Analysis Overview
SHA256
f79947418426ba4cd55deaf224f17cd0583664e75af6bd529c3a76a06a556be5
Threat Level: Likely malicious
The file file.exe was found to be: Likely malicious.
Malicious Activity Summary
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Downloads MZ/PE file
Identifies Wine through registry keys
Checks BIOS information in registry
Reads user/profile data of web browsers
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of NtSetInformationThreadHideFromDebugger
Unsigned PE
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Browser Information Discovery
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious use of FindShellTrayWindow
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-13 15:23
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-13 15:23
Reported
2024-11-13 15:25
Platform
win7-20240903-en
Max time kernel
122s
Max time network
127s
Command Line
Signatures
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Browser Information Discovery
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | fleez-inc.sbs | udp |
| US | 104.21.0.123:443 | fleez-inc.sbs | tcp |
| US | 172.67.150.243:443 | fleez-inc.sbs | tcp |
| US | 104.21.0.123:443 | fleez-inc.sbs | tcp |
| US | 104.21.0.123:443 | fleez-inc.sbs | tcp |
Files
memory/2480-0-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-1-0x0000000077A00000-0x0000000077A02000-memory.dmp
memory/2480-3-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-2-0x0000000001131000-0x0000000001184000-memory.dmp
memory/2480-4-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-5-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-6-0x0000000001131000-0x0000000001184000-memory.dmp
memory/2480-7-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-8-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-9-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-10-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-11-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-12-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-14-0x0000000001130000-0x0000000001435000-memory.dmp
memory/2480-15-0x0000000001131000-0x0000000001184000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-13 15:23
Reported
2024-11-13 15:25
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
152s
Command Line
Signatures
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Downloads MZ/PE file
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0e8a46f8,0x7ffc0e8a4708,0x7ffc0e8a4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0e8a46f8,0x7ffc0e8a4708,0x7ffc0e8a4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2587663121113712849,13266656134089865488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | fleez-inc.sbs | udp |
| US | 172.67.150.243:443 | fleez-inc.sbs | tcp |
| US | 8.8.8.8:53 | 243.150.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 172.67.150.243:443 | fleez-inc.sbs | tcp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 172.67.150.243:443 | fleez-inc.sbs | tcp |
| US | 172.67.150.243:443 | fleez-inc.sbs | tcp |
| US | 172.67.150.243:443 | fleez-inc.sbs | tcp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.135.221.88.in-addr.arpa | udp |
| US | 172.67.150.243:443 | fleez-inc.sbs | tcp |
| RU | 185.215.113.16:80 | 185.215.113.16 | tcp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 16.113.215.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | learn.microsoft.com | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.110.18.2.in-addr.arpa | udp |
| GB | 95.100.246.21:443 | learn.microsoft.com | tcp |
| GB | 95.100.246.21:443 | learn.microsoft.com | tcp |
| US | 8.8.8.8:53 | wcpstatic.microsoft.com | udp |
| US | 8.8.8.8:53 | js.monitor.azure.com | udp |
| US | 13.107.253.64:443 | js.monitor.azure.com | tcp |
| US | 13.107.253.64:443 | js.monitor.azure.com | tcp |
| US | 8.8.8.8:53 | 21.246.100.95.in-addr.arpa | udp |
| US | 13.107.253.64:443 | js.monitor.azure.com | tcp |
| US | 13.107.253.64:443 | js.monitor.azure.com | tcp |
| US | 8.8.8.8:53 | 64.253.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | browser.events.data.microsoft.com | udp |
| DE | 51.116.253.168:443 | browser.events.data.microsoft.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| DE | 51.116.253.168:443 | browser.events.data.microsoft.com | tcp |
| DE | 51.116.253.168:443 | browser.events.data.microsoft.com | tcp |
| US | 8.8.8.8:53 | 168.253.116.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 6.173.189.20.in-addr.arpa | udp |
Files
memory/4284-0-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-1-0x00000000778C4000-0x00000000778C6000-memory.dmp
memory/4284-2-0x0000000000FF1000-0x0000000001044000-memory.dmp
memory/4284-4-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-3-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-5-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-6-0x0000000000FF1000-0x0000000001044000-memory.dmp
memory/4284-7-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-8-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-9-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-10-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-11-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-12-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-13-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-14-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-15-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-16-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-18-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-17-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-24-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-33-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-25-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-41-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-47-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-48-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-46-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-45-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-44-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-43-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-51-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-53-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-52-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-50-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-49-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-42-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-40-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-39-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-38-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-37-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-36-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-35-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-34-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-32-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-31-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-30-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-29-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-28-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-27-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-26-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-54-0x0000000000FF0000-0x00000000012F5000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 37f660dd4b6ddf23bc37f5c823d1c33a |
| SHA1 | 1c35538aa307a3e09d15519df6ace99674ae428b |
| SHA256 | 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8 |
| SHA512 | 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d |
\??\pipe\LOCAL\crashpad_3528_AOCQGBRYQYHSOEXT
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | d7cb450b1315c63b1d5d89d98ba22da5 |
| SHA1 | 694005cd9e1a4c54e0b83d0598a8a0c089df1556 |
| SHA256 | 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031 |
| SHA512 | df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 648aa08ec6ac681cfbd305bd358c8c28 |
| SHA1 | 61a79efae49cba0b89cd2476ba6e1d7af66ebb90 |
| SHA256 | c6588bd61e634fbf8994f5df8721e5651edc87b8b04b2149a7b45d7649588b15 |
| SHA512 | 47b13aaca5826897201d0836736cec15173c58dbfebc368562bd45fa35c741a8ca3e062d93df6a195a351a2f2ce6f8f51328246ce65804d1c9e8bfd97845a5b7 |
memory/4284-104-0x0000000000FF0000-0x00000000012F5000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
memory/4284-113-0x0000000000FF0000-0x00000000012F5000-memory.dmp
memory/4284-116-0x0000000000FF0000-0x00000000012F5000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | df0b788a08d8a1b45579c7f4cf33726e |
| SHA1 | 94930349f4633d28c741cea7d6f9d4e277f1c0b1 |
| SHA256 | cc326a6719065105b66a30cd38de62f5df5a6606555356b88528775c7302a1c4 |
| SHA512 | da95e2037b2455cf2aa14959637ea6443a420d9a3336f3de846f98d207c04180cc1e4eb58272cbbc273d6af596e24bc39da10cdf86e538f5431877f6b8e6b94a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | df197015f8188f0b37cf57738f486b7a |
| SHA1 | 759ca90b69c1f96a9de34262bf5f45db69ed4e05 |
| SHA256 | a648a22473bd2eed05f98c08e14cf813c228911c6fe5e993a631ce6fc0f07c36 |
| SHA512 | 795869217d83e7015c0cef0b347accc01a2d94868405ecaaf10703934461f34071838456dcba77c1b4d82ed95a708e6572624cbc21ef6cb633b63b1a67bc516b |
memory/4284-139-0x0000000006550000-0x00000000067FE000-memory.dmp
memory/4284-166-0x0000000000FF1000-0x0000000001044000-memory.dmp
memory/4284-165-0x0000000000FF0000-0x00000000012F5000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 3cecb123512a74392ea67d69fa66133e |
| SHA1 | 88f4a2f2b4accdf984811ce768e9117aa3534465 |
| SHA256 | 58e5f83190822a6ca762ec97961cc156d5db528c4a557c52c757f16e33312898 |
| SHA512 | 9ee218c427cf8fa5575c7765d365b41a3b6d6f48732cd872028e1b39c1e3c9924ce759418e9c4a555029fd62df4f2f263818f6256820ac01595f2ded71098083 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 47a2d3f383a60772e04f85a8549c8825 |
| SHA1 | 1cafee2a7155d8d53a3bc8fac6a9f6a4e1199af0 |
| SHA256 | 1aba905f2582af196d190af9aa74b19ebf4d2cfde026bbfba6f264318435bbc3 |
| SHA512 | 5e90074bcae44d278c9fd29d9c31703c01f2e8ac997834cbc9efadf125f1bb332feb186897ed63e0bec865a1f889cee19189fe0b17b69f29e3b6770c45496d49 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f586.TMP
| MD5 | b53d52bbbe39b03086bf56fe6336475c |
| SHA1 | 4d1e5547dfb262ee70caccb1a767a43f979a543c |
| SHA256 | d66bc235ec6732b008109a2d244a92ab03525032158ec0bf5b2d4968a2a97e50 |
| SHA512 | 768f541e07de2c471dc4fcc75e25c5ef133ded681785f39d7d04731bd6a5f5621dea2557a8eb4cc8ea765849cb74779e5850bbc993afc460ce171b714eee0af8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | a9a5dc92ea96a95cf564f8e460d382ae |
| SHA1 | c7c6e1a22aea737ce24d954a3327de83baddd1aa |
| SHA256 | 20cceee50798c460e1a690dd10cfe5a5378b03aa68808b603a2b4bd6cdf3b1b2 |
| SHA512 | 12d145881b62a0b3dc9d87fff1fe8a22d99de5d6b6c6e9f5de8a786876429f41df286f9570ff621a0fd7d530a07701b8db65709f100cb94a2c6d64d5eb88be30 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | f7258d89c76aa17bca7358907dea7215 |
| SHA1 | 0ca3c1199fe344da4e7d26f11b7f2be0e229dbc6 |
| SHA256 | 1745abba0378e5670369b922e921bd21daee94723309a635aa4ffbc2674da2c6 |
| SHA512 | 6dd8468bd014d0d9edb5038acab8fe15b45a1a59014451ee6100703dff5c51439dc0debc1aaf279f436d44fae967ca949e8c9328b371a235fbf7c9b1f82dff27 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 05592d6b429a6209d372dba7629ce97c |
| SHA1 | b4d45e956e3ec9651d4e1e045b887c7ccbdde326 |
| SHA256 | 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd |
| SHA512 | caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa |