Malware Analysis Report

2025-01-02 15:16

Sample ID 240625-wxwyfsvfkh
Target 2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9
SHA256 2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9
Tags
gh0strat purplefox persistence rat rootkit trojan upx discovery evasion spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9

Threat Level: Known bad

The file 2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx discovery evasion spyware stealer

PurpleFox

Gh0strat

Gh0st RAT payload

Detect PurpleFox Rootkit

Sets service image path in registry

Drops file in Drivers directory

Executes dropped EXE

Reads user/profile data of web browsers

UPX packed file

Loads dropped DLL

Checks computer location settings

Checks installed software on the system

Checks whether UAC is enabled

Drops file in System32 directory

Checks system information in the registry

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Runs ping.exe

Suspicious use of SetWindowsHookEx

Suspicious behavior: LoadsDriver

Modifies Internet Explorer settings

Enumerates system info in registry

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 18:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 18:18

Reported

2024-06-25 18:21

Platform

win7-20240508-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000007b690dd421e051a6d1f0595448e1c4b73b28b24d90159a58af887ae28730ddce000000000e8000000002000020000000c1d628ee1380417bfc171d345afd221ada4353f54a5148193b49fa4dd9e3364620000000330daf6bce83441604c7b447ede387d0d2fab225795fc11718ff1c3098622a8a40000000e9986c36ea040108ec6b28f429a26b9f800ee800873d4f14d3a1356f0594f81dc7d912b6e64c0e23aa0ee04efc0edd5907bdaa83769462af7d0ede7168e8ae85 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e8b6312cc7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B897AD1-331F-11EF-A649-4E87F544447C} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005c37628113ca2e7ec905fe158f480605d31f5f7110e18c38ed82af8c70b3afda000000000e80000000020000200000007399c7aaf316bc9f81914622bf7f6b01bae559a42af3c412c297b21b154e086090000000d1b29d43cec4368db1879b03cee37a34ea106f0b90b3897e1af46faa5efe58c7a7ac634e07636cd12a2249c056c30378c78f7a3da00c4554e1615b866ad35ce421e918c361c0378b27347bc196c6665c8fee5b81969439821422bd94ff6f2c4f1ff353fb96ecc0d765df54482b69d7767155b24c5cec7f75e9a7e9135825c01e969097c028473bac656d67ea4f216c4f40000000a359dfe7b533eb3bf2ee857b9c1bbcd92e64aa68877bc49a446b8d7c2797d3183d00f37a8a28bd61db4ba2262e0caf892ea7470d6301e75905ccdcb0af6bcfb5 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425501392" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2416 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2416 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2416 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2416 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2416 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2416 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2416 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2216 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2216 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2216 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2216 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe
PID 2416 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe
PID 2416 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe
PID 2416 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe
PID 3056 wrote to memory of 2788 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3056 wrote to memory of 2788 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3056 wrote to memory of 2788 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3056 wrote to memory of 2788 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3056 wrote to memory of 2788 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3056 wrote to memory of 2788 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3056 wrote to memory of 2788 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2644 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2644 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2644 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2644 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2748 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2748 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2748 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2956 wrote to memory of 1300 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 1300 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 1300 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 1300 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe

"C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe

C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://pc.weixin.qq.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 pc.weixin.qq.com udp
US 8.8.8.8:53 pc.weixin.qq.com udp
HK 43.155.124.49:80 pc.weixin.qq.com tcp
HK 43.155.124.49:80 pc.weixin.qq.com tcp
HK 43.155.124.49:443 pc.weixin.qq.com tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
GB 79.133.176.213:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 res.wx.qq.com udp
GB 43.132.64.188:443 res.wx.qq.com tcp
GB 43.132.64.188:443 res.wx.qq.com tcp
GB 43.132.64.188:443 res.wx.qq.com tcp
GB 43.132.64.188:443 res.wx.qq.com tcp
GB 43.132.64.188:443 res.wx.qq.com tcp
GB 79.133.176.213:80 ocsp.digicert.cn tcp
GB 79.133.176.213:80 ocsp.digicert.cn tcp
GB 79.133.176.213:80 ocsp.digicert.cn tcp
GB 79.133.176.213:80 ocsp.digicert.cn tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/2216-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2216-12-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2216-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2216-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3056-20-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe

MD5 66eb21741ecfc2a8a53a24d65ec7a40a
SHA1 6d70532a0b9a1012da004bb78461fff8d9845253
SHA256 64cd27f902fdf3e74c2ed74f7640ec000441ef46daffa20416da582e751b18a8
SHA512 47289021ab9543a30a2ab647f42619cba048be9c03f4b8c6fbc888bb7167c0cd8868e482114874c0b6c8f02dc48b6e87d22b1c4f04e53a0d20b62897199955be

memory/2788-32-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2788-35-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 78c18e00fd4b4a614e53a3954dd59f24
SHA1 d5b0a6be5be18b812e64bce543f035d286acee59
SHA256 eccf3a7068f3176ff6834c710944424879d34e649f46db6d11a84cdaee620810
SHA512 8aaeff40f5e6e79eda6e6baab66595978e0f674da77d552f45a0c9a409f18b957007e87dd574fecfe84754f50f9f2c08da297b43c036dbe3447ff794c2ed8087

memory/3056-69-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2788-70-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_9B8670363F58B4643EB28A4A03EE9887

MD5 04ec7192d24d44ec17702fd6d9b675c9
SHA1 3838c42dbd6a66149e3ace3da073a8d78db3ccce
SHA256 ed3168ee4f75076cc37dc3c48e9b5e6dcdfe29281293dee85c13c90c9aec1ea9
SHA512 e016ff25b9cdf3de80b249004fe6d3a7f12679f40e6d02d70f2ab4ada560b49b3f91c6c859791a6bc740c22d7fb4abb3eebf39d837a8bb69ddf65404f8349cbd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eb72dca4cecad4c390103faaa2f82e5b
SHA1 9179d765aed5496a94becc42c3f23c294334ce20
SHA256 14c92b3abc163f9e1ed520012fcacc275f23e533e104d0a512bf4d58d0f0004c
SHA512 2ad9fdb1a3eb59edf0b746a79b3c33291766e6279ec4e8a47712f27fee7f8c8cdcb702397fe04f80af2c103b8bedcea077ddead5b8b5acd14600525d217ef276

C:\Users\Admin\AppData\Local\Temp\Tar5C28.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Local\Temp\Cab5C27.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar5CBA.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 48daa8ef4a112a9291850b63f52b039b
SHA1 12da3b4a707c4c80d84668616b0a3c57683fb95a
SHA256 55c3d2cb0dcd39798e0335c6a1013e3184ae1d0deb9901d22fbc4802d842db40
SHA512 4438d944388e902b60b92807b6948a04e5d06c85449b1a41296b1b11fff3ed37d5b304fbe170695f0f2e22b0b3874f06b73593d1dacf21decc44f645c70a9953

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d1da96e72f7695c82f72e0f220339ed3
SHA1 454bc57724c05381e12f56b4090b120d4143351d
SHA256 cdf773284297456030a0a427273eb972b7be0d10c41086b2f5a83e3338e47cbd
SHA512 bc84e0351d6da962fb3d4649fe1da770bc890cd7b7e06b688777386f338440540fe7953643a4eb9bd42b5746d349ff694a70a920c08e79d7c92e538327d0c1a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc03db279b354c9c297cb7f9bdcd5429
SHA1 c505f18647ba8e2e1674156be8ed575d542f924d
SHA256 4b544fb612c5fe9a63b348afd0b10ac95b091c63e21d084aa70e8b24bee22cdd
SHA512 b621dac430559279722553912ed072f2feec0c054205d575d52f9b73f4a1af0b506ec3dfb60efce7b26665c0f1ff04fe520c6495da2f792aa6c0edec051d4c53

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79dc1a55957f8d05db1dbfa6196e537b
SHA1 d4884791dd1c0429d2f209f642484c778d576c5f
SHA256 e9d86383f7fef6c1818a17961a213e0864a250a21838f6e89e2099f8907398fb
SHA512 49759a4ad89d06513af8c5dd4ce31c0e99fa48d16d8c1b5f62af49f869e50bcce28923d3f8d439e56208ea3c1c35cf5d46bc4dd83fde69818d3b3fb5ca0e219f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f833d1cfec395c21938a931e5c8a109
SHA1 333f644bf6ac48d791b84aab3c92164f7b1161e9
SHA256 b6c1f5eeed7cba38dcb43aff59ba610510441f60ca92dae0b36b79e276fa50bc
SHA512 0d65443816844ebaf82230cffdef47540475ba63721e3c71a8884d1169c9ed3a7ff2837e0d3fab304fae8cc39b2ae11fdf3448af80f7d0c93704e50f08c6d054

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a95a490fe47327fb5df5b5e613352aa2
SHA1 fa735d1990c0148e207a58ba796571ed9ae6419b
SHA256 17569e0f84788bed7ba30e832c853c231e610a01abc763e058770ddf1d412181
SHA512 cc0e37176857cbf2e8a6f70aa3b9a83aae6be2b0996eed13925d0d03dd20cb4db8dab9d6b14f2498855c9cfa9d649216c7b2e0c6c7ec46def81edaf7de5ee319

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 427ab8424ea4b7a7b6a01bf60d40f4ff
SHA1 74bdb1c9fdbe67918bc286de186ac4a719e23e2c
SHA256 3b88ec14427c30dee4a99ebe76e84786729c54a99e698a931b7293b69f6adcd0
SHA512 dbb1747e82574d2d609b107e32806c7900548c5f1769c2069897e2249cf47466b9cb749770339af530c34eb65ffc51d6d20232fbda59fbe659e52764572cf5d4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a7860c1950226ae5299cdcbf88f6551a
SHA1 2aa81c6a98d0fb49498b2260068c2a8f0c0abafd
SHA256 2bd2ebc7a1e442dd218abc6c54e291a09a82d787ddd683bf1f56c0bd80482673
SHA512 a407929e2f82674a2c67df1deedc3b095c95e548440eff0c6a41b685ac0682010b05eb3fc5dfdcaf9b31a67d31dc02cc94381bba44242bf6f6e5a33b841e5502

memory/2216-592-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7b7471e4690811df7f36c8c69865a34e
SHA1 f0f37568495943b99a777cd3a1f34fec456061ae
SHA256 1c05bc325e6a72c4a0812791da9c84342127d50b50faf6b616cfd33964c901f0
SHA512 751e69bcd22ed44bc069763e865b003ea0c74fb37ba36a5a3de0457c23f11c9f738dae44eca06b07a1e1b85bdc80edc5d37290cb09637bf07b3e76ce837a5097

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 16bd093bcecf2e0cc6edddb3ba509a9d
SHA1 9109967ccdd6703a8d8f8ce8513f2759aa89faab
SHA256 b90db9451437346a85c38578abf9020dd21cff8523e42a790edbecf191b9226d
SHA512 3430355a86e2432843c5f2220b1ecbdbf6faf33910d689fde54d6063edbf0ae04e7f87a7fc6b992d2dd12258d7a7df140e032e93a015a6cca5bf975e4e9de56a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 c652c3cdfb392deba303836a415984b1
SHA1 5342b8b9f974aa35f9c909f9a24ab204d2315488
SHA256 377175c2ed464b00733b2118d223d479bb4dfea601691bbf92a585796cf013e7
SHA512 2f5850a1cddd36e2317661b354a2121b97dd491f9fe8197a6de6b9d0b072c94a92d835ed931e8a52e1e78cec3464484276c5463f9c035c6703226f83afedeca7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5258f763316cd4bce52b03962b1b7881
SHA1 c2aa30141748785a1798c61ce7039f0ce83fd01b
SHA256 4a5f111f16f7f27e527017c30d5fe6ccc4bf348330622fec2ecd4cf9f1bcdfff
SHA512 5e4be2360c10e56c77d3f76fed173aec5f67df3be6282b84e84d144af8894146248da90d9cda22b315c693a3387a8854d4b11774e34f203dd83f2947a188dd4a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd4b1e84375f10fbad8b64bfe8ddd1c0
SHA1 2a0d9cb1a770eeae21c0f8d98801bcefd526f6e1
SHA256 51f10f52a40b0044df81442aed33a04d45fe47833888ef7b0ddad2efd4e5b8ef
SHA512 c9ac59820558103c61b59069db3499f625969d3fd3bd21f2676c24bb4a0294292c7d8526b8d9c1387994299fc08b51e773dd891d8cd37ef1df78691097ed56ae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2982525ef1ba3d42d71d22400a88f03c
SHA1 9273cee7b76771135b0dfc087ea4b7dee54f8ff9
SHA256 5a6198586292e60fd08b0ae9ce5ea2ef4e3ec4940558e6a38d87a3e2e06e62f2
SHA512 1ae504683c0ca37a358e3b17b8ed99033e39a35c30894b5ca321ea9536ef09fa314c184c770f78c7fa303437493b42ffcb8272fb235705e2896d01f5c45204de

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e9c8bc291a263af607bc178cab055744
SHA1 abc3bfd725ee8707b406af2452482e75457f8754
SHA256 1e739bfa739610c4785736fa557d4cefee97524a7923d9f95840f053d06665e1
SHA512 1739b4886a3b8aa89606f6425724a444c44870b44cae2d12440b9a388d29712d4dd311fc18b29564b776eb66580d007b1ec193ec63136231ea8c7d7b7d5334b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e037ce9527f1829628a98263f8f7583
SHA1 8b626484b1f27c458650bb5d7f67424ca17890e5
SHA256 b94437b2ad638f0a43903774323dea74f5781d83b26acfbfebcde33ce14f9d37
SHA512 3879a50895212a8d50ad66c57fc842245e0bfcb838e605eac8bcb51f9c1d1673a72de7591e3d6b53fcf8b0c1093bd47bcbd30b28e74b55efa101b60170d9d6d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 06ba1db8369e01fedd6432dbd29a8c4a
SHA1 639277f447d23fe894d40ffe8f200fc03aa3e9a4
SHA256 c1c165c0ccd87f69c246ab3d22525291b36993bbfc6577a1c519f735cf4ae12b
SHA512 4d161abac01eb5c8f3ceb2cbe9de42073ed69e96512303a8389421e0aceeed03fad9c7d92eec70d0d9456876ea32b55cf0cb605a782d7581196232d4e605fd6f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d5dad0333c29cd98016c972e831fcc63
SHA1 eaaba09e0f6eca13a878372e618fccb1bccc9314
SHA256 a7ec54a6df00a5a5c79f61226fe915273f6c605dea5ec702db1c3e9d82d7bbff
SHA512 a14d2d9af36d0ed08bbeaf2b352ee66958174b340c8356e721413efea064eb499357ee531dc568c0f3578fceb768c0790f9481cc83e42d787e233c6880f8b15a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 61b86f145ee8a670920c012e4cea0612
SHA1 4ffbbcdf51929ef00f16f48511fceacd96cd3f74
SHA256 94c6cfcfb7ab49263a12affaf6cad63cdc2e6e3934ffbb1640f087023038a755
SHA512 30c598c46d515016d1113f440eb7d0c7687ec26179506961764db930aaea2a42484f2e3e0152745dec11b4227e8e223e2e55c86c9083d1e86a720b8c5e15ef82

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87a19c21d9b192fcee223b5b28973ded
SHA1 6d9a5272d7dc0d3637fc6eee8a38779d8c57fe43
SHA256 4bbfc257f0d37a69ff5d1217df48de934b3599c6c6c69bfd828ff2c0659f5b77
SHA512 81594eb2e8eb776f52d7d663d6fb2a793db3fb388a37e8353237a4a004a2c98061cb2b4f6e0de11b9503cb045dcb56bebe4180f6e663d94ba72aea1d11e0a232

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 18:18

Reported

2024-06-25 18:21

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2460 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2460 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2460 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 4660 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 4660 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 4660 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe
PID 2460 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe
PID 2268 wrote to memory of 980 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2268 wrote to memory of 980 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2268 wrote to memory of 980 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 816 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 816 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 816 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1948 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1948 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1948 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 900 wrote to memory of 4360 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 900 wrote to memory of 4360 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 900 wrote to memory of 4360 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 4360 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 4360 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 4304 wrote to memory of 3828 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 4304 wrote to memory of 3828 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 4304 wrote to memory of 3828 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 900 wrote to memory of 3568 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 900 wrote to memory of 3568 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 2724 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 2724 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 2676 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2676 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2676 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
PID 3568 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe

"C:\Users\Admin\AppData\Local\Temp\2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe

C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba8b46f8,0x7ffeba8b4708,0x7ffeba8b4718

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2104,3763171035984684534,7823488063629183162,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 17.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/4660-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4660-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4660-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4660-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2268-13-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2268-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2268-20-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2268-16-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_2d6c9dbadda80ddf66878970b32ebf4dcd5fd56dea30a59376339af1351bd4a9.exe

MD5 66eb21741ecfc2a8a53a24d65ec7a40a
SHA1 6d70532a0b9a1012da004bb78461fff8d9845253
SHA256 64cd27f902fdf3e74c2ed74f7640ec000441ef46daffa20416da582e751b18a8
SHA512 47289021ab9543a30a2ab647f42619cba048be9c03f4b8c6fbc888bb7167c0cd8868e482114874c0b6c8f02dc48b6e87d22b1c4f04e53a0d20b62897199955be

memory/980-27-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2268-29-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 78c18e00fd4b4a614e53a3954dd59f24
SHA1 d5b0a6be5be18b812e64bce543f035d286acee59
SHA256 eccf3a7068f3176ff6834c710944424879d34e649f46db6d11a84cdaee620810
SHA512 8aaeff40f5e6e79eda6e6baab66595978e0f674da77d552f45a0c9a409f18b957007e87dd574fecfe84754f50f9f2c08da297b43c036dbe3447ff794c2ed8087

memory/980-48-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/980-77-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/980-30-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 bcd52fbc6f223a0aa1809e8079140ecf
SHA1 efb38b93646a494e9b84fb93d24cdca0858a40a2
SHA256 75e07deffb63a443d6d01fa17b7e9f7b0c32add49a06b0c36494346f917245c6
SHA512 84a6cb1694416a81026705f6d18d704e1d3ddcc12020389ca116c42b0bdac28325395ed0725f4651901fcd59c1a2f0058b292d1ee782362e770b7cfb26dd8baf

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe

MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

\??\pipe\LOCAL\crashpad_3568_IKMMLNRRQCZFSZKE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1536-120-0x00007FFEC9870000-0x00007FFEC9871000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a16c90a2490e680e68d2a06607815d45
SHA1 1aef48ae5da9a156dfba5f860829b63596f2a40b
SHA256 07747f8cfc0327faa40c5219e1741e68c92a1be538c9bfecd4f595fd0e730e8e
SHA512 68a6823183d6eff26a359062a03d1dcb1e58b6287cc274251ae1268452c958601ca16d13f031d6606792c79a46268014fea99b298317d9c8bb4e49aa04c53cfa

memory/5080-154-0x0000028698600000-0x000002869869E000-memory.dmp

memory/3596-158-0x0000020E3AF30000-0x0000020E3AFCE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/4448-170-0x000001AB0DCD0000-0x000001AB0DD6E000-memory.dmp

memory/4068-185-0x00000192B9950000-0x00000192B99EE000-memory.dmp

memory/3092-187-0x000002383B2D0000-0x000002383B36E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 75148636c2b3b9c0fa22ea368eb814f9
SHA1 349a7051769f44af00037fe0e34f084b74fd20a5
SHA256 aec17631b97adcfdd9748e91402dbf42bee22906100348fd9ac54e2b51b2b3c4
SHA512 8819c4ba88ed8676b7e229dd31d9ff5616406daa347efe5a2369b6a3bca2eadaca8e5c64677d830183d129282477abf7eb4a310634fdd25376e2d1c456253daf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 631c925e788e994b3997416d9ca94fb3
SHA1 57bc0a69275aa02afb1c9875eb9d84d253a76cd5
SHA256 fa8b9801d98bc4d6f217fd13eddb5b1494adc943262668141fc6841c856aef5b
SHA512 d102fc5a923fd9a8cdaf4c5049f5028f884113f194e040be6a8343fb14e240811ab247cfe46e8791962998a3c07250255569133f92e3f3eddfa6cf39d5ee44c8

memory/1536-205-0x000001BAD2810000-0x000001BAD28AE000-memory.dmp

memory/3052-206-0x000001EA06E00000-0x000001EA06E9E000-memory.dmp

memory/1956-213-0x000001CDCC4D0000-0x000001CDCC56E000-memory.dmp

memory/2268-214-0x000001D50A200000-0x000001D50A29E000-memory.dmp

memory/1536-237-0x000001BAD2810000-0x000001BAD28AE000-memory.dmp

memory/3052-238-0x000001EA06E00000-0x000001EA06E9E000-memory.dmp

memory/1956-239-0x000001CDCC4D0000-0x000001CDCC56E000-memory.dmp

memory/2268-240-0x000001D50A200000-0x000001D50A29E000-memory.dmp

memory/1956-257-0x000001CDCC4D0000-0x000001CDCC56E000-memory.dmp