Malware Analysis Report

2025-01-02 15:16

Sample ID 240625-w5h2kaybml
Target aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3
SHA256 aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3
Tags
gh0strat purplefox persistence rat rootkit trojan upx discovery evasion spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3

Threat Level: Known bad

The file aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx discovery evasion spyware stealer

Gh0st RAT payload

PurpleFox

Detect PurpleFox Rootkit

Gh0strat

Sets service image path in registry

Drops file in Drivers directory

Server Software Component: Terminal Services DLL

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

UPX packed file

Checks installed software on the system

Checks whether UAC is enabled

Drops file in System32 directory

Checks system information in the registry

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: LoadsDriver

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Runs ping.exe

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 18:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 18:30

Reported

2024-06-25 18:32

Platform

win7-20240611-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259418134.txt" C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\259418134.txt C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0873fd42dc7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD1A7BA1-3320-11EF-B848-DEDD52EED8E0} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425502094" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a2787f481653274b90c47e9954861bb81d474db2cdea4ac5a1f09b57020455ef000000000e8000000002000020000000acbf4ed8d619133f9e4ce32b16778a10d9f7716c179491ff2541da0f3f0c0d7090000000f14662084caeacf42aaa6c7a58c3b6b6c05bd7f843e207e01a757f77f8d9cbd5019403aa73efc569a93f793840d7e57f484622eeb92f4edb16ed6d6da4b27f4619520befa5b9c6c4d415942ed34af578a6f6bc4cc1755ddcdc5734a6008a87224a95539b658666cbbc8ffcf29c86d31de011de9cf6daa111831e219f304a1457c2d959cd8ccf0344a96500bfca1b5e6a400000006fcfe3e0c8fddcb3cd0887b92567ebd4f29d775d4587cf9e9ccb3bef7456cfd791366b220542b28c27e2f6a306997c32b2fc148f0a32040f48c6d320e35f13da C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000096714a9cd8e3f0134cf875843fa2ca9dff301cd0a927890e5a68526aa73e1a3f000000000e8000000002000020000000a4644dfcce0f3d077c81fe5b1429f33100fd2fe5d5f6480431283c038ccd6fed20000000ce6de44318977ab287e4d489e25de10c4018f951ad9ab2e642a5741997d595a0400000005bb4d0cbd68ff53f4617f083990f44dcf186fd17ce71b6093d5335f429c66eb3433c3ef84edefa219186ea87af02aa018740bcd1291c8803a8faa50d97630b42 C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1200 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1200 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1200 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1200 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1200 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1200 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1200 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2560 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1200 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1200 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1200 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 2128 wrote to memory of 2776 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2128 wrote to memory of 2776 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2128 wrote to memory of 2776 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2128 wrote to memory of 2776 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2128 wrote to memory of 2776 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2128 wrote to memory of 2776 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2128 wrote to memory of 2776 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1200 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe
PID 1200 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe
PID 1200 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe
PID 1200 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe
PID 2736 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2736 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2736 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2736 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2504 wrote to memory of 1136 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2504 wrote to memory of 1136 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2504 wrote to memory of 1136 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2504 wrote to memory of 1136 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 2496 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2496 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2496 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1716 wrote to memory of 1544 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1716 wrote to memory of 1544 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1716 wrote to memory of 1544 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1716 wrote to memory of 1544 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe

"C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe

C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259418134.txt",MainThread

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://pc.weixin.qq.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 pc.weixin.qq.com udp
HK 43.154.240.170:80 pc.weixin.qq.com tcp
HK 43.154.240.170:80 pc.weixin.qq.com tcp
HK 43.154.240.170:443 pc.weixin.qq.com tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
GB 163.181.57.244:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 res.wx.qq.com udp
GB 43.132.64.190:443 res.wx.qq.com tcp
GB 43.132.64.190:443 res.wx.qq.com tcp
GB 43.132.64.190:443 res.wx.qq.com tcp
GB 43.132.64.190:443 res.wx.qq.com tcp
GB 43.132.64.190:443 res.wx.qq.com tcp
GB 163.181.57.244:80 ocsp.digicert.cn tcp
GB 163.181.57.244:80 ocsp.digicert.cn tcp
GB 163.181.57.244:80 ocsp.digicert.cn tcp
GB 163.181.57.244:80 ocsp.digicert.cn tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

memory/2560-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2560-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2560-9-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2560-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2128-18-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchos.exe

MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

memory/2128-27-0x0000000010000000-0x00000000101B6000-memory.dmp

\Windows\SysWOW64\259418134.txt

MD5 ffa7ae80adab65018ba485e5380ac4a9
SHA1 951abc7f0a22299d3869ed9210c94dab84109d11
SHA256 215dfca5e51916fb3977bcfc5ae9bca1e50392a48e28a16ee3ef0950b28601a0
SHA512 11238ea671a52dc1fb95a9d0db3d3746e255816f1c918fea8567029cf0e1a678399440786f63302dc00b4a084de9997a0b057b6eacfbab15fcf179586bcf4af2

memory/2776-36-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe

MD5 66eb21741ecfc2a8a53a24d65ec7a40a
SHA1 6d70532a0b9a1012da004bb78461fff8d9845253
SHA256 64cd27f902fdf3e74c2ed74f7640ec000441ef46daffa20416da582e751b18a8
SHA512 47289021ab9543a30a2ab647f42619cba048be9c03f4b8c6fbc888bb7167c0cd8868e482114874c0b6c8f02dc48b6e87d22b1c4f04e53a0d20b62897199955be

memory/2776-34-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2776-33-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2776-31-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 21d3b31ce900a5efab1edc2f6c0b716c
SHA1 158f042106662d40d24632183d64b2ca4f65b044
SHA256 8a525fded0f15ea9c0931db151db2d5a8973cf895ee788e31ea95d2390509568
SHA512 f6f27fabdc567a17c0fe768c9f49b68e7f60092e8058c94e92baee98bbe2d768fd117e7327887714669c76430df5e395480946b92fe0ca5b1ea5cf17e6892b72

memory/2776-79-0x0000000010000000-0x00000000101B6000-memory.dmp

\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

MD5 51138beea3e2c21ec44d0932c71762a8
SHA1 8939cf35447b22dd2c6e6f443446acc1bf986d58
SHA256 5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512 794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_9B8670363F58B4643EB28A4A03EE9887

MD5 1f12de716f110a7687a8491324f35e90
SHA1 479d6c8b6d7574a7d283ccc5e67f42c2ce0597d0
SHA256 2c1f463543b2eea1fbf0bce01ede1b7617b5bd44a79dba44c3a4bf24c5665c49
SHA512 8e0597e98e0599b053325e6b373705cf555a6f21793f9bbc0fb26b762a973a66afa9de9449279f587ed9791bdeb0143770fd08f780a1a761586c5548ddc41d49

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_9B8670363F58B4643EB28A4A03EE9887

MD5 04ec7192d24d44ec17702fd6d9b675c9
SHA1 3838c42dbd6a66149e3ace3da073a8d78db3ccce
SHA256 ed3168ee4f75076cc37dc3c48e9b5e6dcdfe29281293dee85c13c90c9aec1ea9
SHA512 e016ff25b9cdf3de80b249004fe6d3a7f12679f40e6d02d70f2ab4ada560b49b3f91c6c859791a6bc740c22d7fb4abb3eebf39d837a8bb69ddf65404f8349cbd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca6f879805f1ee8e228035e839063147
SHA1 fc9b85a4775ab159bb808a63f8bab306ade98cad
SHA256 58a35399549a089db4bc2ba1d542bfeca1c7b3d5132df9dea3bef7f4794a45e9
SHA512 11f6ddff2cb75b0ec9a4f21cb5b5cc6702b535b753b95a9f25fa5095635fc44b2ad778af94c0c5d2a548c1c1c5f28a44dae133593314f7a66d02c4b7c400662d

C:\Users\Admin\AppData\Local\Temp\CabA3F0.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarA3EF.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6efdaeab6b19445d9ded7b55065659c2
SHA1 9551e1bd8f355b03b542568cffb5ac3aae6fa3d7
SHA256 4f176766719a386ee41b8b1b181738d719882201a631d74ca3f7cd8326aa0ad8
SHA512 1e282e4356fc7061b7447684bb207bdc46949a489a7a2a77ef6b2ee48ac48103a1c57121cad0089fcc7a313d9306880547b75428414e6360e41fcd75a7b8b9f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 565330bf816551584bd552500f31b7fd
SHA1 9bef39c2d4367b36953830c7e474b9d603d0c429
SHA256 7e568e260612b95ff02691085e6eaabb38610fd18aa4bd8c10fc1adad596c7f9
SHA512 28656c384d1244277d0f42d598943d5227a18a28397a00b619b13575ad91e4eaa1366b7ef766d1f83b92f5d632c78e77ea220ac02f15acd2df89647f38b37cc2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7920cffcd45ed84888500f10baf9f46a
SHA1 ddc730e55e4e58a70a8f52c4d7f7c537b4e7ea8a
SHA256 b14f369d5c6cbdb98f6cdf6328e710a38faf29c1a4320c1cb024528859c68f69
SHA512 4820b952ac71d35ec68eb00dcdadad87e991c52b6228630924c2abc6ce3b58475392827f13f4c87670790751a9c3f2fee9160f14a83e3eefd9399188676206aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5295f6211f39bfa794b67cd1e48107be
SHA1 9e52bf3920ec4948a7d3aaf82567a942943454a5
SHA256 c77ea24f824bb0c4b3dc19ac8fe30b4799fa1c2ce0a468687a32fd9b052e2242
SHA512 76a651650655272597dd177c2f43c995b0b580cb49534c1d843fdb1c62578100a5cc1f977e34efed42ceaa81ae1a534802e413c33dd078c700591bc36bd1379e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0aedb5c2c364551e664948b850dffa0c
SHA1 45f485b9b363925acfa953ce535239aa9621e0b6
SHA256 9e77d65fc43f51373aaafeb799a0a6c8376fd5479accfbc1f55355fcf683102b
SHA512 9bd775327532fd903e1963a0d046e4850ec32a4c93505ecb0b16448a7ecb6a176c5f68192fab4b40adeea56ed7de702a4e74ba622fe78abbab074e083f6f1a41

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ad358829b8eb57d131ebdfae64e1956b
SHA1 e451cee82e8d07e245f7c4f17dde24bb7dbd1f3e
SHA256 8d3b77a6bbc0a7cbdc4f69edd137423857a95e434b9274f231d52d38219aef16
SHA512 803cee89f25cfa12aafb60f847cff9e749a372fb0d4b9d3b36fe5e60e07217217fc59e16d67c20a7c4bd4be66799b6dace42765c013ba5ae9d9726b9dcd4e98a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 320a7c5b2d4663389c22f0b8dce12f4f
SHA1 62d16e7dbe439c1443d530408bd7a1f58a5ca9b4
SHA256 ef2d2e11ba23226bad74b3ee4c6f064bfa43fac302a653fcfa794f2fd753ce70
SHA512 f54ce3e3a74aa0005edc1e894a80291b61641a6dbd26086fc95c1e7c34e26b31dc37373773188ce54a4ddeed321f2b62c3831dfad3e1e58220f66aed1335b6e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 448a780b336ef1794616f48f23621f42
SHA1 573c4974ca4795d0480ba29294a18258bfbfdd6b
SHA256 dcb162ca4d1d0ceeddfd99625444b0d1dce85562ce747532c332613446429fac
SHA512 af4d837b2d835048fff47bd87e20eb7eebde157f5126cdaa105478f3cdf9232ad9abc92138951a140bf8469c2ed9dfd8ca5642b210e5ce9a457ffbdf35df2570

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4beb3d129662fd309b98aa794d53c9f5
SHA1 3d7bdaf99c5030c016a5e684b9e9779293c37e0f
SHA256 3f9a3d4392ccd01e10137ac19151cc34e1db6c04957c0449a7757c6d278cf137
SHA512 0d4a2b5a28e8bd8e464c86c41b68333ae6e93c72c8f25be276459e94cbde6e148b4a54483dbb0f510db0b6c6e222048391f47b6f6e0fab41655974d8bc525709

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5fe3adf62c4267faca4236fb0390be31
SHA1 0455c17af2c8054c55efbc5499b72970d4ca65a0
SHA256 9a0514b2cd21a6f1a81eb275dbbf03836a33c4a8dc3622078f23831a1a29760b
SHA512 5bd4da234d548f861e990a46fea298c81e278e805ae805be26afa713dd3d14f213a5bb324b5fb0358d44f5280fe45a7edbe01a8b6df8386ff8325706d815e37f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fbec6cd2b211b19cd17dc4955c7610e1
SHA1 9e7d8370bdeb235ec89dfbe04a811b8fae9f5e6d
SHA256 55e8432809f42caef9f6a1783f15fb30a5fea2cbfcca4efc4b2bbd61e778656f
SHA512 b0bcb9129e058cdfc22f778c6190c4a693cbad5935b3a9c9a57fb061c6921da106044f35c61adb10f108444a4681d361c3b1feb899c8ff70a3d0ca5835d2e04b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d13684ebfea361efc980f26fea34a0e
SHA1 af89ebf00469efb65ebece50e3f0e04ef873b55f
SHA256 ee6b0198caf7dc1b2694f7be2436f5f3773baf298096f7b558cde7fcd8a8e807
SHA512 58444f197253f78fdcb85a68485d481844a089f71dd5108024678393af60672deb4b7bcea11b11b26d6461f34dd92ffdfca40777ea919c1e1829855c94680b7a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 002c539efb0b0878530338f1ccdd28b0
SHA1 0b426f7d53dc07f2c951767eb37c89c9cca23736
SHA256 48e48ade27c056f4e0deccabe68dd1d4ba017becf452f6c2958aa6056c5dbe17
SHA512 293ec32cd720b9ff41f6e2d7f448a3ce5d0bcc84c6bf8c3021a382452c594f9467a99b5e8e55e3dda6aea3270405693854ba698bad22efaeb685fd1c71d7a181

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57cf0101bf8c89a17283fd10fb063017
SHA1 40b3aacb3de115f90650cd3ad0d97dce32fa1fcd
SHA256 b7307ae80c2eb4ef38bcb257e0aa208d7c8bfeb8ad6ed0ad82a64fe038aa9e39
SHA512 895f569cf19c1e075cb2798ddaff7d67df26f4a3436e8ca0b07dea64c79f7b8149a189074caf35e256930afb1cf1774aca62276463853a36d24161be8678312f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bbd648d09322168d30f967801f01188d
SHA1 9ecd98ead64a40029541f28277ecfd8a1bede250
SHA256 55853abb8a0e782d3999a4cc79ce9d6ff9a6a84cebb62b9ff64344a4d980beb9
SHA512 587341c7513ad6041f72e1df4397a958210546e40208b89f12f992d85a969fff91d2c79454e8db9dbd0f5bd196330dcc4e75756858617f90a126f488774f6773

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec3806577608d903eec221d37abbf1ad
SHA1 e9c8b9700b79c62e86a9ecc1c53f7e514aa23dfc
SHA256 a0a388df720676dd25a84df6e882ab3c49ecc4bfd2b738f63660e237865a5e9d
SHA512 f4c7045cbc2744e2e7332a0a5b1aa38aa4eb64d6f383030be629f632c462a2d2f03a3d74350de29538656106f776b2291a3c71577271d929f3503d74fdf8911f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a7221fe2954a3d5f81f5b88657d0a85a
SHA1 c8b2e798ecfe831e0833202d824cf2b034e47c1a
SHA256 e5db68ea27432ed5ea05dfe2c8b3cb8af609f061acf0d8322426ccaead3196c6
SHA512 a06b2a5ca73de21b00895f32c82bf3734ca01541237ec4b5722d61deed01c1a0d6a4fbb30bb9d446de24d9d70a6ce1a8e51221d5abe464596f3ed51f0789cdd0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 783b682b8f9566e7ea7663ebc8b227eb
SHA1 0f140e2914841c05687d0d97a02484f8986b8298
SHA256 c57b5a918d62b5fa028b40fb7bf637950c8f8c5221530ee19e0ffeeaf9207789
SHA512 2332f76b6066aba28e4431c829238a1ac0e4d0938a43a049472165e900c1e6043950fe335a0cd68237218292524365eccec6292ffb72ab5964d20746a5126384

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 292d8687789a462cf9adee472c774b79
SHA1 fd44e0e0dfc23641430243d69de3663fc78230ae
SHA256 38dd8fc60058bfadce65477ff0e4fe61ed3cc09e7ff66cdbb07d78865cc519fd
SHA512 01cea0781caeb77f14601928f03bc051239d96509e0023809e645e433393fa8b41fc4ced92cd56ee55d576219bb4dde694684b18260d323f64fb60bcbce2485e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 18:30

Reported

2024-06-25 18:32

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240602250.txt" C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A
N/A N/A C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File created C:\Windows\SysWOW64\240602250.txt C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\svchos.exe N/A
File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 4480 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 4480 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3688 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3688 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3688 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 3268 wrote to memory of 3772 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3268 wrote to memory of 3772 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3268 wrote to memory of 3772 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 4480 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 4480 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 4480 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1732 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1732 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1732 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4480 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe
PID 4480 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe
PID 4104 wrote to memory of 2752 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 4104 wrote to memory of 2752 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 4104 wrote to memory of 2752 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
PID 948 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 948 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 948 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 2980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1876 wrote to memory of 2980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1876 wrote to memory of 2980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2980 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2980 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 2980 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 1608 wrote to memory of 3744 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1608 wrote to memory of 3744 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1608 wrote to memory of 3744 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1876 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1876 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1876 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\svchos.exe
PID 1876 wrote to memory of 4612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 1876 wrote to memory of 4612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 1760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4956 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4956 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4956 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 4612 wrote to memory of 2340 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe

"C:\Users\Admin\AppData\Local\Temp\aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe

C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240602250.txt",MainThread

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\\svchost.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul

C:\Users\Admin\AppData\Local\Temp\svchos.exe

C:\Users\Admin\AppData\Local\Temp\\svchos.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3b1046f8,0x7ffa3b104708,0x7ffa3b104718

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2036,9728984171224948373,12350219616838327918,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

memory/3688-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3688-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3688-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3688-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3268-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3268-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3268-13-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3268-17-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchos.exe

MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

memory/3268-24-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3772-28-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Windows\SysWOW64\240602250.txt

MD5 ffa7ae80adab65018ba485e5380ac4a9
SHA1 951abc7f0a22299d3869ed9210c94dab84109d11
SHA256 215dfca5e51916fb3977bcfc5ae9bca1e50392a48e28a16ee3ef0950b28601a0
SHA512 11238ea671a52dc1fb95a9d0db3d3746e255816f1c918fea8567029cf0e1a678399440786f63302dc00b4a084de9997a0b057b6eacfbab15fcf179586bcf4af2

memory/3772-37-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3772-29-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3772-38-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_aac8ce08e78b115ab925fd1db1885986e262d7ec92c176a2133ec6317a912bc3.exe

MD5 66eb21741ecfc2a8a53a24d65ec7a40a
SHA1 6d70532a0b9a1012da004bb78461fff8d9845253
SHA256 64cd27f902fdf3e74c2ed74f7640ec000441ef46daffa20416da582e751b18a8
SHA512 47289021ab9543a30a2ab647f42619cba048be9c03f4b8c6fbc888bb7167c0cd8868e482114874c0b6c8f02dc48b6e87d22b1c4f04e53a0d20b62897199955be

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 21d3b31ce900a5efab1edc2f6c0b716c
SHA1 158f042106662d40d24632183d64b2ca4f65b044
SHA256 8a525fded0f15ea9c0931db151db2d5a8973cf895ee788e31ea95d2390509568
SHA512 f6f27fabdc567a17c0fe768c9f49b68e7f60092e8058c94e92baee98bbe2d768fd117e7327887714669c76430df5e395480946b92fe0ca5b1ea5cf17e6892b72

C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 4e71d20028422f852cb2dc2eb6362d18
SHA1 8cda077418f0299046376680efe78bc87c8a8fcb
SHA256 21062a9c50f2145d3c2c3d3dabb1df99aee16619ce9d4c2d603c4a5491ef5458
SHA512 5abe1f669943d7acb8b789b3693895bd6485fc25fcd78035db4d08830eba913e5537edf045aff37356fd30f337b2c75f4e956ff5277b327c6ce4a6cb92ecb335

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

memory/2340-140-0x00007FFA47B50000-0x00007FFA47B51000-memory.dmp

\??\pipe\LOCAL\crashpad_4612_FCGWBSSZKFPYSQRA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cdbc1381e60ea1468ffe64776a08fdca
SHA1 1a57a8fa6f475aea60d7ee6c35237c1014393431
SHA256 29420678f3e8c8a17bd42d4592f55d0e475b9a90162c5e3fb8762d7d2df390b0
SHA512 b28580f097d88a3fe42c42fd09fbab050c3aa4e9c287d92e013960df4d60803637969ff6b0a330f8226bae05171680be12fd925b95ff50b7b026ede0297c13a1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 713e6a1097f5a2897085d564eee44d14
SHA1 f00199b137176900fc07476111f25aabc9615a75
SHA256 bce39c13b162e8c3f321fe9f140389213c4456e28a1237e3f9bafd46d55bfc70
SHA512 f841d7b7b366fb8dbeebe2fb491a0d6966cc58e3e2ed4ce01262ee5deb4c15e3a78b62388619139b40c19fe1834491d1acf4279ddc4316f5afac728c317db841

memory/864-220-0x000001AE3E740000-0x000001AE3EE7F000-memory.dmp