Malware Analysis Report

2024-09-22 14:45

Sample ID 240618-hgglya1flg
Target 67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809
SHA256 67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809
Tags
gh0strat purplefox discovery persistence rat rootkit spyware stealer trojan upx evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809

Threat Level: Known bad

The file 67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox discovery persistence rat rootkit spyware stealer trojan upx evasion

Detect PurpleFox Rootkit

Gh0st RAT payload

PurpleFox

Gh0strat

Drops file in Drivers directory

Sets service image path in registry

UPX packed file

Checks computer location settings

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Checks installed software on the system

Enumerates connected drives

Checks whether UAC is enabled

Drops file in System32 directory

Checks system information in the registry

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

System policy modification

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies registry class

Modifies Internet Explorer settings

Suspicious behavior: LoadsDriver

Runs ping.exe

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-18 06:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 06:42

Reported

2024-06-18 06:44

Platform

win7-20240611-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424854847" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF61D7C1-2D3D-11EF-9266-767D26DA5D32} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a9d2097e1a53c85aebdcdaa9f8984bc739b85d21b4e84db4782a73e004dca4cd000000000e8000000002000020000000f4e4faf074cab8ce1ffcfec13ba2a717daa155527b230590b7552c6546a84662900000005222658ef931654c6d1820ac12c20705001f20cc24123c4ee96cad2ba894bb623dffc611d1069317dded99acd8bc9fbdfea17103428081ad5dbe6bf8ec347313fc4e6a43bf5baedbbdf37acf74a37f628e63797f6235cdab9e9643ef95d339236b1975de2a04f433fdcb4d4ad696cb9b46571125c5338a05135b12c5dfbb1a5be31c833455aa24ef83283e87577bf6d640000000544b09a96dc76d6abdb68a99608c66d67dd262667c31d0d0b5314106aee6acc7c505e84944cbecfd1431b169aa85ee879c159819dce543aa31fc6b50436c61dc C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000004e9493c42c8f6374d138a67b358f62b1b4e0e4c3cb2e6eaafbdc426610b41258000000000e80000000020000200000006f567044b1fc8b4631049c238ea5b7a3f403ad517f489c93ba7cada9021e6537200000001f5a78713a9468ea8165f78ef4735f79255d71f820fb1fe154814ca9c35f7a5440000000be8fcd31393cd2f3401038fa1589aacebc0108ae73887cfbcb69be5733edaef92db355c723aae9c2ce2f1056e7a8845e4c5d82696856508240f208c720e1e05e C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60bb9fed4ac1da01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2968 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2968 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2968 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2968 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2968 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2968 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2968 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1992 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2992 wrote to memory of 2728 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2728 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2728 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2728 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2728 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2728 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2728 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2968 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 2968 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 2968 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 2968 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 2360 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2360 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2360 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2360 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2760 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 2760 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 2760 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 2760 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 276 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 276 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 276 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 276 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2936 wrote to memory of 1628 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2936 wrote to memory of 1628 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2936 wrote to memory of 1628 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2936 wrote to memory of 1628 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe

"C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe

C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe

"C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe" Master

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 info.178stu.com udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 www.178stu.com udp
HK 103.133.93.52:80 www.178stu.com tcp
HK 103.133.93.52:80 www.178stu.com tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
HK 103.133.93.52:80 www.178stu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/1992-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1992-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1992-9-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1992-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2992-18-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2992-24-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2728-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2728-27-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2728-29-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2728-25-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe

MD5 11ea08cc2634959c88257350fc395168
SHA1 dd465893627ffbfa8a0823144909fcab1da3e1a8
SHA256 89e21f282afbc54a57c37726ffd524aa97887517c2e32a75107f7061095b149e
SHA512 ee665cf2db1fad781fe77e91a9d2d4ad47114cc82dce19e4e876a06c765a7220c555e6127b03370715ba68805f0a3ab3409d1a311e762cc23105ffe1cc0add30

memory/2728-30-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2728-41-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2728-42-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 ce8ac736fb7af8cf45d9cbfc9d501d3a
SHA1 5ad81c39297fcd8d9b3c4d7e3d08e67cfe37216d
SHA256 c1408d476022e1a2ec303312910ae8fee594a4697cd50b8b14d80d79bef0b5ec
SHA512 73b582049bd3e8d27b9176a734a6d305b14c14247d6de5d5a0faf45204615fdabb7efdd53ed9c79c028e9c9fd0d3e593a0e3a46b22e1737bf2776c46457b98a2

memory/2760-79-0x0000000000400000-0x000000000069F000-memory.dmp

memory/276-82-0x0000000000400000-0x000000000069F000-memory.dmp

memory/276-88-0x0000000000400000-0x000000000069F000-memory.dmp

memory/276-91-0x0000000000400000-0x000000000069F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab99F2.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar9A81.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fe7bfb25cef055c942523ad6f7c5ffea
SHA1 578e604ba1f1e0109c35a9f8a7d5b9c64765d8b3
SHA256 e490e99c6b69d188b0a2ee9743cb4e64d2836c81f96c61bb37f7a1f4bc099a74
SHA512 a83c0cdce969d3fc80f54123f3b324a4e8637607536ea399f03818428c02975d95aee65763cd043c37d7e44687e3f26e918b052236f355304aa7e659f5ecb338

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 313af646f20deeffb961fe7fa7adfa8e
SHA1 02897ac00390adab159a4315ad05d94a7fa32301
SHA256 28672a56a4059ce15d0a5e5fe2579e9f54c9407d17f659f26d907f93c34c01b7
SHA512 ab34deadab9901ffd7f9fc039887c8bc512a763d6f90afda313786b4b6ddbe7a7e296243feea5c1bd526f772e92d217d91b465e165c74be06a1dd692e35e3a9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 afd2d172ffb1a532276716852ea71d90
SHA1 fd10c36c17f8af4493ddb9bdd14a49e200e1d8c9
SHA256 cc265ecc17686c1a6e9239dea9452a5d510fab7380ca3e317c641afc35509a90
SHA512 98fdc55141d231ce3c8dd16dfdc63a953f9dbc0ace5b3969438760a93f567b7fb54492e501ddfc786abce928a265f2ca23eb34a6bcfc0a6071e4ee3949c92941

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c8bc450ea3f9d69bb91d433ec6c4e86d
SHA1 a1841c230a694b5516e8da05b3818ad599f124fc
SHA256 dffe7cc732d82e48bda52c8beafba0ba2f72ee98cd354cfc776c73cf3b83f78d
SHA512 ab793963c6118d41e6a37627d89240ff2720e168a9ebdb390c044a297e573e35cf73c29a0c480c090199d197dc03f1c46cfcc05629dd711ac469e6505ab1a6d3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ea74c689d31bd197603d1c140f0c182b
SHA1 29579d4a367321401c9f76127a430eeee08f25a1
SHA256 a3fbb56d66a2532b19bf275b1103f692d0ce479a409078a41bf6760c64046073
SHA512 565470df9002e7f423cbf4c94cb7f1a01e8d59ca8d3b9d734c75ce4d9fca571556669eb8f121ad67389d266300eef249f5cd42a279d3a752a19c5b7bd20510fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ae03593e158071f9a7cabb49e8a620d
SHA1 a4fa027d286782b1755d126528597a42eb41f959
SHA256 0647b7f29446ea5eb6049385c3fa51368bc5d58e617e5c169904ddec24383536
SHA512 2869910c5dcadcbb0f133fd74e7d618742293a917da916ff300c46a4c630c601cf8fe0a38d0602746ed42ffbd8675fba686d8a1faeb2873f1012e65d1a689a81

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a5cde69f0c89bb386f25b4d696952ca0
SHA1 c6ac118228d553d9fe2de7273083158352bfeed1
SHA256 96b430058291f21d1a1229d1244c2b50cc8defd46575135e1762c4291cb12d07
SHA512 91b91b792e4ab6ee3573da7ca70cb24f374e3957e919849e5f3da72ab3b036501c9878939cc98dd7ecd15b9af5c26b938209c09816ff9802aaac314616889ba2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 735f36b320d0fa1c89b51773b268e7c1
SHA1 0a62d40b5fdbee9bab2889eb8d906e533c6a5463
SHA256 34838c91777a9e108c39677738f89617c9fc7d6b746600a085f7e2b13722b1e2
SHA512 7fd0430e9bf249ac6d5b462ce7941cb3ccb66fe0a276dc7ad635dd49a1d97c718c175a8dab5fda50650a001436b9870ca2dcfcb5f0081c54b1b561c9f70cc15b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8fc5330ba22ca4d4dbc0d092e2bf5306
SHA1 5adba10b9a12bef49e1462d9bde7654f60748a9d
SHA256 c475820b726ced51b766bb4fc7f950535b447ac25348c51edc1dd0d9b389d929
SHA512 175600e6f1f3ac1af80df8b9fb83de0ec690fedac0764820492cb696fd94b4423d452451df77742d2e96f97dfe05c84ceaf82225916bfc48f1db8111bf72d1d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7e453c086775ae30b0393c60a6931b35
SHA1 25f6392fcb9ae2c648e02f3507287b2378a551d6
SHA256 1a6a71d9ce5e220a87fb559da3fca301c8323382e0c5f9dd2c903954f59c05ef
SHA512 04e540fcfdd3fbff49adbf53eb770c474cc0aa88d8a45e421a9238f1f2c3621a4423ea85e5020599a9d03f40aeec3933aabc57b64cee6e607a9f3c0c80dfa8ed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a69e52b05dba288b51aa750f30b8f5d6
SHA1 feac46360aac2785a31fc1970b5f0d220afd4454
SHA256 021744b3336cbe745196c2f3de1cdaeac558d7775736f5a036b0082f2b0c34ce
SHA512 4037dea8fa54139f7a56dfe812c763bd58c3ce700de51dde34f739752bf9ca3c1a3e9f2ad95b0bb9feb06a6a0dd85149de8a0690357b424fb54c85e150727fcc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08f030c855fdf53a44a2d583b2989e2b
SHA1 f082c908f1bb5ed0f9a1d5be1ad12fc45f722ccf
SHA256 4cb8e46f8925881c004509639dd90c6f240d9265e7bbb7de2e26fed52862b077
SHA512 017d6b374edd7507f0ad2c32bfd296646dc0a38828232985dcbfddab9eb9d3e8bc8b42bfca5e4a0b7d351190a98042857be4f577e3afad2634e1b3de9a96b514

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51a19d24ee04a1c336125a8fcb2ecf65
SHA1 bd876d0e3bac680b2017370a49f62f96698490d9
SHA256 7b491f0dd53bc491860c1f3c6943a7f137634d17be6590836d88969d2012f5ef
SHA512 4ed499cb2aa0393978c45f9561e03705a24c990a48b79448b6a6a8bf4733c9442da782c9d03586a9247bf10613ed043e5eca817e4f2631ee9705d399cd54540c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e9ea916238dc18a985ce1ce9f2494c2
SHA1 efa14dec121554ca64c4c99201b1246e38ed20a0
SHA256 088e4edd89166ccf096585168e8900d4277ddcf01f6bd4b2699b8feec92a64e9
SHA512 7edec7b382bce2c38a52dcc854d3421af787e4de0cbd2479eda24b61b70607b06989df64efb1712407f8229638cb2510234c3d0994631e1d7948c39ad4d48ac3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ac210bc12950d8f74930ddda5d66eeb
SHA1 a09d21c4d1c94a281bf8af47b4300774a3e23ab8
SHA256 d5f35d0dc5850ed7c5d2847c478d6983a1e072cb73bfa26da22661eab8c200f5
SHA512 6bffd4d8f39477355f3622e61c241d2aaea169342a45e41b04fe99e48df514637da1e29f7e2fc6144c9c423254064ec62831362a5be009da97d2b9b5a7f6af4f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 01d1e8e8653e7ea198ac4b3ff3e0b50c
SHA1 d17f5d1e6a6cec3bcd3fff09bdd8abf024ce1d2f
SHA256 544e214f631075d3e2d4c797b9afad541364fbcec82ded4578991710f8c68296
SHA512 d1d99bde1cd734aaabeb0702db8b842ad1735addcbacb79b1de710c0ff0d2fa1adc47860c55ac4584bdc3692241831756be9c4c56446c2ea4abc4ee0cc1e0b4e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a78e7a8e03532e7b6ee269dfcf7d0f3
SHA1 16fe0ccc74e902c88a43497ed13f08382259341c
SHA256 9c68078b77cd27f004828d2a75baea22efcbf8fcbd77d83082e4a40decc9396a
SHA512 3aad7a0752fef7a0f4f937e7a392b507f95bca91f6829184ba3d9064fdd444529b15830670fedc31898a22c1f1481e84e70462a25feae0b98bc7d996563fe011

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8923d47ff306e37a094245a53d89a79c
SHA1 8dbbf73670e50a85e4bbefee5d1c5fcb520e8fc8
SHA256 1d51f146c4774dd18821a7d7d9b248d16ce7678a3ab283513defa84d4c32420b
SHA512 3a4b4b0e836a9200b0d318bff694a0c43ab28ef518fe139be0fdf3906f83a675bab57c18a51c9d751ac50f74412f9c5d7be06c53e362e68c3cc914957a748125

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f0ed67340115e71e3e24d99d6829bc75
SHA1 d183c40aeb924f1d15c2128f68c768d0c4164b93
SHA256 3c96653b8cfd9a82ebdae1a315d12c4aa14c164f3c5e7914e3e7d73661b068e4
SHA512 799563c05a6dc97456aeeac34e822c19e479d7828ff618022214de8e95aa4f144d4cb08614ee4cbdfc7829f7f7305445abb6b5eb84da23780f46c6b5c7d6f2d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 beb1fc2fb6373699723fbd29c143a778
SHA1 59f8d523595f5672fc797eb0f3fce1f8f6695e4c
SHA256 d5d4cdd9ab028d7e99d148abd6e627ee5b213ceed035ae057e18be756d31c329
SHA512 5b1faee48d9abb3f33779ae0fd8bf0d01c6bebd459517aa4361638a881b3b692fd450c211b0657e49897575f3597288d5e2b9c8e191739c3b6c25712b3b9cff7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e5ee25413e505aa16a3a1677aa33db3
SHA1 84df169c4c7647bfcdf3f197aef669033cbeb5eb
SHA256 0430d7f4e7836eece35cc90e14a00044f4746b59bed83557e26ef03434e8742d
SHA512 ffe84b3289429009f6d92a2fff0d52f0dc38b01800a8a2fa6bf9cb5f8bcb2969a6857ea38666a99dbd111b21150e1e8d93d2f59c09fcbc5db3b93da24b5daebd

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 06:42

Reported

2024-06-18 06:44

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 396 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 396 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 396 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3100 wrote to memory of 400 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3100 wrote to memory of 400 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3100 wrote to memory of 400 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3240 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 3240 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 3240 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 396 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 396 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 396 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 2624 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2624 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2624 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4896 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 4896 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 4896 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe
PID 1580 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1580 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1580 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4448 wrote to memory of 2508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 4448 wrote to memory of 2508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 4448 wrote to memory of 2508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2508 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 4696 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2960 wrote to memory of 4696 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2960 wrote to memory of 4696 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 4448 wrote to memory of 3952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4448 wrote to memory of 3952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3824 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3824 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3824 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3952 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe

"C:\Users\Admin\AppData\Local\Temp\67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe

C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe

"C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe" Master

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeee5546f8,0x7ffeee554708,0x7ffeee554718

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2092,18015983991485609612,13347475334474538664,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5440 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 info.178stu.com udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
HK 103.133.93.52:80 info.178stu.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 arc.srv.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
NL 52.111.243.31:443 tcp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/3240-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3240-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3240-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3240-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3100-14-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3100-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3100-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3100-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3100-26-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/400-30-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_67fd842b6164837865b35ffe4f2cff31a58a7c1ac1a7e7599a2751b6bff68809.exe

MD5 11ea08cc2634959c88257350fc395168
SHA1 dd465893627ffbfa8a0823144909fcab1da3e1a8
SHA256 89e21f282afbc54a57c37726ffd524aa97887517c2e32a75107f7061095b149e
SHA512 ee665cf2db1fad781fe77e91a9d2d4ad47114cc82dce19e4e876a06c765a7220c555e6127b03370715ba68805f0a3ab3409d1a311e762cc23105ffe1cc0add30

memory/400-34-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/400-23-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/400-35-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 ce8ac736fb7af8cf45d9cbfc9d501d3a
SHA1 5ad81c39297fcd8d9b3c4d7e3d08e67cfe37216d
SHA256 c1408d476022e1a2ec303312910ae8fee594a4697cd50b8b14d80d79bef0b5ec
SHA512 73b582049bd3e8d27b9176a734a6d305b14c14247d6de5d5a0faf45204615fdabb7efdd53ed9c79c028e9c9fd0d3e593a0e3a46b22e1737bf2776c46457b98a2

memory/4896-80-0x0000000000400000-0x000000000069F000-memory.dmp

memory/1580-83-0x0000000000400000-0x000000000069F000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 825d3014be2cae9e6e6d410914aa06b7
SHA1 42b27f1bb31b8ca5c498c17a5146817e53b4bfe8
SHA256 e2b6c72eaa66b2e9838a98f0439cc870588881c7256358477a253386022f592a
SHA512 995aa24852de248e41c62835dbe12872f386922a165ece888bc14a19917b86e37f5a1a6852aae1fa1db41ee88080e77d8ec939de1f153eef660009b635087996

memory/1580-88-0x0000000000400000-0x000000000069F000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

memory/4280-131-0x00007FFF0B090000-0x00007FFF0B091000-memory.dmp

\??\pipe\LOCAL\crashpad_3952_QWHLMPXGDRQGVXLT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 66ce6630ac6eeacd4ab9affa50480419
SHA1 f7e1db4198fd2766b3a012f7c3a063d11e42d0e3
SHA256 8c8fbef2f880c7f22fa401ceb33dce34015b4dd4f73fb055470c7ac31f9c189e
SHA512 2179d3477e2052bbf513a960dac56846a2ba6ed7de1d5eb6149783bb899e31e535d4f1de6bf58ec5e846777aad8e36d3e6c4eca1869e7fd620bf398ebad5595c

memory/4856-170-0x000001F267150000-0x000001F2674A5000-memory.dmp

memory/4900-171-0x0000025A32F70000-0x0000025A332C5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/4876-196-0x000002033FB40000-0x000002033FE95000-memory.dmp

memory/1720-211-0x0000019796780000-0x0000019796AD5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 24790be255d11341b4c6a95998f75584
SHA1 95cfc78ef547b44e2615a2d1be7ad0aff7099e3d
SHA256 11916ba92830f878faaa078d7a211cca150610266c913ec7fec194ffb038853f
SHA512 7e7b5a68c773cbbe2e6f219564d0d86bad6f74e00f1b340544d562f1714efda1eec002607f0f9a06c4b6a4b117ee0027404d479c27a7c318ee9bef766e19209a

memory/4280-219-0x000001D24B0E0000-0x000001D24B435000-memory.dmp

memory/368-220-0x0000016716D40000-0x0000016717095000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 da857226657ce0a1e0acf61d4b11b3a0
SHA1 80fe5c80b1b79ada70194c8bd40c65d46716341b
SHA256 97c89d77916652f49dae5c5046b847762a4d924b8dd88a1b631e8cfe571aabf5
SHA512 e54850b2c3fa03a8fb6b70be210a13de54f9f79ef7b178b99750c2fce6480f8eb95cf11e2644fea5006a33c13899e9e85f8bec6e08a0e927f6aa2bec77f3d05f

memory/932-230-0x0000018CA9D40000-0x0000018CAA095000-memory.dmp

memory/4000-231-0x000001FD65B40000-0x000001FD65E95000-memory.dmp