gh0strat | 9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3

Analysis

max time kernel
127s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
Size 2.3MB
Sample240606-d6sy2sgf45
SHA256 9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3
MD5 ae0985d80fe1a25a06e7313515a1ee05
SHA1 77e990ebffe8384cdbdb83585490c7c96559769f
SHA512 d05e5a1209ec7303c2f3efd65f7cd3d56e09d4417a35fd6852f3df203468d348f625eca6a3240d079cef5f8633780be0b560185fe9f90e60be2eb76ea18abc6e
SSDEEP 24576:Q09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+21Dfun2nY83qV49:Q09XJt4HIN2H2tFvduyS4Dmn2n/ae
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox discovery evasion persistence rat rootkit spyware stealer trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 7 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/880-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3552-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3552-34-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3552-56-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1852-21-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1852-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/880-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/memory/880-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3552-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3552-34-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3552-56-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3552-27-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1852-21-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1852-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1852-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1852-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/880-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/880-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	HD_msedge.exe

Executes dropped EXE 21 IoCs

pid	Process
880	RVN.exe
1852	TXPlatforn.exe
3552	TXPlatforn.exe
4708	HD_9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
2036	msedge.exe
4424	RVN.exe
412	TXPlatforn.exe
2184	TXPlatforn.exe
5008	HD_msedge.exe
3312	HD_msedge.exe
1788	HD_msedge.exe
3244	HD_msedge.exe
2924	HD_msedge.exe
1104	HD_msedge.exe
936	HD_msedge.exe
1780	HD_msedge.exe
4736	HD_msedge.exe
2524	HD_msedge.exe
452	HD_msedge.exe
4228	HD_msedge.exe
3792	HD_msedge.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/880-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1852-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3552-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3552-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3552-56-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3552-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1852-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1852-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1852-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1852-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/880-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/880-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/880-4-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HD_msedge.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	HD_msedge.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HD_msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3024	PING.EXE
3940	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1968	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
1968	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
2036	msedge.exe
2036	msedge.exe
3244	HD_msedge.exe
3244	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
4468	identity_helper.exe
4468	identity_helper.exe
3792	HD_msedge.exe
3792	HD_msedge.exe
3792	HD_msedge.exe
3792	HD_msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3552	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	880	RVN.exe
Token: SeLoadDriverPrivilege	3552	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	4424	RVN.exe
Token: 33	3552	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	3552	TXPlatforn.exe
Token: 33	3552	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	3552	TXPlatforn.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe
5008	HD_msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1968	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
1968	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 880	1968	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe	82
PID 1968 wrote to memory of 880	1968	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe	82
PID 1968 wrote to memory of 880	1968	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe	82
PID 880 wrote to memory of 1924	880	RVN.exe	86
PID 880 wrote to memory of 1924	880	RVN.exe	86
PID 880 wrote to memory of 1924	880	RVN.exe	86
PID 1852 wrote to memory of 3552	1852	TXPlatforn.exe	87
PID 1852 wrote to memory of 3552	1852	TXPlatforn.exe	87
PID 1852 wrote to memory of 3552	1852	TXPlatforn.exe	87
PID 1968 wrote to memory of 4708	1968	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe	88
PID 1968 wrote to memory of 4708	1968	9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe	88
PID 1924 wrote to memory of 3024	1924	cmd.exe	90
PID 1924 wrote to memory of 3024	1924	cmd.exe	90
PID 1924 wrote to memory of 3024	1924	cmd.exe	90
PID 4708 wrote to memory of 2036	4708	HD_9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe	118
PID 4708 wrote to memory of 2036	4708	HD_9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe	118
PID 4708 wrote to memory of 2036	4708	HD_9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe	118
PID 2036 wrote to memory of 4424	2036	msedge.exe	97
PID 2036 wrote to memory of 4424	2036	msedge.exe	97
PID 2036 wrote to memory of 4424	2036	msedge.exe	97
PID 4424 wrote to memory of 4308	4424	RVN.exe	99
PID 4424 wrote to memory of 4308	4424	RVN.exe	99
PID 4424 wrote to memory of 4308	4424	RVN.exe	99
PID 412 wrote to memory of 2184	412	TXPlatforn.exe	100
PID 412 wrote to memory of 2184	412	TXPlatforn.exe	100
PID 412 wrote to memory of 2184	412	TXPlatforn.exe	100
PID 2036 wrote to memory of 5008	2036	msedge.exe	101
PID 2036 wrote to memory of 5008	2036	msedge.exe	101
PID 5008 wrote to memory of 3312	5008	HD_msedge.exe	103
PID 5008 wrote to memory of 3312	5008	HD_msedge.exe	103
PID 4308 wrote to memory of 3940	4308	cmd.exe	104
PID 4308 wrote to memory of 3940	4308	cmd.exe	104
PID 4308 wrote to memory of 3940	4308	cmd.exe	104
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105
PID 5008 wrote to memory of 1788	5008	HD_msedge.exe	105

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	HD_msedge.exe

C:\Users\Admin\AppData\Local\Temp\9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
"C:\Users\Admin\AppData\Local\Temp\9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3024
- C:\Users\Admin\AppData\Local\Temp\HD_9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
  C:\Users\Admin\AppData\Local\Temp\HD_9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\RVN.exe
      C:\Users\Admin\AppData\Local\Temp\\RVN.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4424
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4308
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks system information in the registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb0c46f8,0x7ffedb0c4708,0x7ffedb0c4718
        5⤵
        Executes dropped EXE
        
        PID:3312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:1788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3516 /prefetch:8
        5⤵
        
        PID:2036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3516 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2120,1741928878844859441,14021841028984675993,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3792

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:3552

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Executes dropped EXE
  PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 1.7MB
SHA256 57d4e7d9925134a80b95fc05aea66c6ef26c78ae3362bb3044f9e6f07ba8161a
MD5 8c3f3d0f59d7564e1ce0080614410c6f
SHA1 a4cc0ca1cc7da5063c864f3130d598a08c23a269
SHA512 666d8672b283db5961707b64016f1022fd8293b9fa4d72db38458ee98320298a226733a1cf219c15c9c761d4a000593e666f7c5c7763d022d01ec0866d25931a
SSDEEP 49152:+t3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EZ:+HCLX7nkDnF
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 2.1MB
SHA256 177c26ff5e877d2138f90a8406882e22725409a7b8ceffef691461398d12b47b
MD5 848ab4e5bafe4c55ebf2d5adbb639309
SHA1 6f91cb35025721541a545bdda4b116950fdc74a8
SHA512 e556871eef9b08f6e9503f2378a594b3bbbdd3e4a1a7a815776e931cb9862ad9af832b7a0b2bcb247aab5e9b01a14d596b76060ac1be7a8255de5aaf23c3d724
SSDEEP 49152:+t3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMs:+HCLX7nkDnaDIs
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 3.2MB
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe
SSDEEP 49152:+t3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMlTZZ2y/B5:+HCLX7nkDnaDIZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 2.4MB
SHA256 9d5853f0c26747d07394c40bcfde24017675aea09d6c418c364fde1311c537f7
MD5 ab3babdf3003fcf9179aa0f4ae8dbd21
SHA1 8597aaf66bf824648b4333314ebbf308b3b0845d
SHA512 db317bc37b2d4990b95cff27302af430dfea21b0dd2ea65184b0df31c03b8d767ca8d1de22dbed6d47563c7d6c9d5023f654e46023f97780d694bc784a4b3478
SSDEEP 49152:+t3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMU:+HCLX7nkDnaDIU
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 2.1MB
SHA256 b1403194c71785fd8b057846a9a3ca8052850726a480969709ed49c5e4a180fb
MD5 aeaec4ac23050216fcd9c99529e68334
SHA1 9971694a45a462d7a614ff371457effa03192e45
SHA512 e0751f3208b033ae11068c9a3d838b88313dc0562f673c4e7f2c49953c70e3c726de03e4e708368d718525f5b44d5b5edb76283f014b6611cf6eef7b22fbedac
SSDEEP 49152:+t3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMm:+HCLX7nkDnaDIm
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 448KB
SHA256 c22cca678b54741969e32d93257baf902f59857df95aa259519d816173d9502c
MD5 60b7c04264464c8bc9221b97f33b0cd7
SHA1 eacd9bcbbcdfc440b46f3b1ce9c2f0d6ce7968bc
SHA512 126f61aa31d1af5ead559d6caf52c43e12f6b119074772afe9a4f78d3ff51a7786464cfa3748ab2e48367f74243dbb54da8fa082b3c34d951bb971a6b3b3054e
SSDEEP 6144:dcHAkhDCoQRevRNb7/7nJYDAuhDU5L+wXf7h/BxEmPn+vAy+9fRvrgP:d/khDDQYP53h/BxE+n+vATG
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 128KB
SHA256 1d8e240b196bff14c49b3e83cf9f2c4bda84f90ff0fac61cd3c9f73d9df713e7
MD5 b872b851ea9db502135c7088ad3f008b
SHA1 a468bd17cf9a1b55f7d3787756c3c70929c7f63c
SHA512 f869eef8cf0e72d20f0278bb6f0a350df1b13f3fd74535befd311e4906554f2d629f46fdea1b8ff7e0d84f5ba96db146a99542b885b67e36d4fa3e84030c24c5
SSDEEP 1536:ucnhHlDiUfKIp1aRbDpOLhee9txJGDMG3+dnU4g6xxJZvk04zjVuHBE3svRHzinH:7XpcbNcheAJGw4+qCS8lihTTKY
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 3.1MB
SHA256 df7b82ff145077eab407e7c8cb0a25149b9a719cd12d39a83853167007e4f098
MD5 80c0ee8c520ef07f442178a726e09298
SHA1 efe2d175bb67164da36cb685482f137a9f695199
SHA512 24270f4a3a608cb90fa80f28b493c79b1ab3a81577d91a75e435b003a2e64650fb198ee1ace318668a96ef3d9550a9b30a3d0a4d2a03737f37fcf27a4412620e
SSDEEP 49152:+t3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMlTZZ2y/Bi:+HCLX7nkDnaDIZU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 2.1MB
SHA256 fc7d957612baea67b3baa7f1eff6fb6375de21032d29a475cb0ae9e8ff7b16cb
MD5 a1d217dcc1c96589259ff335d79ac7a6
SHA1 7bf014eb42dcab36f66f9fe5ee996f4832cb744b
SHA512 fa6d077439ca6f124694bf853bfbbd196daf525b1874caaee8b52f24a4aa689bf58ea61a76ecd4556c88aacb14d5163f884e62cfdfc1c6e0febaf520791c9ef5
SSDEEP 24576:Q09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+21Dfun2WkhD95tnoW:Q09XJt4HIN2H2tFvduyS4Dmn2bt3Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 2.0MB
SHA256 e54a6a883e4c290fd5ae51c8ce3beb219627c7ee1a36278404dcf5c6293a3ef6
MD5 a9393427efb963a1b39caf0542ebf654
SHA1 e6c0a1011383117f16ac8a1574519d3f511ed482
SHA512 cf4e8bb5db18991f4919043f52513561bc787efab17c23b13da7047db3df58b515bbf52c5ec80febce1f0a8cb6dec5fab1a8ca56e66b2de36ccce6ae3498fe2e
SSDEEP 24576:Q09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+21Dfun2WkhDx:Q09XJt4HIN2H2tFvduyS4Dmn2btx
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 bef3aa1f4d011c02390f3becc4ea52b62882b0458f2023d7a4b3e83349ff7c7e
MD5 04cff1ada76ce91c113e261fb8f73a2e
SHA1 f4ba22f56fbf13109ea7564e4bf8f418397bc46d
SHA512 ba522649f24b4aaa833319d0c499287d60f016952c5d4d783dcdaaa9a9fe9eb30d4ae4b5c195e91145574919860dca98e13054524932d8858e77570468c15652
SSDEEP 96:nGkGr1+Pe8wpvWMoiVmdeHpw8EFAoUWQyV+VDCziEwb:nGkwUPe8GWMXpw4oro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7397f54779435da462aa80b349b4729e1b2d93ebc1a0103e3afcf6526055f8ae
MD5 9377ec544082db9513d9ff907a4cec4f
SHA1 4bc3a26fef4c7ee213fac03d9ddc39e8d579722d
SHA512 0c6c9c4743afeaaeddff096f405a563025f23e4baeb2c8ed3f21b47c2d88b1461562b06330ba13c38e53a4a789b0efa06bf2a1b1aa69cb3eab2617c46b6c261e
SSDEEP 96:nGkdr1+Pe8wpvWMoiVmdeHpw8EFAoUWQyV+VD7AiEwb:nGkNUPe8GWMXpw4org
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 0dffac8753d04e76c5bd395e42710cf44729eacd0555379f6031920b6583f721
MD5 6ba44ef8d779c9491dc0fe1bbeb6ce8b
SHA1 6621e84dcda024eb12f654e5f0864331a2a132d9
SHA512 64bb2f23d8e9ce8a11cc4339a7b2f22a4e7129e195b266d14fea2f4cbdcd32ec2758a6029ef16af9270d8f638cf239c4342efaab22f7cc5e07b390d1c65ba673
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupFPjM9e2RUmJ+kE3z2OMDCd:A9iIxuERzA83h09RZxYFP2zEaOMWRHqG
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_9357679c396d35c504f9a754a45d6b8cf193cdec4ddf3fc6d9dab0681ec6b8a3.exe
Size 644KB
SHA256 67f7a19691a795d39de97cb2e5aa02461b2529b14c3d46e5e41a1df255c54730
MD5 f425849e05301fd33488dfc5a81f3ef5
SHA1 ff887ef2d9f5134a9afb0223f2363bd02a0425d2
SHA512 11b2ee9cd829c472819c281fc6a3d0f78ddf133fa50e63d6ef8ed5161451a0acc3059948b7a8f2f57d9646d34289f0a23f7ec00e8bf8e53cabbe0834d25d37e8
SSDEEP 6144:2YnvNGTR65kzLpKhlD24mxirt+XRW29PRtYG:2YnsTR65kzLpA1VFrI59
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.2MB
SHA256 c8cd1ec94258d327c5ecce62adb926d073dec088edddaf6a0913ef7984c1c248
MD5 3f0a63d61997dd3db6442f17b95c5f43
SHA1 4b92fc86de57f174f4b9c5edefd424201393df08
SHA512 7ca63b1808a8e7c8513096a076694b7e5a7b52fc467577116f589e6c23a90a0227ad720cba183a80ca75166925eded749dc5b901c2643786e24aac49a9dcc2e5
SSDEEP 24576:Q09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+i:Q09XJt4HIN2H2tFvduyS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 128KB
SHA256 3967fc041e4a9bb59fe80beddaf6ef728d6414d7aa70fc0fffdb8e775f37b3f5
MD5 93165ca4308855fb4f7cb8d125ef6954
SHA1 fd8cc7c1637236e2aa05d40c110bd2f157e14913
SHA512 a7850361395974b42382ea3d1a401d4ce5225c304263d95d25dc0f1a4d714b1713a9356ba22c7af1a3b430913c29006387000fd5fd23bd431492dfa0c0787d35
SSDEEP 1536:uZYvv41axFjsLmEtPlB6j26YnCMiWSchm49v4Crifdmm9aD1pz9xFl8Lfzm0Q:uZ8F8mEtPvJ6EC5K3RrWdmFz8eh
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.7MB
SHA256 cf3aafcd22549318d89c4dca8f0f1febe69cd8018803476f6d9e8e1ccf0a03c0
MD5 fb1d8296569bcb3582d0c85c6cdd8aaf
SHA1 c92ebe86c07f3bdfbfff40cd531bf95b98d33771
SHA512 1810fbb2ca21db4370ebbd53e6c8ea9aa50c748b4878191dd963391c0577b5da12c480b57a5e67510c4c1713b9b10f5076138e10eff5a7a7cf41e33eb6331f75
SSDEEP 24576:Q09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+21Dfun2V:Q09XJt4HIN2H2tFvduyS4Dmn2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

RVN.exe

Path C:\Users\Admin\AppData\Local\Temp\RVN.exe
Size 377KB
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
SSDEEP 6144:BEo7J1ixs4uVKE9rFEAHKThrBSq2hAzSM5mDo9lSJULHZqExlD2E1LxhJVwIe0Dy:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/880-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/880-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/880-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/880-4-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1788-121-0x00007FFEF7B90000-0x00007FFEF7B91000-memory.dmp

Download

memory/1852-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1852-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1852-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1852-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1852-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3552-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3552-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3552-56-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3552-27-0x0000000010000000-0x00000000101B6000-memory.dmp

Download