5c0802d194d85391da2101b97221375fdbb3b126554f2e64edd0c64a82

C:\Users\Admin\AppData\Local\Temp\CabC68D.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarC68E.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bedc019f8f756d033000dbc52d8b7ccd
SHA1 257b41d5342685fc3f0b664c8e131ec83268059c
SHA256 1f2c03300d7f8d0ef89a164383e0ca3eafbf85e71e5a32d8d6d0919f93002cf7
SHA512 262adae4b27897bc027fd02410c3deb56906b2245d4050e6c36b3f5e5929f6b6e2009f52f22bcbef75903e4c08d4acb53794ce9dec38fb51b43bf785af99464e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f987ef1583cc2a62e01dfe552b0e6f5f
SHA1 a8189db60f2816eb6183d5cd2b50caa0e4b74194
SHA256 85695ad1c3ebc0556493908e524437b53695b47babdbd540f0d3046c73405f74
SHA512 609097a7c1601fff5b4759f2a8fedec5caf23f208e6b7be0566ba27c840041889a608602d40b78b4acbd93b4a390d0de1dd8e2e9fa89c13c058d20a2c894df65

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a2ec48b22bc51dde3bc7bca6718f3382
SHA1 acf434d573feb741f1d7350334d380a79fac6e37
SHA256 0cac85226e336fad001ab12688f892bae7bd94161b0abca0a486296049b7e4bf
SHA512 f6b053289a76c940469470eab585f5fde47114babec21b6a2a095d8675140142668d5d04f02ca476730e878e7a53ca80414f78e703be07f5f7684bb427bfc199

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cfbe0871abbe8a4bfe5a1bb8725b2b11
SHA1 3d9ffb7e96c911dbb064478b0c9633c049b04509
SHA256 e7b91438ba746dbd9286a4f87ea1b56f9ce480a37d7504ac8e58f9daa2966a7b
SHA512 435dda742e02407954b0d63fa8020d4299b412ea5997b3174cc6ff27264ee90dec485104066887d20e50bfbf3543bc62747e7599d856f89ccfd24d34d8895632

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e1daf49981abc53c341eac80f19e33f8
SHA1 97bf948fe6be4f50ded3f454c3cc65ff89e6fefb
SHA256 ed912971619a69677a3e56169502029e9ae8d13154f8f9ede5bfcfcdca528c42
SHA512 abf98a966012413763416ae23385e7b568f6cf23d227c683715d9279a6548e409418a06653eb47d7e0d9352bee3fc69a1e72706d7e18aa1184d37368c704a27f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 93c011d09e99f77da366903345f6876f
SHA1 3a608930711bb4e7e2bd5aaf22f375b56bc8692f
SHA256 35b6a3e4d1f2ea6cc991ab1f09b32fd4ab448dc416586d09c7c924155e8bc2f0
SHA512 5304f776804e62de4356815aee440e24b74967623dfcd2bbb62ce72dee44fa6ec7df96430d5bc2bee3bcebc6b45a01c996df8139e91b7f65c3a0d079fb13031a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c525b712a09a282f1141f04c90deb615
SHA1 d8679fa3a90db59262d7a903832d61077751c174
SHA256 ca229dc288cbae4cc816fdc4761c32ff8ab5c3475e314abbb8d036e99472f99b
SHA512 1d57ba58cdfe5cdfe64f74238bd695e5386840d1139fd996819d1eb2801bd0ff23b974dfc945bf07383ac29728658da8866b9fe423e1b9e626e50eef18efe848

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c228a8584fe4f1afa20c4382b326600f
SHA1 41f590cb5a32c9451f0624687d0ff1aa18af4023
SHA256 77b975331b2fd7daa7b5792241d74fb68cb0d052465340f0601322212985f7d0
SHA512 b63630774d8ba3377c8200d747c4cff05b3dfb5ab44623e71cd60506337a92832bd2bd64183c7e260fc27aca81b78f9df4b9f7b611fc03b398e532bf4f019434

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5cac5c29881e90823b190956d5745f7c
SHA1 cb05c8e7e18dbf6d8513c3df9edd07795e896a2b
SHA256 8073165d388b162aa3436acbc54f0e7589e2c1bd45896f918e37f7f5661c7017
SHA512 7f703ace220b8d0a9126273b693e23f8cfd05e8cb6f1557941032925da5de04e28347d6f4427087553517b433d486d304c49d49fcece0dd23ca2403c72bfa76f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bf81e5d43aa01bacb625122a60e751f9
SHA1 2b42a6a4620cbc0493292170c78936d9d09323a0
SHA256 c3dd70ea490468b02ded3a6f057ed8edfb63a90179304079ffd26645d648b6b2
SHA512 38969281770cf397912f40d915515b9a64c0476f6005baa4588f2f960d7db7f3e0ad088c0e938d078389d9dc24a107821552d94a0c8cf9962e580a4edf37ef8a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ef6733ac1700887f38608aadf6530479
SHA1 7900d8b7ba1b2f50c857a259203250f00d3491d2
SHA256 7890f8b7611e086326cc7f97f998416e5317f5c499b36d336c51956c2cc4f83e
SHA512 5e7ccf1bbd5c2c82ae8fa77de0d412ae57611edd7b78347d46b330d09b91795585ea60e3b3bcaf8367605c17537e7feb9fe3a79f6d53d88de4c5d4412c2bf48d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6312925febafd85ca10f28172ce8ce39
SHA1 c97e81d4643dcab62de402fc87bcd282eff5c42b
SHA256 5a7eda44f0f96123258e6125f291807a6520e208728fffcedab8cb01cf7bfd3c
SHA512 8f24e6db38d7baefa9f8caeb53dfecaa0fc8833545bad120f6d3b06aa290f3ee0070b08c68e9d13acf4efb0fb4e9694bb0162fb97408df1f6765c2bce20ae209

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4ab5cf5474527657b8c065ab9039fc82
SHA1 309cad19188f6a76c39fbb449048c95ad633d2b0
SHA256 4269a4a83724f61ff6c9665d6c2dfa26a51b2ca9f633bd6bff467c9870ba443e
SHA512 9ddc50db08d1253d7312be9dc7e5dabbd392c0040bc98fa528132c2e9f9ef99133910d7cfba7aad5e2e4e9b48e1b3e3b5ea56ec47c9bb2188cef4cb6dab44746

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d463d79ac915b1a166dde35b4b4f8127
SHA1 5c28cf0649602d407ecf37140ab8a317db530b4d
SHA256 971f7a63af46d6875272350a56fb6e691ed9cbc3529f25277b17e56f0f370001
SHA512 118ae6ddb49535e93d0b55ce4ef1703413b35a4e12b080fa0ecccd6957705dcf0c99e460294df63c8c0b9a0b991ea0cc1ca0fb92cbb0e5cabfb16ff9f7f3810b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7d54434f209f859bce7a92cfee014088
SHA1 0be128cbcaa21fc557b75b93d19e339b336c5ecb
SHA256 488502c9f29a6896ed64e650bd75982ce9923ae0363431fddc6277970f7520ad
SHA512 83e3d8c04aed05c9f572022070971e5b6d03b59ad6de23ab63c2dcc9bd80eee732b02e6a8398f37bcabaf88bf79a18c717398269f6ba989023f920e5890f3045

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1881099e18a43cc9cad81a82ea14e431
SHA1 2e45a1c3b9af24e21aab3ef740d3b79e7304ab02
SHA256 7a6dc5c5c7cde2a376da60dc85a6a5804c283aaa09c4ce44050d6a1d06c8fb2b
SHA512 46e2d6d41c1d3f4b3542f09c1fab5b8fa80f4d62971423296eb6101b320ed72e75aba7db8b25a6146dfebe0be8831c657700f45a6ecc3b12bfb485869fad14fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3a36c9e68ad983f809194c24fee603da
SHA1 06ff08937b7fd673065504668f8ba161c03c4bf7
SHA256 68832bf6f24d893bc7564f40d167ad362d7575df9d3a9408d83466fc892fa675
SHA512 963eda02cd75c01000ca89d24e2a6483970b5e3d3acda962ac3825bfb7245fff570db900e97468b221a27a4ca98c8d920178cfc96bbf7624cf89577d54759cb3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f8afb31f8f58754ef40f8f863dc82e38
SHA1 66ab1542ae1edc9aa53b5c76adb5fbda16600871
SHA256 fbeef94c053b7d7ce2b5f60f3ab018bea1fab60c90e4a0f65da1f4d9da528247
SHA512 aabb23967985fe5f4eeec4b3b33d4e06c488723251459e62c55dfa5f6a68593d3ab7126a1f83c8e410cb8685c0b887aedc6abb6e083211b5ac664b34e0d6e76c

Analysis: behavioral4

Detonation Overview

Submitted

2024-08-25 11:09

Reported

2024-08-25 11:11

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

151s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\YouTube.lnk"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2344 wrote to memory of 4008 N/A C:\Windows\system32\cmd.exe C:\Windows\explorer.exe
PID 2344 wrote to memory of 4008 N/A C:\Windows\system32\cmd.exe C:\Windows\explorer.exe
PID 2188 wrote to memory of 1568 N/A C:\Windows\explorer.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2188 wrote to memory of 1568 N/A C:\Windows\explorer.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 3052 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 3052 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 2652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1568 wrote to memory of 828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\Combo Editor by xRisky v1.0\YouTube.lnk"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe" "https://goo.gl/u4VrES"

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://goo.gl/u4VrES

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa215146f8,0x7ffa21514708,0x7ffa21514718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5248 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x298 0x474

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14557770901862636908,2733251513047921141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 goo.gl udp
FR 216.58.215.46:443 goo.gl tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 46.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
FR 172.217.20.206:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
FR 142.250.75.246:443 i.ytimg.com tcp
US 8.8.8.8:53 206.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 246.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
IE 74.125.193.84:443 accounts.google.com tcp
IE 74.125.193.84:443 accounts.google.com udp
US 8.8.8.8:53 131.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.193.125.74.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 rr5---sn-q4fl6nz6.googlevideo.com udp
FR 172.217.20.162:443 googleads.g.doubleclick.net tcp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
FR 172.217.20.162:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 yt3.googleusercontent.com udp
FR 142.250.201.161:443 yt3.googleusercontent.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.co.uk udp
FR 142.250.201.163:443 www.google.co.uk tcp
FR 142.250.179.68:443 www.google.com tcp
FR 142.250.179.68:443 www.google.com tcp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 youtube.com udp
FR 142.250.75.238:443 play.google.com tcp
FR 216.58.214.174:443 youtube.com tcp
US 8.8.8.8:53 162.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 42.57.194.173.in-addr.arpa udp
US 8.8.8.8:53 161.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 163.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 68.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 163.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 238.75.250.142.in-addr.arpa udp
FR 142.250.75.238:443 play.google.com udp
FR 216.58.214.174:443 youtube.com tcp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 static.doubleclick.net udp
FR 172.217.20.202:443 jnn-pa.googleapis.com tcp
FR 216.58.214.166:443 static.doubleclick.net tcp
FR 172.217.20.202:443 jnn-pa.googleapis.com tcp
FR 216.58.214.166:443 static.doubleclick.net tcp
FR 172.217.20.202:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 202.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 166.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
FR 142.250.75.238:443 play.google.com udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
FR 172.217.20.206:443 www.youtube.com udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
FR 172.217.20.162:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

\??\pipe\LOCAL\crashpad_1568_FIORMLCHMYFSYMTA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 185349e2f3eac1ff2e08b33779b17c69
SHA1 3a30b3299165a6248fe997c8bfad987fb7c3e40e
SHA256 496134db0a96658b3a42a116d5f69ecd0b3e5438b011a01e08aaa944bca0726f
SHA512 e8ca7b7bf30bd77edf0eb6753f0fd953cd726079c8a369fcc8ea00637416610c55173f1856b8dbc74e5d455c9cf19932f38e6ff7e9ec2b2593ba88ecef7b695e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 1864216611ece16da60c6f6e0b6c8e36
SHA1 d118408aa7049e425e8c2dbf44328568909876ea
SHA256 fc75907ed6ce8aa626bba2c9c3952597e10a3ec38502f00a8c560d2c3ad0279c
SHA512 b56e536382563fe018fa69e07bae4f401a8bdeefecdcdd5b652113111a7051b5026c712c86a04d8f4fbe70264585a18d9d3455a7152422c5f18b8befe2eb3456

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 164c9961c87961f8ee7fbbc18385642c
SHA1 084e23bf5bc73efc6339447f61db00ba3e4e6cfb
SHA256 61cf7e8167503a1c45b6d67e0cc71125a5f623b4a2369c6ddd5814c7da74537e
SHA512 07aa3085ffcfaaa652cf4aa4b59b63cf6b9e988aa92ae33223af422089a1184c8e909006d5735c94ef5266b51cfd4fff1d3b0437c580f58d85a3381564f30a09

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 787e6ce69d7d62474aebbc0f33232f5f
SHA1 6cca7fb2097457dbc39ba058c13d958d72888675
SHA256 0d8076badc104d0a33dfe98557c87f2f42585dafff4082a7282a4c81a58bec01
SHA512 643f856849fcf265e426465a6f2345d7a1a646d1299154efb341083103d672501ad7b524ffc822c1b45702ac47e2ba25f2f6146eb93560b03f86e09a49ae1f9c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 27672e047b41ca7c2280df3611b16f85
SHA1 ed4b3336bf7275de3043b6a50e3f584faf0722c7
SHA256 12fa28713354e09609c0dab9f79e96c52197b424b8f1ebb30a3902c4b61ae792
SHA512 24f7ed8d9207f20750a3571855340123aba8d69e64d938ba9f912c9b820ba2efe48634150699f87a0b6903340576eed90441bf7cf65afdd7a71408df382408fd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3e732952feab2779b5b597c39c40c61c
SHA1 4b0abdd312253cb52b2fceeb15dfad4d906eb359
SHA256 20115dc786168e1469030dfd3adbbe5b592579618452c025e98018ac910e38a6
SHA512 9cdd7822a5bb04740414503dab22ec8d2e4c08a3731b9afdd91d7a89598f9a0644d30c335017d5b5080ab061eb22e7dffa2f4dbfec0ecf16266195b31d65433d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5b058b04604b9dfb0040694efe50f262
SHA1 b8fa8f1e57c358e752f22e2cbac57b7cdf8eaa5a
SHA256 fe55cca059d621d993f05145c575032d3c60e7c1433f5ac13c53049c176854d0
SHA512 7022b6397818ff796710211a1fae4bd0479e7d27a7edbfcca18abe92151ce0c3401947b550508d4eac2989306fad24246bcfdb79d7b22da72bfa9a9096b50c5d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fccf.TMP

MD5 f95f032fe066ccc7a9e2a2b044fdbeb2
SHA1 0371e4c3d633fbb0e1fa6ce6ef5f4ecf5c700660
SHA256 38c64b179ffa61ce82847c3498c5a18b452a243e33a401d09fc0aa4373a247af
SHA512 0ad826b3c6f4597540eb2f7769eeef8609e7603d1fee507e5a934cb3899f55fe54b22c394804055629d99dcd5f3e2ffd50427567314ba051c6fe01ccd94b38a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 b0df395129743e8bb9631361f14f508c
SHA1 b2aba353e2df6ad25e73a57cc9b5d6ef6301c6d0
SHA256 63c59f228e03d6137be931cb2d3b83acf8507dbe43ede57affbc2d72d741891f
SHA512 af4920201410385a39ae0108dfcd9e3311c53648ce4b4e2785039ca73a10078fd143b24f83eee38838e3b5f08e1d617337ff628fec0ecbe2783af4391c040b70

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8d461da8-f111-4d70-a32a-aca28f484dd8\index-dir\the-real-index~RFe5800e5.TMP

MD5 28fd1fe348d5d1c361d0461721336b7d
SHA1 a64015d978d1df00fdfa02cc19c6d9cbcdce18d9
SHA256 9a083eb6726152705ff01edfc0c975c7918a049dc1ec8c2cad4db51319b89abe
SHA512 9cf4ecc0b5dfd646a831b7a26fd887a0c5ad277951a696b9ad84f655201bee88d81e2856eaff5a9e8e660c79762f14c2b056031bf978d20b1e25154db75b7374

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8d461da8-f111-4d70-a32a-aca28f484dd8\index-dir\the-real-index

MD5 7195874d69cc5a96224be2d49995820e
SHA1 76b5c74de34264cf9c20d82f187f8baffbb835dd
SHA256 8801a6d862a634952cbb65672081fac41874be60625291e000c75bd4a6036b51
SHA512 b3684bbf4951dfadcf4c391c1033e071a5257d8b4b85cf1717e6b8c7f1275d8194a1aebe4667df8014518f7af094eedbf06cbc13e694167828da76aaf76d2506

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 e7d12bf3f111682b5a3f1f91aff1bff2
SHA1 1887b95787a0372e573c65c36bb7a092d56b35d4
SHA256 d9812aea84034c52417c4b038b8fd22c2e55d02e841142222521ece5da94a7a5
SHA512 8ff5dc98a2c6bae17537296c02ca742c11a19995d1273b315f6a068e5eb37464c415ac9d7794c06658ccd077136ce657476bea46e4ecb689bdd58bf33e53b314

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d4ab831f-cf84-4e93-abdd-6aeb342d67d6\index-dir\the-real-index~RFe580450.TMP

MD5 3db9d498e6367085ebe66b611a70363a
SHA1 9becdf3be74484840fd2a66b27afd756863a5396
SHA256 4bb596513a2dfb4a50de35089c40400be69aa969f98d51b201d123fdbde6db57
SHA512 32f03eb45f57e4e57e17fe96109a02b22ca2d03d7e593549efe0b36b200be9437d680d358421956007b33ca08671182b4328252e479cc82427b07306b36488b5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d4ab831f-cf84-4e93-abdd-6aeb342d67d6\index-dir\the-real-index

MD5 e0742dff977b3e5e7f28ea7e2e414aa4
SHA1 b014537214cfe069e44ea022690c34afcd21a386
SHA256 7da26346d644e4d0445eb61f6294311c493829516c3bb15131fd6c902b3deb58
SHA512 86e4cd95dc164af1875e016685942ab6c9b7f7a1f888118c1ae1d72a52bb859694b32d065b9ec542a3c742e04de7a52c9ceb71910175bfd92c1657ce91750409

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 60318b7eebb38f387f4d516592044c2c
SHA1 b31617f1f6f83392cc92dc39cd9cb362568c9c44
SHA256 2ec0daad19e732f16cd4a2a2b200c39aeb782b422399a8d353a17f50455a2ff4
SHA512 2bb4277e2e7d2887672559166e0d08c3a363ed94a374d9fedc2c5d1f6e92dc6044b28982cbcad07ed94b89ca2e8a825a51308e13b698ac7cae38c49640a91984

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 97cf6e142a6ac8be147dc3fc7b2e5b6a
SHA1 435aeea2fb42570b46775ce908a7759edf3b0835
SHA256 dfd7724bb6a23cfbb3cb579d05acb9b86dcd2f2e6ba71f086e390611c3a32c75
SHA512 ce1a1ee96276289a92f0872463f4cad77efdb31a4b7d58e56b58cd444c2f90378831ebae8dc3c0b0bf34b4c83addc3706cda218229cafe83bfabbb11cf747eea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 936274075dc7f35aa8d258131efde9b2
SHA1 a6a436dbd13fb56e61aeacc94d554ed7a5f99539
SHA256 150f3d77c57001e24a941ac2d2a8522d3327a09870614b0fdbcbe5c19804cc36
SHA512 903ce1f56b92ba7995ba09522fd741ab5efbfe9b2146aec85047fd696ad1dadce433b51ee54e8293dc2a143492a060e6de180f4f1cbd2efcb1abfb16957e21a4