Malware Analysis Report

2024-09-23 03:50

Sample ID 240526-j1qvdsca5w
Target 0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4
SHA256 0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4
Tags
gh0strat metasploit purplefox backdoor discovery evasion persistence rat rootkit spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4

Threat Level: Known bad

The file 0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4 was found to be: Known bad.

Malicious Activity Summary

gh0strat metasploit purplefox backdoor discovery evasion persistence rat rootkit spyware stealer trojan upx

Gh0st RAT payload

Detect PurpleFox Rootkit

MetaSploit

PurpleFox

Gh0strat

Sets service image path in registry

Drops file in Drivers directory

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

UPX packed file

Enumerates connected drives

Checks installed software on the system

Checks whether UAC is enabled

Checks system information in the registry

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

System policy modification

Modifies registry class

Suspicious behavior: LoadsDriver

Enumerates system info in registry

Runs ping.exe

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-26 08:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 08:08

Reported

2024-05-26 08:10

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

MetaSploit

trojan backdoor metasploit

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3252 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3252 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3252 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 4120 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1204 wrote to memory of 5112 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1204 wrote to memory of 5112 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1204 wrote to memory of 5112 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3252 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 3252 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 3252 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 3712 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3712 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3712 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3172 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 3172 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 3172 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 3644 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3644 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3644 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4348 wrote to memory of 1236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 4348 wrote to memory of 1236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 4348 wrote to memory of 1236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1236 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1236 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1236 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1800 wrote to memory of 1204 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1800 wrote to memory of 1204 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1800 wrote to memory of 1204 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 4348 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4348 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 4852 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 4852 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 732 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 732 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 732 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4048 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe

"C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe

C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe

"C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe" Admin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffba1746f8,0x7fffba174708,0x7fffba174718

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=1988,8660916068305519540,12276738231274377254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
CN 1.15.12.73:4567 tcp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 arc.srv.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/4120-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4120-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4120-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4120-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1204-13-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1204-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1204-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1204-20-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5112-24-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe

MD5 a6277a4dd6da17e31eebb8c702e86d6b
SHA1 c93a52e6ca0b877871049174569dd5568d93d341
SHA256 f771efee7b5ea61757ce49e53fb7e0ba4623b45df099a472b48dc3e1a0a9d6cb
SHA512 fc07116a531be4b8d6599c90301fd2c16768c518a23b9d6d27a9c2335f66811253811daa831032f81bcddef18c384341d538d411bb92a9834de484eff02348a2

memory/5112-30-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5112-34-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1204-29-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5112-35-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3172-36-0x0000000000990000-0x0000000000991000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 bac68825468087126b1bf35caa76fcf7
SHA1 6be32677a936a103c8bfc52b7b9dd6e90dc511a9
SHA256 76522a8224923099ecbe474d7153b9fc163493e301531f3167076c124b9ad3ad
SHA512 d3ae905feefae88cd5633859102f7d40a54f3a9906fc440e7d680fc63284d1cf04b7cd51f5da3b0d490f74f0d0903d4dd03289a6b3eb1ee7b4b450c122d565dc

memory/3172-83-0x0000000000990000-0x0000000000991000-memory.dmp

memory/3172-84-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/3644-88-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/3644-96-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 038252e4dffb608e23bb9f52b05f136e
SHA1 382104f4f2d1e9cedc22c5573365c77830088c50
SHA256 ecd6e2f172bfdd8ef667b716c21fc00be76254191f83f017ccd08282107415ad
SHA512 420b9ac55b8b6bc9b883e76b9a1a457560ac224c44140f7796de81f393dcc1aa1ced5f6e5d7a37965e3ee654afd12caa6e7b5f2707fb9d85fee8b2c7c67442b4

memory/3644-101-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

C:\Windows\system32\drivers\etc\hosts

MD5 03450e8ddb20859f242195450c19b8f1
SHA1 9698f8caf67c8853e14c8bf4933949f458c3044a
SHA256 1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b
SHA512 87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b

\??\pipe\LOCAL\crashpad_4048_RWHAANCXWPODRIID

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3516-143-0x00007FFFD6EF0000-0x00007FFFD6EF1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b25c247aa02b313578965a2ded07ebed
SHA1 3d851c586600c38d0478b8216977a548b9bae9c7
SHA256 c0902a7b46d955450b7015069d646191deb7b0a373ee76c3c45a15d50c9fa76f
SHA512 6613e6bbc475ab93f7cadf7a28a48da42823562a126a2ebe54661777656b59ef6551ab9643f3f3329e33fe4171ab545be4c83356fc649cbcf22ee83d0c578357

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ec4c8d976fbbd07b5441a21dcd719254
SHA1 124c0f42f37742905ba171557f56aec228c245f4
SHA256 44ef04bb647d67327989df62861935839781a1db08403c8985c037ce037aae88
SHA512 d9fa791812f99118ce6c229ce367de1632ca396b1201116212fd6cf5768ec8e597b9607ed0c3d93d38254e3f7ee30459b218543e6185f94f853b81fb3a320bfe

memory/3516-220-0x000001B120960000-0x000001B12098B000-memory.dmp

memory/4688-221-0x0000017F2E3D0000-0x0000017F2E3FB000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a3fe21e3224b304303b1ee453df24902
SHA1 0ebae7805fbe44f55e85ef04f1add073bf704b5e
SHA256 8f85da3f19849c4ac59727f4aef7b7957a5ee8dd96c2391be9c862f0466b7194
SHA512 bb67819a61ca4a8b26ec0505d929d7b16bd8056e439d50dec870e67d0b32a3b96ce083a7c93743010f161ca5ea47b2f794c403973f0376f19ca6f220e3dbb277

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 08:08

Reported

2024-05-26 08:10

Platform

win7-20240419-en

Max time kernel

150s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

MetaSploit

trojan backdoor metasploit

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80512a1644afda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422872785" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c2a20c56d9f53ec5f29db1113d698332ab58516215a78a08e92db20c4d2e7b9d000000000e8000000002000020000000a72b8332b1c8c1f3fcd9bd195528b6e75cb10a69187b77af22397d4e012a5fc620000000eafbb69f2803702b1e9cf9f6c9c96b36b8e77c04aa1023a511b2d6ec7f0dd35e400000004ad14b08ec249a303d7986026ec6f72452ed657b2cc6ecea18d1f6d81bb99c891e0fc6f86953d535fd34ffaf91b66839d31472777e450396df3e7e1dc8971e70 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28742BE1-1B37-11EF-90CD-4A18CE615B84} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a9f28da54c76525989762f08522779a6b2284435f2f4f4703487c7d6bcef4a2a000000000e8000000002000020000000e47fee30bac7e5d697c6083c2c4f7b0a4534e0fde3df84a3603dad0aec52f68890000000e3c32d58154977650001a93eb29c34a6d42d4d11e4420ce26ccc7b0da532d877f04eba0c729ebcdbc1eb56b454f90d5a0a2a097b89c4432e3b55a8a8a146dd1713657722e0eff103dc5de444b1c220740ec89cb140420dd5e6f8fa0ba4daea37d8c38ffb4b87ce1b4290a5148dbe30dd0295ba615cd28af55d3ab28b30964e21f3b715ddab04c65bc1cdfcb9388b183640000000a6ee8a2afe30c4bd1e3d437fbc89f0fac411261aaab91713ab1e4f25f26e780f789ddbdbd36715fd97f0cb5c1b1f64102deb8790662a9d980fd81d3775479827 C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1992 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1992 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1992 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1992 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1992 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1992 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1992 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2204 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 1992 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 1992 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 1992 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 3004 wrote to memory of 3056 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3004 wrote to memory of 3056 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3004 wrote to memory of 3056 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3004 wrote to memory of 3056 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3004 wrote to memory of 3056 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3004 wrote to memory of 3056 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3004 wrote to memory of 3056 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2708 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2708 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2708 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2708 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2608 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 2608 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 2608 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 2608 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe
PID 2728 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2728 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2728 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2728 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 844 wrote to memory of 2580 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 844 wrote to memory of 2580 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 844 wrote to memory of 2580 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 844 wrote to memory of 2580 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe

"C:\Users\Admin\AppData\Local\Temp\0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe

C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe

"C:\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe" Admin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:844 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
CN 1.15.12.73:4567 tcp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
HK 103.133.93.52:80 www.178stu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/2204-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2204-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2204-12-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3004-18-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2204-19-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\HD_0dd6d189ab0a47cbfcef1d09283bbf52cb71029cb079ada2f1c52227d22a80f4.exe

MD5 a6277a4dd6da17e31eebb8c702e86d6b
SHA1 c93a52e6ca0b877871049174569dd5568d93d341
SHA256 f771efee7b5ea61757ce49e53fb7e0ba4623b45df099a472b48dc3e1a0a9d6cb
SHA512 fc07116a531be4b8d6599c90301fd2c16768c518a23b9d6d27a9c2335f66811253811daa831032f81bcddef18c384341d538d411bb92a9834de484eff02348a2

memory/3004-36-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3056-41-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2608-38-0x0000000000220000-0x0000000000221000-memory.dmp

memory/3056-37-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 bac68825468087126b1bf35caa76fcf7
SHA1 6be32677a936a103c8bfc52b7b9dd6e90dc511a9
SHA256 76522a8224923099ecbe474d7153b9fc163493e301531f3167076c124b9ad3ad
SHA512 d3ae905feefae88cd5633859102f7d40a54f3a9906fc440e7d680fc63284d1cf04b7cd51f5da3b0d490f74f0d0903d4dd03289a6b3eb1ee7b4b450c122d565dc

memory/3056-76-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2608-80-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2608-81-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2728-85-0x0000000000400000-0x00000000005E5000-memory.dmp

memory/2728-87-0x0000000000400000-0x00000000005E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabFBDF.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\TarFC30.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f06e7c7abb3f6aa39643bff5cf0681f0
SHA1 2dda78978e4a620e9ad54b5fc8959d91de10b848
SHA256 3853c7676909efdbd711465311c010bcda4b1145e22ccf52991abfa5145842a9
SHA512 b2762a70e5f28efa3df0a826b2c199da49921ac93831a892bdfb05ad5101dc5e89f1dd97538afcdae3cc0eaa312554c41c18e540e62b6f26e302f8487f7d6a36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a49e00d23b3986b2cec6f897c3f4938f
SHA1 81d9130e378258f9a32e49d6abd4865f2de7c9c6
SHA256 468c2b8e260fb7a60903e12e9b89d1d7d57baa952051d74a63fe0a010edee90c
SHA512 fb672ec713a472d294e69815ea29619ff5d358f47ba3c361b26feec835d5258803dbf6499d5720883cc0f175b35e4ecc15856db9134434fdb35c79c556caa816

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cb9dcd49b42e48d6579cae3007aa41fa
SHA1 a14f5ed4c7ee71593c6a946a4dc40d1a1ea19d5c
SHA256 91ae8e5d910045eaa918b176aaf2e48049cde922c4ffa3c15a3d238cea5db6e6
SHA512 e466c5432e47516dcc6e631d57ef41856dbe32bc800dad5e44fcbf3db28c4f89b35d79465a1f5e8c287243c1aeae95f256c9240e822c455074c20836658ca417

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 282e717800d46ca8e4ee2dc313115dc5
SHA1 21b9d8ba821a7260f623e5c3915ecd56cad5b2d7
SHA256 b5ccc4f26173cfacaa814d7a7f5e5e1f9ddfbfe7d4ae8def3670439ab4f0303d
SHA512 9ec0c7c0aa3a87274c6713a97789405db1fe7feed80d11fa7a34e3791bcc190b21d4a1e19f3ad8f52e356795b1239aa65e8b3f614c65d988d16737c2d11c7d64

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57e92bf81456e0eb024de912dcd11d7e
SHA1 7bb1cc310ea9b591a3b4c366b99f5ab2ddc3538c
SHA256 e7604294714fb7713849339ae114218d8a72abce2f5e980eac828aefe55b9ca4
SHA512 7b540ed0a64ea695661fd191006ddcc93085e2746d66a2e14ef9cb17c821f9317a1a64a99c74763b9834fde91253bc47c49b42b5771a04c4375b5f0128fa3f9b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8c0be7e50abf4626402fc4fc40c67cf1
SHA1 917fcca0ae01be1b3a42e59920c8f25f435bc61e
SHA256 88efa9738b19508460681eee5584914bfee4739b545d0132bf0f5ba78bdc8c0c
SHA512 eb0948289c9b802eed555fa3b2ec391a775ec6b960366d7baacf282ce2d04cfab93f7f3c43b03f3f36aaa9fec667403e6e3736ade91428f439e21d6b1e774276

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 223390bd122fb0557bc3eeac2c490ea9
SHA1 384b03b3b0e43b1b38fe98789dfaa6b4a92eb73c
SHA256 f8bfa2ad17210f5f2ac988742143200616da436ac74b2bbadd7d592fc06b50fd
SHA512 0771bddb6f73d57a5ffe0d32598f24adbc44c2eede80011c309e01e0b0338933743693c4d1a2a6db2f1aa2187520f3bd151d8e8f2047424527e21072a6a63059

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8db45b2e0544ca80e7445492eb6cad83
SHA1 9a748f8ae5909b22520e75bed30ef25dc47c68d6
SHA256 9b2ca98204e4d6cbcd16d814a10ef09211c71264c73e0c3e23d5f2476ea1fb85
SHA512 c36f186d14579034bfd2c97dd7b691007d310ad42ba3088fd7099932c3f9671ba42fdf2226472435fe99549d8447ab4743b970e16b9b39a4bb3bdee9024605d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 07c1c846b416ef1ebfba2c28d948b0d2
SHA1 5f2a014086acfdfa2a3369031697aa3d4cb27365
SHA256 31f3279caa54dc7558f71de02f0680e13c4628c2198536a181d8ea6caa39c2eb
SHA512 fe072a0c5897cdcea9b5bfd734d6d88525db1a80635c23d1ce107dec30b3a10765c00f5995d850ada74ca153fe7c90ab46056711538ca458e57f2d5f304878ff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77a1029294511e7ddab7b30c44075ce9
SHA1 5359e79d1f5c27d17db8789778743a82b0add90f
SHA256 4af0cd9488e0751ce3790f1ba6392fbfa2fbf1beda938d72430d4054161b87f8
SHA512 84fa72e72d99439bc1aa61d420a581e11f0dbc07ad58def9c7edb6ec739e7533d1170697fe2538d1f0ba914fab33fa6e454da8d665a472376eb69a58c8b261d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1c9cc76d1e75dcafb63ba8601b2eecc2
SHA1 dc2dd152653af20f8d169213aa4f5fd709bf2161
SHA256 7c3871346324af2eafb28753100476aba427c1e06d98ef4f3abd8e9853ff2dbb
SHA512 3c32b2355c9b9015c840754c77b2ff3c8493116cdf3c875ffc842dcec96e25430745f612f2a90c59870666f09ac41af8e9466cb7b5cf47095de71760da2f040c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 62681fe023010ea90c58da09d52733be
SHA1 ff0fc140b14fa8247eaf4a3949f256ad03340074
SHA256 b2f4c9a4e23bbc02574f00a85afe34fa8d18c11bfd7e0441f12ef85d8991babc
SHA512 e7acf857c001ab47d21472a70e521347cf803438cd3cab7e0c3f15fb0ac6c6f914cc6b263aaa525b8ff576f193f4ebd4d81510842b8b7cf01f5d4c9737b07960

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c95c009d5689f917222fa1a8fc45bfef
SHA1 786c113e46e02006b7b12c07808affd30921f4a5
SHA256 82284a331b5bb60c022c1b7f14451873029dc6c063b381e3d6b62d62fa92ce9a
SHA512 3293c17277f8df9b23923fc485d6ef9e74f96c886e3ee00bd7621255cbea2eff4ea8c1b05fe803a33207a451e0d3fdf41351405602511df61861895254e8e121

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b646be15055a48cadc47373d9a9d857d
SHA1 7f2b4e065c6d8969204be27f069554d9f7434e16
SHA256 a3d53898f13cecfb3c894cd7e8888f9acf8f2b51e7b0bed12ff12992bce05315
SHA512 2eb563f83c40a7f11ed6494440dc13b92762bbaaceea88d698e58db1c97269eb3129bc4751f539eb5361b2990bcab38272d9abe234478642a8710c71b7665b59

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 99c930044c0871ba803a01a454632dab
SHA1 9883d9e77821189b078e59d27fc35b26a5542270
SHA256 38b39946109dc71cfb34f35013543c0b069ae6b9c283d576446297874083aa4e
SHA512 12bc192e8ad2beeeb4882c509999ca21c8c0d712298d7d732be3d7e5bf1b16bc4fe6c514ff7235f1035af2f7e10b769ebaf23c03a2ef0d6ee9f8b55a12c7944f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a8184a75ae7415aadfa77cc840804586
SHA1 6bd53144256c584b518176140ea9458dd2be686e
SHA256 a47d0f1b7f182862041b913b8ffbb8b252d2cef3cafa1d9d09024fbac8df1e91
SHA512 8d564227b1a0754d2bd13ff8a3c98b1cdbb017ddf9c48f1e697cb093afe49b1ea289fd8342f4ab80aceacfc6f6cd5d77930ac6a3b1f26402a7748ef9b90c6005

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a2bf7d0aba8eb9f4a50d86af8a3017f
SHA1 2d4afb956e2e4fffc9671c4f7b442830b6060083
SHA256 978c9714c05c9c4c1a52b8012f330e11b66f0581a0e82621646a9c2913aae774
SHA512 553b9fc70088ae9af9aa40ff21603480be09b017f26ef89e75fcaf36807b2a80a084997fda506eb529615abd97507dfd5dd3d89e0a9ed6207b65b05cdcf41ecf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e833d4fc17cbe0fbb8eb6cd9106ad4d7
SHA1 3052af8d91e77088daaca1226202168c574db261
SHA256 8483e2142cfc2b60a13aab380ead54e78aa9774a2eb0bc76d4dd859d5a2cc742
SHA512 e9bfcaa6a7fbacd3c2ef30f748cf8f2070b1e74f20ac814ded9035717c05a7c2f7b35625b4a36a55ff7d4f886e1b835796f5098276643c4754fa1e47d163ab0f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9fd69569d6b2afc1259c912ee73af65
SHA1 26af6aa27dff66d2d345938a68dbc67fcb053100
SHA256 fb28cc7616329630add5ac284bf38ac69b3e005c2866bae5fe3ae14af756479d
SHA512 5c1346ea2667db68119a694c4bd942a014dfacf702f85658eb25c53139aa24c31f8b58c0dd44bbca95eec352e431f222219afc40c7344a487323a6b173d81715

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 720df2a37dd40936d5099bd2d3111fc9
SHA1 a8dfd0ce84e1231eb7a765a99c8014516f040072
SHA256 8c40c00b8fc09512e44ad248f77cfabf394a7495f67bf8deb17510eaa160e840
SHA512 bb58e7e71a8e284528c6d5a6efd325c27766a875b1a0710fec221a6dfa4a405c6aa75fcd453a4a389ead4d7dc94eea8a64d2e1c9272ab358381ff305e880b330

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0dbf2c81d4475d12e2955134fda231ca
SHA1 0c8501947c381b9e9326dbb1c1d2147ba1d8f816
SHA256 2458b7b83ad74d7690958dc12de9dc64e9bd61e21b77f86eb691ee1480313aae
SHA512 c67bcc6aeca16a6cdf604347a952de6f57631ae1aa37c7e0f58e37965adf2cdb1691aeca3fed17c15948be86ed08d2711c5b3f0238afda7454b92f71eeee3d80

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b53e1bedf55f773edd8959530798b4b2
SHA1 17d8412784f7cc8396f070b561c539791fdafe6c
SHA256 e42c920c75ba89fbfc09c5a025914346d9b55f58220be23dd380a8f1dd9e957c
SHA512 b28a7ad5cebb822d8dfeafcc2ea0433260e23f587b62fc38f192ea80b33a62f280c78676a39b86076fbef23ba40e8d548f8d4f2c28f89078321d6a0f3a19c3c2