Malware Analysis Report

2025-01-02 15:25

Sample ID 240524-nynz8sgc75
Target a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17
SHA256 a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17
Tags
gh0strat purplefox persistence rat rootkit trojan upx discovery evasion spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17

Threat Level: Known bad

The file a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx discovery evasion spyware stealer

Gh0strat

Detect PurpleFox Rootkit

PurpleFox

Gh0st RAT payload

Sets DLL path for service in the registry

Drops file in Drivers directory

Sets service image path in registry

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

UPX packed file

Reads user/profile data of web browsers

Checks whether UAC is enabled

Checks installed software on the system

Checks system information in the registry

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Program crash

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Suspicious behavior: LoadsDriver

Enumerates system info in registry

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-24 11:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-24 11:48

Reported

2024-05-24 11:51

Platform

win7-20240221-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File created C:\Windows\SysWOW64\259400116.txt C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002222071f0975184cba7bea5df9f84fb4000000000200000000001066000000010000200000008b4f21a539a2ff9abf1071ea599210f90e9114bc6cc4150bffa09e3d5ba4bbb1000000000e8000000002000020000000fd8e5dcd003104b547dc5059b16aae9b24492e6c99a5e680b06b95b88ce1448f20000000ac97d25fcc00cd4e5f0730e6224e876a98b7b80e87b9c6ab945887907b8d34eb400000000296d7c3373cc7118e612fe87fb45c998b82ef5bde149fff24d0f4dd2990c467a63ebb63cbf0772fdbbd1e59421c54318d786335fa664c58953cbc573b4ac85e C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d7be6cd0adda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002222071f0975184cba7bea5df9f84fb400000000020000000000106600000001000020000000051bf3eb90b21d8283fd552e1808a1585e0e4ae5fa9adb42b4773e6fb4513ef7000000000e8000000002000020000000c5d0afcbf85c58326b40db397abb8eaa3e28678662714bf2c5f45633e53023eb9000000030bbb1f91fbbcaef327f876981883c848f53667b0bdcaf01d3dd88f9d81184bb58fee909bee2a060d9eb8ce170fb658a601b5942cbe5a42d1b19773055ab57c9488a728174cd4b5536157c3645108d266aa521089299906685648b07ca585f0de253a5b05db0d986aa083814bc1c98d1e1a3f14dcc59bd0235211b09cd3b5f6093eda8ccee0c23c263162aba4aa07b6040000000b21f05ab573ebe191180a1342f84def1c955a84118dac23bf342563c7deee3e48a08ac2f9b3e50bcd9fcf428501a8b85c2f75224eaee36e9bde9f910a788b64e C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9247F081-19C3-11EF-B1CF-5A791E92BC44} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422713192" C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2156 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1428 wrote to memory of 2276 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1428 wrote to memory of 2276 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1428 wrote to memory of 2276 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1428 wrote to memory of 2276 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1428 wrote to memory of 2276 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1428 wrote to memory of 2276 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1428 wrote to memory of 2276 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1264 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1264 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1264 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1264 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 2156 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 2156 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 2156 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1856 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1856 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1856 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1856 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2156 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe
PID 2156 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe
PID 2156 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe
PID 2156 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe
PID 3004 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3004 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3004 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2936 wrote to memory of 1776 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2936 wrote to memory of 1776 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2936 wrote to memory of 1776 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2936 wrote to memory of 1776 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe

"C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe

C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://pc.weixin.qq.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 pc.weixin.qq.com udp
US 8.8.8.8:53 pc.weixin.qq.com udp
HK 43.155.124.49:80 pc.weixin.qq.com tcp
HK 43.155.124.49:80 pc.weixin.qq.com tcp
HK 43.155.124.49:443 pc.weixin.qq.com tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
GB 163.181.57.163:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 res.wx.qq.com udp
NL 43.152.42.192:443 res.wx.qq.com tcp
NL 43.152.42.192:443 res.wx.qq.com tcp
NL 43.152.42.192:443 res.wx.qq.com tcp
NL 43.152.42.192:443 res.wx.qq.com tcp
NL 43.152.42.192:443 res.wx.qq.com tcp
GB 163.181.57.163:80 ocsp.digicert.cn tcp
GB 163.181.57.163:80 ocsp.digicert.cn tcp
GB 163.181.57.163:80 ocsp.digicert.cn tcp
GB 163.181.57.163:80 ocsp.digicert.cn tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

memory/1264-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1264-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1264-12-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1264-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1428-18-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe

MD5 776fdc0e7331d3d16a6e2eeb956a52b8
SHA1 1960568f4f7d47966e9ce5e3d6fd646b129fe322
SHA256 caaa46d47506f6503156f4ada2543981741250468a63d54bc6a937818372f9c4
SHA512 e53e244770c249622968133b8b217c5084d8cd55dba2a047dd1317deef080c04afa96ee2c51a8cf77ea9449e5d0d322e043ab88773c42c3677f9ed1db1557b8a

\Windows\SysWOW64\259400116.txt

MD5 5c3c9239fde3e24b070a9dab0e6b747e
SHA1 165ec44205f71bc511a23330301197b4b82fc4bc
SHA256 2d1a68a7766554bd52ce72582284c4a25f4edec938dafb205633aa0e29d85309
SHA512 d1f6dc7f7d99e465c27d012e5a729b19c690756c370eddb26d686a0bfbb12b850471ed2fd9fa9950579d92ee2a7365de48bb2a43af2a7a880f037eb4e207d52b

memory/2276-37-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2276-33-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1428-32-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchos.exe

MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

memory/2276-30-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 87919ebacea9637066993702ef5a6f3e
SHA1 b2c951370953b765d387921748d3b6d00f6fbe37
SHA256 39ec600754399afb01ffa56cf8fe5d4d994becb64913d9671b267156e66b48f6
SHA512 c64b9ea3ff7be3888ce4ec41d0805cc334d2d13bc27a4cd0826f4cd5585a68ba4767a3786ca9dece12bab00a3efb389dd026d4e71b7675ee128c54263d9a7358

memory/2276-80-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_9B8670363F58B4643EB28A4A03EE9887

MD5 426e4b161c1c9804680b00a25028a6cc
SHA1 d99f9c1c4b8610d07bc49869a9bc831bc68f3c90
SHA256 38463a02f842f634b4d4308447bb25865cab3b7d2c5b77fb245d0b2dd6ea9cb9
SHA512 2b0ca2842397d1a27b8b432598353b9e706957d8b906f5a5436945e89bf5516fa80aef3862155cee5856c9b6c1d0d93cce7943cf4b75f0304990fe0cc6febd63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e6ec92920c9b8d5f2d582b0a1b14b3ea
SHA1 b549f6a470a79aa6497a95c9f5b4895f8623d50b
SHA256 8528f9df92a2949e8d5c7e8310382486c72125471e896466861850b67f57f141
SHA512 406a12270fc35a0bb3e4a84dc016021ec1c0422c21a20085600593004a59fba3ff933478ece690aaa3a0e11591eea0cddb2acf21b20ae1e92cf602cdb307e5cc

C:\Users\Admin\AppData\Local\Temp\Cab77B1.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar77B3.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar78E4.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c1a1a05f03dfcd2816813c3a937bc31b
SHA1 704bb98d35dcc0c719d0f2d8c61e6ea1283e4829
SHA256 9e84805e3337fae5aedbe1e8202d07ea20338d74d91c7e659223331db946d1de
SHA512 4b72570ae52bec9bc808bac6783dfc644bb7e1f5a2376357241c7a943371d21d04cd1d2278fd75d791dcbb1311c8279d7e0b4547476ab56163fbe36c1695287c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a4f8f62502b2bdc1a21450683f0d1343
SHA1 47a3a0dac28fe4f38fed3a5d9be5cf51796202ce
SHA256 adb3f9b36f1a2c7a85b3c6ec8c0605a3d1c69a358e2602ffff55cf7771511443
SHA512 bfb41817b2c22e48ffd09e69e3fb43dd16c197e54d0ca86a0f77e46b2348b3d3176c824c8566316e718c569805f3c523c24d8074158806133a48c6bc8b630bee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 001c458205000f9f7996a57204dd5d5a
SHA1 75a7d852312ceecbec6be90d48d09938d2c5482c
SHA256 1e7ab74ad4bf2f3e353d7ece5aba112840bce77bb4af6ed1aba9240b2e940abb
SHA512 bcf68863194c8b285b92f01b0a2f56e478f52584afe031183584b3a2347ecbe4a78af894cf9ad056abcee742ea78c99728b566caeac014d955e8eaa25a106894

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a4179c08b2f38e8048fb9dafcf41edb6
SHA1 ba6ea1e5ddb725a747c100770f515f0f2a6903fe
SHA256 2763ea2836aa4f5669b32d42be09bdbfc90783414c68159ea40f4fbbd317afc1
SHA512 504e526da371667f455897f4a9fb6f006e4666e2cdbfc5f4ccf6ab1a37e7d79261687352158e77228b089fb0e92ce1899ece695490996e95c3928ad597f7ea60

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f50fc110216a169fa2614590d5a9aaa5
SHA1 d6a3e4284fd839d83f22df733cf513d06c53df7d
SHA256 caa36d41dadee0fabf3950bebbd6c1734a63a3f2167a6cbf24361b45cbe34baf
SHA512 66bda12c9ddc58fe9d84c470cd5bb82d648faed97195ee98b53b29f34c055820c825785a30fc44f4f94ac2ae426bd8081c423223a8bc186c569995720da73b2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab6e990aad8ba81a7226c115f808d421
SHA1 973029b450e65a808a5f7addb4cd2a0b21c42dce
SHA256 b14da32852f8fcc693eed99e3a3dba90b4dfc1dfeabd1eb8ba7e9c6c8b31e51a
SHA512 c3fc4684bfc3398f6cc91e065d2d07997800990766dea486be5d4c84e671bf81dfd008c5871c2ce49fa283332c897572d156bb2034480e5b0b0e67922683e55c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ddf68a7d33ba5ab930bf99063750d34
SHA1 43b640cd6c5268a232839874a11965f82cc2d36d
SHA256 33b487294c3194bcdf92bc73db0d06f58c768990566c32958a0bafb73b578494
SHA512 828c600fd561fbcb36b98801b584d76fc8e1cb39402dc3382dee53b49101e99cc23a95e6519db5b4614b282e593e35a22262368be507f16085bcdc3f0ba93013

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3fa9638b6022e89bd0d2d54fcf8104e9
SHA1 ed2d3f0fe3f200b83c74c3769ea7a7e4fd70e5ff
SHA256 37b0417b8af76534c52436a82bcb5e3cf1a431a5ab5f8ddc50a67077a89f06ed
SHA512 f69989207bbbd9a2e366caf2590a7e3f73bdf628b707d48c0c6769b941f8b7052d22404eeb9b043149d5aec672ba75aab3c043b39cfb9cc19fde386dd348c16a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b6e46af59a5997cd6d7e72df3b8a0676
SHA1 3c508efab9783b19ad3d96311c4f3cf0b54985f5
SHA256 2bb0f3e508189ac85eb1f55a04e9c59c8adcf79bd3a7ec193b6963c32d29eb36
SHA512 52f59a4c0890479f9f9cc45c30ce31457ef4ee82fb2ed711b027195ba1b3e8ecc4c59db75b2c6ab03ad4e7b313e2467d4187aff6235288793120fc1762461583

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 df534eb2366a7405b465394d7bdb9475
SHA1 899f758ab692600417caadb07c50fbd6bb236740
SHA256 18913cde051da01ea6ca5806400dbc2851cb59e2e31f32fb9158d4638a5df2ec
SHA512 4b6e9d05ad42822516e03b18a9c873a2d51469fda25f4693c924861c44632f56240436ac881845b8607fe9edc545ccf5820e0756c55bb4545407f11aa69213be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 e2e8ca22fc46359192acc4230dfcab20
SHA1 e6cbc71b301f581a208596c5956191b5edd93a5f
SHA256 3615211f0b6ba7ba002aa079fed50c4277fd4cc46e33b8ea0f089cb9986bd09e
SHA512 b9d6b9b1a2b7a7a6eaf913f68da6a219774feb03483cb8560b81d24e3934d413b293630dc34cc695a64347fbb3cf8707cfeb6e500be8aa82b49da5864d151aad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dfcd126e0db01f781bbe5ce33249dfc0
SHA1 34d70cfb12ae3fa1fc0def70a46f13b875247ff8
SHA256 4fb692635095f4289d58256dcc93e9d551206ac37da75c69077fafd6af7ff219
SHA512 2a995539a94b8ddaa7a8fabff94bc31c33ab85c22348fbb0cfa6e18b6013c4cf943771d72bf3d395dd0823cb4bef918e7b5c802cb63cb28945caa75f3ecb6a20

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d03f8bb8575855c2d1518c4e56439809
SHA1 074ed34306c5b8b3789278a2d5290d838f4f97a3
SHA256 0dcf08f7169d1c57e7f19f859d70b52811420cdf82ab5350b1bc393238fe0096
SHA512 eb61a0d51d4d44b1da7f877b6499f38ce2d823f5866c16419c096c99a0cd958eaed7a5e2986551515b6e088b7d3b6d867cae8ac19e0766dbdf31027a4620c09b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f7a04821ea31ca78ef5bd62e5975d270
SHA1 a19ea8a6594359163cab4b8fa2474fb16b1e2a3e
SHA256 bdf4a3acb94f85fc0afbb2c911346d816c71629c1163a3cbc1223fccc434d29c
SHA512 ab07670df18f918d842b6554ea8480c6e3f7d8fc17baf034debf2d2650170df60ee361e706b0b37c035bb320ce209251d2ce18f5f1b921c74fa69b2e73170711

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 399859a196d6fc8e9115d79cf6f3464b
SHA1 65f141b20ca814a257e9e1c27af423031f4796f1
SHA256 a636ad692e651a99281c83bb3b41c10c3295468d74440b21f97db83358eb454c
SHA512 8102db2be75d1c93633354cc3a9b8a1c320ce51cdc4d40f75e93b7a8f8ed6c67d93f18e92fee373d9fc77f7e7c4d173ba7a2f2c28fcc6a43400b04d0cf1d80fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 833f3db769611a0874ad9d87166a7f75
SHA1 3203a7530d2c64c382313a91087cacd217f76679
SHA256 c13d32d8e8d44f395a2994fef6f21f043f46d8777fc04fbb7d544fb692b78f13
SHA512 67a62b2e58ac7f3a0377d06d3ce2ab42fd5b582a7561c2aed5b31a81ab8892e6e1a79172386aa0ca9d9657f362de0544b15987b2e8f2dabf09a0a961e53d41f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c6a850ec546d79b6fd01c56f9eeadff3
SHA1 1ec54ac6eb79664c8bb5f2f231faa62a0e20796c
SHA256 96dae23838147ad9554009c0321fe5cdfefb35e30cc15861112bb58d6ade9fb9
SHA512 3ee5c809b3f78b64cb27f4fbd26bf6ac9dcacc704454a14ed4c1539f9da068e9423987bb0488ef998bb18784523df66e21f280066a5c964ce57e889b9fbecee3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 696b580905da16f6722df8a2b4caabe4
SHA1 1ed0a0759de1263e56e6aeb1332a8e9c0ea458ef
SHA256 9721742b70df0003defa34600b688fc3131fff6ab245877ee59127e42cfe6d7b
SHA512 094b59aedb837e08452be673a0fb13d5ea4c03fb8a6371096701e6cdaa8b4a019d7f0b11e81e5965fba8b610c6c21bac06934ed0cb9c3b3570bcccb03ce092a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d3e458408d4c61bae4c0d4c104cc6d03
SHA1 0f430a67723b307552a80fad55d6c94d096dcf31
SHA256 695eb7bea548e91eafeaf12ba6248c24dacf917b86f95b4b377deabe59520b03
SHA512 2403404e65412376014ef73f3ddb71e0a4c758168bd1d83e656d13c0cad45713d628ecb09ec4d7783f4a8fb57112c020ceda7976d7a32746be6096ebbe265b8b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 703ed01921364a7371146346b3e7dd25
SHA1 463f9281311ade159128888178f8a721a9d4c55a
SHA256 e0be96a9ae0726f47b880c8bf6fefd33bafd9b73a52c7c3af0be9d187a14fe40
SHA512 5194b0144084d5956483a2cdadf34f0d9c66955fc1a556bc842e0b0456751429aaaf63404d0f042468ca508184b81a1147de084c23696a4cd6f1107c6ff2b41e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 10cb3d9ed487f5e48345da9a8b1152b3
SHA1 05631db795cdc40e6f9f1cf2ccc06833d2d4b4fb
SHA256 be659679a9d0c28f21dbf4bfde86ccedff7f497d5c1478b689227ebf9d27106a
SHA512 759532da168f6bb5ced3c80522ac84dd1766f033184f43bafcbacd3c3761f339cd2e0cbdc0e41dfeb792bfcea09dbe78fe891116f526b185af839e342f5b2409

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-24 11:48

Reported

2024-05-24 11:51

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240611281.txt" C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File created C:\Windows\SysWOW64\240603953.txt C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File created C:\Windows\SysWOW64\240611281.txt C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1176 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1176 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1176 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2028 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1176 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1176 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1176 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1440 wrote to memory of 4828 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1440 wrote to memory of 4828 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1440 wrote to memory of 4828 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 636 wrote to memory of 3460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 636 wrote to memory of 3460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 636 wrote to memory of 3460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1176 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe
PID 1176 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe
PID 1428 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1428 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1428 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 5000 wrote to memory of 1964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 5000 wrote to memory of 1964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1964 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1964 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1964 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 5000 wrote to memory of 1604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 5000 wrote to memory of 1604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 5000 wrote to memory of 1604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 3100 wrote to memory of 2672 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3100 wrote to memory of 2672 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3100 wrote to memory of 2672 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 5000 wrote to memory of 2256 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 5000 wrote to memory of 2256 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2256 wrote to memory of 2564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe

"C:\Users\Admin\AppData\Local\Temp\a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3712 -ip 3712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 456

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe

C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ff96db446f8,0x7ff96db44708,0x7ff96db44718

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240611281.txt",MainThread

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2052,14175924189067975913,2030853680749913002,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
NL 23.62.61.123:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 123.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

memory/2028-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2028-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2028-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2028-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1440-13-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1440-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1440-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1440-16-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchos.exe

MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

memory/1440-26-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Windows\SysWOW64\240603953.txt

MD5 5c3c9239fde3e24b070a9dab0e6b747e
SHA1 165ec44205f71bc511a23330301197b4b82fc4bc
SHA256 2d1a68a7766554bd52ce72582284c4a25f4edec938dafb205633aa0e29d85309
SHA512 d1f6dc7f7d99e465c27d012e5a729b19c690756c370eddb26d686a0bfbb12b850471ed2fd9fa9950579d92ee2a7365de48bb2a43af2a7a880f037eb4e207d52b

memory/4828-30-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4828-33-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4828-37-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4828-38-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_a0e16b3a0b14ec290721eb4a77b45fcb95d3ad980b8418cde67e818c8bc9ce17.exe

MD5 776fdc0e7331d3d16a6e2eeb956a52b8
SHA1 1960568f4f7d47966e9ce5e3d6fd646b129fe322
SHA256 caaa46d47506f6503156f4ada2543981741250468a63d54bc6a937818372f9c4
SHA512 e53e244770c249622968133b8b217c5084d8cd55dba2a047dd1317deef080c04afa96ee2c51a8cf77ea9449e5d0d322e043ab88773c42c3677f9ed1db1557b8a

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 87919ebacea9637066993702ef5a6f3e
SHA1 b2c951370953b765d387921748d3b6d00f6fbe37
SHA256 39ec600754399afb01ffa56cf8fe5d4d994becb64913d9671b267156e66b48f6
SHA512 c64b9ea3ff7be3888ce4ec41d0805cc334d2d13bc27a4cd0826f4cd5585a68ba4767a3786ca9dece12bab00a3efb389dd026d4e71b7675ee128c54263d9a7358

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 8e514e7e4844d662b2066712a5ca548c
SHA1 fe01c218e9ef0301b147bba2a4f33dc3e1cac7c5
SHA256 2d3e794144647da284a4831bd1d628fa7be30ee48f0021974eff9f81a264f646
SHA512 68913ae31033655d74798c616cb36ce8d11c8f6914aff6f377baa84f525f964acca9de06c648bf86228d8bd962b12d79802b06ff000d65c8fc6169dff92bc791

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

memory/2564-139-0x00007FF97C2C0000-0x00007FF97C2C1000-memory.dmp

\??\pipe\LOCAL\crashpad_2256_UCNCFMQQZBMLOEBB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7a0584bbf621f54e0fef8f5b5f2509d9
SHA1 8584db714491e0d522b03025e5caf317ce1aaab4
SHA256 968951594646254b5c432847bbe83fbb92f20312d9e698383e6e36f3f9f346eb
SHA512 81adb2f6ab86d7074e76c54897d65b5fb2526b6681fadc841195be8747338e17719aba4f7a4e958c4d369bf7c865e80e5a2917ecec81767bac9e5407ca4f132c

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 601905be03ab3fb9990da93362d821b5
SHA1 1be1ff932a4e07ee899b526e00f1d2757b7b447d
SHA256 4239b9e06dbd4cd986d7a4c1ecc4da9a927fdd3452de4383872c619a6496c9d5
SHA512 fda84587783828d4dbfaff853f8923e8fd22f2a21d30b9d5c293f0a9453ac98f4a31d5b9ec1df23702cabcece49b650333e52f60e2738f8a58cb1a0a50ab06b1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a8627f96cf9c2d1c922922185783b920
SHA1 4e08abf1c6df862f44945707ed5f005213f40770
SHA256 87ff968fff2b976159037e2973aac0978b7411563b8a5a63bba3c57f6c89f27f
SHA512 35f1fc6f3fc58ace6edeb7cb1f13a44b864a91e037988d49f5926e28817ffd41e10a8d8f8f86d528ae71455e5ad04ddb7aee8ab3bf95de7d3fe9fb18caf5a3e6

memory/2564-223-0x00000121714D0000-0x00000121714FB000-memory.dmp

memory/3528-224-0x000001D818200000-0x000001D81822B000-memory.dmp