Malware Analysis Report

2024-07-11 07:36

Sample ID 240617-mz2r2sxeqg
Target b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118
SHA256 38381aa1b897a8c4533a83fd5bfc60fdc9a839b568a26033649005dfc164ad75
Tags
plugx trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

38381aa1b897a8c4533a83fd5bfc60fdc9a839b568a26033649005dfc164ad75

Threat Level: Known bad

The file b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

plugx trojan

PlugX

Detects PlugX payload

Executes dropped EXE

Deletes itself

Checks computer location settings

Loads dropped DLL

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-17 10:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 10:54

Reported

2024-06-17 10:57

Platform

win7-20240611-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe"

Signatures

Detects PlugX payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

PlugX

trojan plugx

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-35-88-e1-3d-52\WpadDecision = "0" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24} C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24}\WpadDecision = "0" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24}\WpadNetworkName = "Network 3" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-35-88-e1-3d-52\WpadDecisionTime = 00824ad3a4c0da01 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24}\WpadDecisionTime = 00824ad3a4c0da01 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24}\fa-35-88-e1-3d-52 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-35-88-e1-3d-52 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24}\WpadDecisionReason = "1" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-35-88-e1-3d-52\WpadDecisionReason = "1" C:\Windows\SysWOW64\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 39004100390039003400370039004400350037003800300033004200310033000000 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\CLASSES\FAST C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1912 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe
PID 1912 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe
PID 1912 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe
PID 1912 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe
PID 1912 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe
PID 1912 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe
PID 1912 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe
PID 2512 wrote to memory of 2612 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 2512 wrote to memory of 2612 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 2512 wrote to memory of 2612 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 2512 wrote to memory of 2612 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 2512 wrote to memory of 2612 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 2512 wrote to memory of 2612 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 2512 wrote to memory of 2612 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 2512 wrote to memory of 2612 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 2512 wrote to memory of 2612 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2612 wrote to memory of 2236 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe"

C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe

"C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe" 100 3064

C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe

"C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe" 200 0

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe 201 0

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\system32\msiexec.exe 209 2612

Network

Country Destination Domain Proto
N/A 10.127.255.255:53 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp

Files

\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe

MD5 bf8c7b6e88a049fda4ebd7407488aca6
SHA1 8b889494f25aafcef5e92b6cc7b2e0e0e217e60a
SHA256 28e0bafc9b20c4a5104d558a36600098429e8ac779a46e52a28edd432e6457e2
SHA512 35a72a887e4389bf7faa5ebe712d569301d03678816b2631712138628f03dd26430682a2ec656ae7167c19314f8c6dc162993789bdb0b3eca298f95c3f27da08

C:\Users\Admin\AppData\Local\Temp\RarSFX0\pdh.dll

MD5 2ab8934a0133f1cf3122b1bbab6de846
SHA1 4e0db9d32f99d724fdaa56d18e9fad687333f18a
SHA256 462713911bac73ee904afab28d19f366b6b125ca7656144142654892319259fc
SHA512 164075833213b164b722854252f5349fdae8cb9ba80028fde7670f5bb90b9dae34befd4e32ffc1cd11ae6cbad3fc3176e77a3a85cdf1583c73153387d6d831c5

C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowser.pak

MD5 768fb7e913b66701a20cdea2abc7f884
SHA1 10e8ddf7333109b430ccaeb87ae644051d120f5e
SHA256 92812f4d34aca0bd7c7e2f67abd2c1813546f2826ec3380fc45a5ea0822ea76b
SHA512 19c261f9b6508288f0e88d1b9f6385d3393bcb92d6a31c521ea6a22955f17d02b9e1dc690812bdaa9a3ad84ba9929a5732529b78b0f6df560bca573170a23290

memory/3064-22-0x0000000001E80000-0x0000000001F80000-memory.dmp

memory/3064-23-0x00000000002F0000-0x0000000000320000-memory.dmp

memory/3064-24-0x00000000002F0000-0x0000000000320000-memory.dmp

memory/2536-43-0x0000000000320000-0x0000000000350000-memory.dmp

memory/2536-44-0x0000000000320000-0x0000000000350000-memory.dmp

memory/2512-48-0x0000000000640000-0x0000000000670000-memory.dmp

memory/2612-52-0x0000000000120000-0x000000000013D000-memory.dmp

memory/2612-53-0x0000000000140000-0x0000000000142000-memory.dmp

memory/2612-49-0x0000000000100000-0x0000000000101000-memory.dmp

memory/2612-54-0x0000000000220000-0x0000000000250000-memory.dmp

memory/2612-77-0x0000000000220000-0x0000000000250000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 48ee62f0e96d2859bd486a77956cfe11
SHA1 6af9e7d180860236dfd836fcce59709f39d63026
SHA256 78a67a5f511dfc1150dd4756f5993e3c4823873fccdbb1507f58a076bc2f909a
SHA512 4ab5030d2d218cabb06a7873f1d8420f04c4f697b0de59c73d9d9336dd173969d89a262dcac8da87ee4ca219efb37ed263444513dd73072d2ffc3e6bd4b4a580

memory/3064-73-0x00000000002F0000-0x0000000000320000-memory.dmp

memory/2612-72-0x0000000000220000-0x0000000000250000-memory.dmp

memory/2612-71-0x0000000000220000-0x0000000000250000-memory.dmp

memory/2612-70-0x0000000000220000-0x0000000000250000-memory.dmp

memory/2612-69-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2612-56-0x0000000000220000-0x0000000000250000-memory.dmp

memory/2512-55-0x0000000000640000-0x0000000000670000-memory.dmp

memory/2612-78-0x0000000000220000-0x0000000000250000-memory.dmp

memory/2536-82-0x0000000000320000-0x0000000000350000-memory.dmp

memory/2612-83-0x0000000000220000-0x0000000000250000-memory.dmp

memory/2236-89-0x0000000000270000-0x00000000002A0000-memory.dmp

memory/2612-91-0x0000000000220000-0x0000000000250000-memory.dmp

memory/2236-92-0x0000000000090000-0x0000000000091000-memory.dmp

memory/2236-93-0x0000000000270000-0x00000000002A0000-memory.dmp

memory/2236-94-0x0000000000270000-0x00000000002A0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 10:54

Reported

2024-06-17 10:57

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe"

Signatures

Detects PlugX payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

PlugX

trojan plugx

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\CLASSES\FAST C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 33003000310045003300450036003000370046004400310037004100350030000000 C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3216 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe
PID 3216 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe
PID 3216 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe
PID 4504 wrote to memory of 1108 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 4504 wrote to memory of 1108 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 4504 wrote to memory of 1108 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 4504 wrote to memory of 1108 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 4504 wrote to memory of 1108 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 4504 wrote to memory of 1108 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 4504 wrote to memory of 1108 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 4504 wrote to memory of 1108 N/A C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe C:\Windows\SysWOW64\svchost.exe
PID 1108 wrote to memory of 1036 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1108 wrote to memory of 1036 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1108 wrote to memory of 1036 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1108 wrote to memory of 1036 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1108 wrote to memory of 1036 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1108 wrote to memory of 1036 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1108 wrote to memory of 1036 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1108 wrote to memory of 1036 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe"

C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe

"C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe" 100 316

C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe

"C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe" 200 0

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe 201 0

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\system32\msiexec.exe 209 1108

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 10.127.255.255:53 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe

MD5 bf8c7b6e88a049fda4ebd7407488aca6
SHA1 8b889494f25aafcef5e92b6cc7b2e0e0e217e60a
SHA256 28e0bafc9b20c4a5104d558a36600098429e8ac779a46e52a28edd432e6457e2
SHA512 35a72a887e4389bf7faa5ebe712d569301d03678816b2631712138628f03dd26430682a2ec656ae7167c19314f8c6dc162993789bdb0b3eca298f95c3f27da08

C:\Users\Admin\AppData\Local\Temp\RarSFX0\pdh.dll

MD5 2ab8934a0133f1cf3122b1bbab6de846
SHA1 4e0db9d32f99d724fdaa56d18e9fad687333f18a
SHA256 462713911bac73ee904afab28d19f366b6b125ca7656144142654892319259fc
SHA512 164075833213b164b722854252f5349fdae8cb9ba80028fde7670f5bb90b9dae34befd4e32ffc1cd11ae6cbad3fc3176e77a3a85cdf1583c73153387d6d831c5

C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowser.pak

MD5 768fb7e913b66701a20cdea2abc7f884
SHA1 10e8ddf7333109b430ccaeb87ae644051d120f5e
SHA256 92812f4d34aca0bd7c7e2f67abd2c1813546f2826ec3380fc45a5ea0822ea76b
SHA512 19c261f9b6508288f0e88d1b9f6385d3393bcb92d6a31c521ea6a22955f17d02b9e1dc690812bdaa9a3ad84ba9929a5732529b78b0f6df560bca573170a23290

memory/316-19-0x00000000022B0000-0x00000000023B0000-memory.dmp

memory/316-20-0x0000000002220000-0x0000000002250000-memory.dmp

memory/316-21-0x0000000002220000-0x0000000002250000-memory.dmp

memory/4640-40-0x00000000021F0000-0x0000000002220000-memory.dmp

memory/4640-41-0x00000000021F0000-0x0000000002220000-memory.dmp

memory/4504-46-0x0000000000920000-0x0000000000950000-memory.dmp

memory/1108-47-0x0000000001600000-0x0000000001630000-memory.dmp

memory/1108-48-0x0000000001600000-0x0000000001630000-memory.dmp

memory/1108-60-0x0000000001600000-0x0000000001630000-memory.dmp

memory/1108-61-0x0000000001600000-0x0000000001630000-memory.dmp

memory/1108-62-0x0000000001600000-0x0000000001630000-memory.dmp

memory/1108-65-0x0000000001600000-0x0000000001630000-memory.dmp

memory/1108-66-0x0000000001600000-0x0000000001630000-memory.dmp

memory/1108-59-0x00000000011E0000-0x00000000011E1000-memory.dmp

memory/4504-70-0x0000000000920000-0x0000000000950000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 b2d61c41a86e9601ce867d1c21b282a1
SHA1 39b99a3bede6353d3fec7936571431f095fa19a4
SHA256 2d1f68e54fcb7804ae310dfff72c43124c04db47108ac99964db4b8f78817c30
SHA512 a3cff32613a133a507b33dc6de34f983b0f2cd8f5bbf812e73041adc38721d722acb154eac962b4b34d79313703f4a0cb97d95a7d04180c22f1107381dbaf5ae

memory/316-74-0x0000000002220000-0x0000000002250000-memory.dmp

memory/4640-75-0x00000000021F0000-0x0000000002220000-memory.dmp

memory/1108-76-0x0000000001600000-0x0000000001630000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 4ab4c23a31f1760703518cb15f6b5e41
SHA1 d2a8bca08012573171c3c2389496531614ccc3d5
SHA256 20a917f2a90d84b417cdb021c84b6eb5fe7bf3afaaea0d05a98b34922a61bcd4
SHA512 9957de7a586b3dccb373a5e56fedd52e0bbe411df37104458aaf38668a35e9ece33d8e8c974b4e8f40f8efff5887f1513924d091b5877eb07ff14b26aa1d9f10

memory/1108-79-0x0000000001600000-0x0000000001630000-memory.dmp

memory/1036-80-0x00000000029B0000-0x00000000029E0000-memory.dmp

memory/1036-82-0x00000000029B0000-0x00000000029E0000-memory.dmp

memory/1036-83-0x00000000029B0000-0x00000000029E0000-memory.dmp

memory/1036-81-0x0000000000B40000-0x0000000000B41000-memory.dmp

memory/1108-84-0x0000000001600000-0x0000000001630000-memory.dmp