Malware Analysis Report

2025-01-02 15:11

Sample ID 240625-v3lh8swckk
Target 81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302
SHA256 81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302
Tags
gh0strat purplefox persistence rat rootkit trojan upx discovery evasion spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302

Threat Level: Known bad

The file 81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx discovery evasion spyware stealer

PurpleFox

Gh0st RAT payload

Detect PurpleFox Rootkit

Gh0strat

Server Software Component: Terminal Services DLL

Drops file in Drivers directory

Sets service image path in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Reads user/profile data of web browsers

Checks installed software on the system

Checks whether UAC is enabled

Drops file in System32 directory

Checks system information in the registry

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies Internet Explorer settings

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious behavior: LoadsDriver

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 17:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 17:30

Reported

2024-06-25 17:33

Platform

win7-20240611-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259398493.txt" C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File created C:\Windows\SysWOW64\259398493.txt C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c036858825c7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425498531" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000088c5ae82a19143373f0cd72513ac734e161dedc9acda0fc3fb61647df77f0e3f000000000e8000000002000020000000383a531eef4ecd51ced825bba148a08faf89518d9b426ba335093b1bdc3ed27e20000000af74698c3a3b6e530b1b745f736fbb87cc7cd6e2a8f1c71441c4221f847112e440000000c65c379951eca91cefc1caf47dbad7a2cb9c203425df2490c8c948bdaf0e49082411051d7aa9049f715d3dbcdaa9d12a30c7b082dc53e57f9cd6faa27e3a236d C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B244AEA1-3318-11EF-8875-5E4DB530A215} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000431b79c7f79f7fcc8bff38461c4349a4ad269a28131b80620cf09a8f9a4bdc3a000000000e800000000200002000000076b31206e020ae9246651379b1e049d55b8de876bdd3ba2d625f569122e4052b900000000f58cf413bf13bc2da077112d95f9276fdccde737ab1cbde2d6cdede165f216c86513b54efc72e45867aee64595e4c994d42d0a8244692f69a5c4ee37bee0a3739e9dbb695482382fac77449e65919b2d34fa365de2180c458d6a0942e33b2fac4f57a157ef0cdb502a842f4c6815c3dfe5804030f08992473ba1e511ed84061677d0551d599a3306d0af13d9d10605a40000000e352b433e060b37b355daf31d797330f35733e4e02962b8439b610b44aadb36a46549fbe56020884d8694671ecae23d920415903ac89fac0fe2050ffb18aa8bd C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2016 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2016 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2016 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2016 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2016 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2016 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2992 wrote to memory of 2692 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2692 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2692 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2692 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2692 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2692 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2992 wrote to memory of 2692 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2016 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 2016 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 2016 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 2016 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 2784 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2784 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2784 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2784 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2016 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe
PID 2016 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe
PID 2016 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe
PID 2016 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe
PID 2780 wrote to memory of 2220 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2780 wrote to memory of 2220 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2780 wrote to memory of 2220 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2780 wrote to memory of 2220 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2524 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2524 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2524 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1888 wrote to memory of 2408 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1888 wrote to memory of 2408 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1888 wrote to memory of 2408 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1888 wrote to memory of 2408 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe

"C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe

C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259398493.txt",MainThread

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://pc.weixin.qq.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 pc.weixin.qq.com udp
HK 43.155.124.49:80 pc.weixin.qq.com tcp
HK 43.155.124.49:80 pc.weixin.qq.com tcp
HK 43.155.124.49:443 pc.weixin.qq.com tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
GB 163.181.57.244:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 res.wx.qq.com udp
GB 43.132.64.190:443 res.wx.qq.com tcp
GB 43.132.64.190:443 res.wx.qq.com tcp
GB 43.132.64.190:443 res.wx.qq.com tcp
GB 43.132.64.190:443 res.wx.qq.com tcp
GB 43.132.64.190:443 res.wx.qq.com tcp
GB 163.181.57.244:80 ocsp.digicert.cn tcp
GB 163.181.57.244:80 ocsp.digicert.cn tcp
GB 163.181.57.244:80 ocsp.digicert.cn tcp
GB 163.181.57.244:80 ocsp.digicert.cn tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

memory/1432-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1432-12-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1432-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1432-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2992-18-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchos.exe

MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

memory/2992-32-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2692-30-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2692-33-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2692-37-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2692-38-0x0000000010000000-0x00000000101B6000-memory.dmp

\Windows\SysWOW64\259398493.txt

MD5 e0e5d745f52642366b58c9db74d2a46f
SHA1 78a72006a6369fcc1a92fb0f1b5e1706c3a2ab60
SHA256 cc7634e983dc8fb37a86305207ee6d1e1d8194de85b5056daadfc8a57b2fd45e
SHA512 0e81b5b5e428a819da6f15e0bb768a6d87d469289ffd936a13d20d94d21e9c81207cac0af90f587fc816dd57a11e6226b47775a6a4d04008ee4fa5d02e002178

\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe

MD5 66eb21741ecfc2a8a53a24d65ec7a40a
SHA1 6d70532a0b9a1012da004bb78461fff8d9845253
SHA256 64cd27f902fdf3e74c2ed74f7640ec000441ef46daffa20416da582e751b18a8
SHA512 47289021ab9543a30a2ab647f42619cba048be9c03f4b8c6fbc888bb7167c0cd8868e482114874c0b6c8f02dc48b6e87d22b1c4f04e53a0d20b62897199955be

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 4653f48d93137de0e7552683b31ed7c5
SHA1 cb900a397c0a23658e30ce7578295abb949082cc
SHA256 2c324c9359c8f712c94fdbb8c7c154241fbfabe2bb36347fe777548b9825b7ca
SHA512 8c02628958f2e1d8ef6f88d35e33e5f2beb85968b4d3a77138dd2df861319b7fbb3801faff2bc4fb167a3e26ddd2d32f188ac40ceb3394dd2453037e7c87c2fd

\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

MD5 51138beea3e2c21ec44d0932c71762a8
SHA1 8939cf35447b22dd2c6e6f443446acc1bf986d58
SHA256 5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512 794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_9B8670363F58B4643EB28A4A03EE9887

MD5 04ec7192d24d44ec17702fd6d9b675c9
SHA1 3838c42dbd6a66149e3ace3da073a8d78db3ccce
SHA256 ed3168ee4f75076cc37dc3c48e9b5e6dcdfe29281293dee85c13c90c9aec1ea9
SHA512 e016ff25b9cdf3de80b249004fe6d3a7f12679f40e6d02d70f2ab4ada560b49b3f91c6c859791a6bc740c22d7fb4abb3eebf39d837a8bb69ddf65404f8349cbd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78f461f7560293d9129dc99dbad66872
SHA1 c4b61395d3e2f7c18b8b6d90a3e9f70636b9a81a
SHA256 9d665a6c5506dfea4e233e9fc4479d2ddaa735acb0e56dace8aa759f5c7e188d
SHA512 04de078cb25dab616eb6fd8a3528548c135e0fcea5d8bec4f08e48d1e435c43c313a15b2f59cfa619b2338e67231f4677f0d678246c972059ebf60add77fc621

C:\Users\Admin\AppData\Local\Temp\Cab565C.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar565D.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 11e99d43e10df4794f20837c31abaff2
SHA1 d019bfa8043e29563638b6b13bff1803c29a28bf
SHA256 f8985c414f05879da046f9ca4a0025d2c9cc6ca8dea197fa66bd5545661afb2b
SHA512 33751dc5626a89424affd292072276f00db29644ecaa72ac3d4f7223c056d889df0372bd7cbd22179159b16f132670288cb7d0bb0bafe604d996e8006685d4de

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e3f0047d883882bcaf71b5bc041105ce
SHA1 653179fe038f4bf6eb8a5ed8846a2f8e3ab8b483
SHA256 c05c74d23f93be79dafd91eea3eeb28a0c7798b8c25f57e612056a5a9af2dd8e
SHA512 edbcb61fe0a27ab87d956add2b116293042b611f6053c6ff2267a14627d4cc65694aa9a85c4fdd8fd3624cb89bb90a3541cd79050a6e9bcb1a48667384825f17

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fc6f96a098408f842831236ad5e54f59
SHA1 378b45954c4c544f80f51742cb5d0f083ae71394
SHA256 45c5c8b454b3fc16b8bdbc0e768c4f22ae72c4d0326764ef6353f1e14b5a2a6c
SHA512 5d952a5b90a14e8bcc3f640d4d8fbdc6008e2731f871439ed3ba3bd16328468d653a2f67feae735ae14352faf3540fb039cd3ebf732d1a9205f0c9b6e767b0ab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c446edc445b0fc6039f681aa0ac08caf
SHA1 313aa013f82e7fc8812d52bef2868a5b3040bb3e
SHA256 5f80b2929f19a2eff85d3c15c8a5d0a021ba877a4ba93b6dc56f36058f67d28b
SHA512 8e8fe92828f41a7b22a675243370ba543ca1ce38f16fa8ac89cd82df2f766375cc82b1b608d38c33102b9ba76a78e01ae7afdbc2ee6e59bea90e133b68b9ec50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 28627968ad6cd5e41163afcf490ba5f3
SHA1 72e58caa359f696da94569ff07ef85891bafebd2
SHA256 4b914e787dd7ab567370477594ecffeacd9e53c8648ce64eb7403b7be7cddd29
SHA512 97e6a7f82059ba588d68c1c493b29fa3d25d4e84d76610caced3481885df3c31da762d290146050832f3c13d631ce10001bb4ca4d6c2303d925ea28c8476c460

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bdda9bde3f2e266d0ce7685cb0a4800a
SHA1 0a1cb36156b8d989a3bcbcd355cd12c2044c60e1
SHA256 0792440c56edda001f7b331a87ecf8d4b687fc727b6e89480c08f935b373d507
SHA512 bf738878c0aa58b5bb65bfed464f8a132237ab10b64ba0a85249c79435699cda9ce47fd60854171e2d708a5dc54f74ec6bfe83befe7e55016b5624cfa468339e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 71cae6f7c4f7e85c5079d0f19f59b3b6
SHA1 d2a2860472462b8b624b6ccc09f884c65b9f732f
SHA256 7399084caaa8fd9916647021c888fb72ae71ba8abf2b253a5c20752d3346c443
SHA512 7c99f2fb569d2e8dcbcb701fea2a022d7e237decd6337c920306208ef64862784ed0a32b4bddb7d8bbde33acdca513ebc12e0f8b264a9d016a79d9f18886bc2a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 622173fb66c3eaaeab88c3bb1080ff3d
SHA1 cc33db9231eace150e3d9372bb8fc29c6f911304
SHA256 c6359a48b2f5f3881f9deebd5a22785e62036bc685866a6c6bcf3bb9f429a310
SHA512 bd932964ee7521be86596b78d0e6cd725395e45ee266d81244594d1451e6e8c8bf2c3425023f0b7f5f19b1cd778263d1b7db722f40fecd04ed639ba792c228f3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 610afa084342e48ed14189ef5a905cbe
SHA1 db4b67d641790b62c9417ee2f59a238d394bffc0
SHA256 132d4be92f85144e24c7456aabc7eefa3f4450f14e76ab5994beec10defbf151
SHA512 59384f73e44f63a1bbc03e9d3ecd60fae1b34db765de35e685c926c9cd2eb0b9bf5658547c95b3da97a6ed246da99bccf26a6af76f9dd59b6f0c4d73aac83422

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f46f0b145da856be264da39cf1a7b7d4
SHA1 e3b7c6d42e24d0e4b58ed397790c21fca96f4e4c
SHA256 d8a6d9fcd7a816ca9e9f88157035c3c382aedb9078b14a93f92a7e8ff4111e8d
SHA512 4807cedd72914b0802817980e375376c7421a4303295a725039d21af38539e62492793ade0294b4bb9545dc3ef2a369a06f81102d25223cbdb0653465c803185

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 349afca9cbba8dbd7e763637de119b97
SHA1 ebe23569e74dd3987e246a1c8fffd880f3048edf
SHA256 8786e061afae0dbc3b6260e7f8abb3d9a7032ac0b22fd9b77e206af4562a4521
SHA512 55b70ebeccb38e876a74f83027dc337ca33b144a8dc3202445c659cf9251301364581382bf9bcda8e68316ac2c9cd3506e0dad5e7606df808fd46c82d24de799

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce2ce186d96ff3b2ba394c57da2c536f
SHA1 afed0a9913ec8c7c7133d5195d063e3934c3267d
SHA256 40982047b5b68f0165db7ac7e64841af7d6ab9dca1d30d281c1f347e034d9809
SHA512 49c669c938619fe0eba410d400482e0a745a7397b7a2662222c7a5d90e7c4ba754f538ff2f2e60e118d98ae9cdfd1217ac05390df73411aee01e04c3d5dc50ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a79794bee2b37c3850abae64d009dabc
SHA1 551d044388a5c0f26cfe6a1757d4f42afe449621
SHA256 7ed85fcf868aa39e7a3158710ca37f76b9fd623f6a0906869aa98f7d36596d9f
SHA512 6a0dd1f0d9db945b561ef85cc711b7867996264f6f42c8f571cbd704be2fedae1abe10b5ee9633b0d58f3c56cbd295d08886c94d5b198c935fe40c40c2cdfd84

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 159b8a0f2cbcd2e3d9137ce4d12520eb
SHA1 0c6ede8dcd8caf10f0f9b0113a76a9e183f61961
SHA256 136c45328ed3f29ecf4d8559a8a8162ce9341f59ee8a659df0d1c28e91b88ed5
SHA512 ebffc4ee97fd2c2179a27858f1bd6f3a13c0a78d6ffe5cb93b3851c076fe7f79f3e2822841440943136aec950e46607815c54972c387829ed579d0b3806b2697

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 518ae0369c7106cab214d6ef222afba3
SHA1 507ff27b5070c78b90c8a5b7c8de02709e5d822f
SHA256 b2459b2e16fc5973857d5acf1620c285f904edde731873fb471e4c5de5acef4a
SHA512 c6d8a926e8a0f363a49269aa1b21b2523f40b86be06b632c132f859b4787434135e155fe164d0e13fa3b0bc6872ac7341c582be0efb37a0682e5478f91561dff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 def24ee694470c330b8dd7ff1b9a2e8f
SHA1 7a7bb8ba583cbb20c2e20fbac830075ad06c5972
SHA256 9dec4c531b000be9b54d72d0cb33685d569186e9fa3d6714b5b6ac4627e4058d
SHA512 125273348abdcc685db89517332e7328ccac1a0ac175d7c0228c4ffff4f55077df5547c1bb0da284bf2bf5c99c6e6f076241ce63231019da06ab7f7916b74caf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57617441936d8c96070da2a044e5b36d
SHA1 8812ff4dd849012cf90c492625987c2f634e7ed3
SHA256 603714b5bc1fd068dc6454c645d8c09fa9758e3468829a4f62f91f9b088cf5f7
SHA512 e9d88f1c13a509f6ad13f68eab8ddee700bf7bbabc6eeaf8ccdd8eb5e3b4710b0ee3b7209530827865c9aeedaf8bd1ec6fe87f6a4371f6fd252507bac6b83781

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 56211d4071b585015b199d281b669d5c
SHA1 8113e44a919b39d16c1f3738c2af2b2efaddc3a7
SHA256 42cb80b16c083a0405f557f69fca0291e035227b00dd712b741105ecbe61d63c
SHA512 6f59cd4cb919f949a53b9332ebc9ad3ade6d3bd85bf693ce79db767dd5efaa8e925207cc1066959d755115cd7e641bbcd474e1b05ed2ae5e4114aadc768cc8af

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 17:30

Reported

2024-06-25 17:33

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240603875.txt" C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A
N/A N/A C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File created C:\Windows\SysWOW64\240603875.txt C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3640 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3640 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3640 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 5072 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 5072 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 5072 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 3640 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 3640 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 2880 wrote to memory of 404 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2880 wrote to memory of 404 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2880 wrote to memory of 404 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3640 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe
PID 3640 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe
PID 3936 wrote to memory of 3148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3936 wrote to memory of 3148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3936 wrote to memory of 3148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3916 wrote to memory of 2668 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 3916 wrote to memory of 2668 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 3916 wrote to memory of 2668 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2976 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2976 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2976 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 100 wrote to memory of 4756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 100 wrote to memory of 4756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 100 wrote to memory of 4756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 4756 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 4756 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 4756 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3356 wrote to memory of 732 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3356 wrote to memory of 732 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3356 wrote to memory of 732 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 100 wrote to memory of 2308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 100 wrote to memory of 2308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 100 wrote to memory of 2308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 100 wrote to memory of 3424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 100 wrote to memory of 3424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 2616 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 2616 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2040 wrote to memory of 2376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2040 wrote to memory of 2376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2040 wrote to memory of 2376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3424 wrote to memory of 1684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe

"C:\Users\Admin\AppData\Local\Temp\81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe

C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240603875.txt",MainThread

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d5546f8,0x7ff97d554708,0x7ff97d554718

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2088,2817219507384214919,12047375433694332645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3056 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 35.166.122.92.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

memory/5072-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5072-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5072-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5072-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2880-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2880-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2880-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2880-13-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchos.exe

MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

memory/2880-22-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/404-26-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Windows\SysWOW64\240603875.txt

MD5 e0e5d745f52642366b58c9db74d2a46f
SHA1 78a72006a6369fcc1a92fb0f1b5e1706c3a2ab60
SHA256 cc7634e983dc8fb37a86305207ee6d1e1d8194de85b5056daadfc8a57b2fd45e
SHA512 0e81b5b5e428a819da6f15e0bb768a6d87d469289ffd936a13d20d94d21e9c81207cac0af90f587fc816dd57a11e6226b47775a6a4d04008ee4fa5d02e002178

memory/404-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/404-25-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/404-27-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/404-42-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/404-41-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_81f3921130a65b492c2777705b314efcc0310ceb6fc6c0d3dfa9495d07369302.exe

MD5 66eb21741ecfc2a8a53a24d65ec7a40a
SHA1 6d70532a0b9a1012da004bb78461fff8d9845253
SHA256 64cd27f902fdf3e74c2ed74f7640ec000441ef46daffa20416da582e751b18a8
SHA512 47289021ab9543a30a2ab647f42619cba048be9c03f4b8c6fbc888bb7167c0cd8868e482114874c0b6c8f02dc48b6e87d22b1c4f04e53a0d20b62897199955be

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 4653f48d93137de0e7552683b31ed7c5
SHA1 cb900a397c0a23658e30ce7578295abb949082cc
SHA256 2c324c9359c8f712c94fdbb8c7c154241fbfabe2bb36347fe777548b9825b7ca
SHA512 8c02628958f2e1d8ef6f88d35e33e5f2beb85968b4d3a77138dd2df861319b7fbb3801faff2bc4fb167a3e26ddd2d32f188ac40ceb3394dd2453037e7c87c2fd

memory/404-58-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 3432a7eba686556f7ed6c8ec8439377c
SHA1 700bbd8df3afa03944436d15528234a96a714aa1
SHA256 307149217f51f1a52cc467d9564ec198ec6a7a6a64fbf9ae4ae824035f6744fc
SHA512 03099b2d72598c48d0cf2949a6e84576652b9972e52e2ff08fefc48ea8603c550300cf61ead66865042d8bf005bea41406786dce587500aaa52fdd6672f91a4c

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_3424_WMQNSDDQYPCACJHQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

memory/1684-141-0x00007FF98B510000-0x00007FF98B511000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 34b5fc7d8b0fef93f77425223e775723
SHA1 702cc3b87afa2e95e1e573f33f85e513695a9605
SHA256 784b1fecf2fb986983d19de3e70abd25ed3c80c808fee07825ad3086a3c6826c
SHA512 e843c570b4c4d0253af30f6a8b514ade971fae6b2084d5421c8cfac11a013716a8c96354f4f9be5c05425edac16f8d2c93018036c04d2e3b3aa0aedf883bf76e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\049b1ce1-2d60-4df6-8853-07b447b9e12a.tmp

MD5 364fb74f70f30d28218e2f3610a9601c
SHA1 204bc27d68c70e730dfe0dbcac57a82954297012
SHA256 f3f18bb2964ff3dac8f98d7ae629e72efe608ff91bee37a12e7e88581c7aa1c1
SHA512 d808a84978d33e10388e8d7243e000d875ac0a0d389ef3f408f93ce44e780a43c203e40936617cc5abcd3ac379ceac72964b4f034f962649272fb1fc5b2e6b6f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f769928a0d10be67453dfb61148a5d81
SHA1 28fdd46a2dff874295680f182dd1c6bc85e5f5f6
SHA256 2a2d3cb1a178effa334c79113dbc9c02411f8d37878d92bae9dbe266df9f00cc
SHA512 50bc43fe9f4cf922afe407590308134bb732e05f36d66b5223af73f471cbdc072ab5e3a82bdd95ef6f3dd4474b842bdccce3c52d12a830e01240b9b07c12311a

memory/1684-220-0x000001D0B5ED0000-0x000001D0B5FFA000-memory.dmp

memory/1684-227-0x000001D0B5ED0000-0x000001D0B5FFA000-memory.dmp