gh0strat | d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
Size 2.1MB
Sample240625-nskqmaxdnh
SHA256 d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960
MD5 0815112f5cfbaf3716b43f48d32a89c2
SHA1 812b788de98748ac0feab0410955679ee8db20a5
SHA512 7f51ad6bdc8858cd4c570134fc77cda2f210b0aa380fee0a0e0c5b59ca902210728ec597706c996b1512f0424e00ceb91c38645290bf63895a6d100f756fdf98
SSDEEP 24576:PQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVGXXUFJg5:PQZAdVyVT9n/Gg0P+WhoFXXmS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox discovery evasion persistence rat rootkit spyware stealer trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1156-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1156-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1156-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4996-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4996-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1656-41-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4996-24-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1656-47-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4996-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1656-50-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 12 IoCs

resource	yara_rule
behavioral2/memory/1156-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1156-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1156-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4996-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4996-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/files/0x0007000000023402-36.dat	family_gh0strat
behavioral2/memory/1656-41-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4996-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1656-21-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1656-47-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4996-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1656-50-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240601218.txt"	svchos.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	HD_msedge.exe

Executes dropped EXE 24 IoCs

pid	Process
1156	svchost.exe
4996	TXPlatforn.exe
1656	TXPlatforn.exe
4196	svchos.exe
3292	HD_d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
5004	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
2344	msedge.exe
3352	svchost.exe
4348	TXPlatforn.exe
1240	svchos.exe
3224	TXPlatforn.exe
1252	HD_msedge.exe
4672	HD_msedge.exe
1160	HD_msedge.exe
1216	HD_msedge.exe
2572	HD_msedge.exe
4600	HD_msedge.exe
4668	HD_msedge.exe
4704	HD_msedge.exe
1608	HD_msedge.exe
4464	HD_msedge.exe
5068	HD_msedge.exe
4344	HD_msedge.exe
2980	HD_msedge.exe

Loads dropped DLL 3 IoCs

pid	Process
4196	svchos.exe
3780	svchost.exe
5004	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1156-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1156-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1156-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1156-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4996-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4996-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4996-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1656-41-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4996-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1656-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1656-47-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4996-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1656-50-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HD_msedge.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	HD_msedge.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	svchost.exe
File created	C:\Windows\SysWOW64\240601218.txt	svchos.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	svchos.exe
File created	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HD_msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HD_msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
512	PING.EXE
2176	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
2344	msedge.exe
2344	msedge.exe
1216	HD_msedge.exe
1216	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
3844	identity_helper.exe
3844	identity_helper.exe
2980	HD_msedge.exe
2980	HD_msedge.exe
2980	HD_msedge.exe
2980	HD_msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1656	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1156	svchost.exe
Token: SeLoadDriverPrivilege	1656	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	3352	svchost.exe
Token: 33	1656	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	1656	TXPlatforn.exe
Token: 33	1656	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	1656	TXPlatforn.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe
1252	HD_msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1156	2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	80
PID 2352 wrote to memory of 1156	2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	80
PID 2352 wrote to memory of 1156	2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	80
PID 1156 wrote to memory of 4444	1156	svchost.exe	82
PID 1156 wrote to memory of 4444	1156	svchost.exe	82
PID 1156 wrote to memory of 4444	1156	svchost.exe	82
PID 4996 wrote to memory of 1656	4996	TXPlatforn.exe	83
PID 4996 wrote to memory of 1656	4996	TXPlatforn.exe	83
PID 4996 wrote to memory of 1656	4996	TXPlatforn.exe	83
PID 2352 wrote to memory of 4196	2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	84
PID 2352 wrote to memory of 4196	2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	84
PID 2352 wrote to memory of 4196	2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	84
PID 2352 wrote to memory of 3292	2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	87
PID 2352 wrote to memory of 3292	2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	87
PID 2352 wrote to memory of 3292	2352	d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	87
PID 4444 wrote to memory of 512	4444	cmd.exe	89
PID 4444 wrote to memory of 512	4444	cmd.exe	89
PID 4444 wrote to memory of 512	4444	cmd.exe	89
PID 3780 wrote to memory of 5004	3780	svchost.exe	91
PID 3780 wrote to memory of 5004	3780	svchost.exe	91
PID 3780 wrote to memory of 5004	3780	svchost.exe	91
PID 3292 wrote to memory of 2344	3292	HD_d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	92
PID 3292 wrote to memory of 2344	3292	HD_d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	92
PID 3292 wrote to memory of 2344	3292	HD_d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe	92
PID 2344 wrote to memory of 3352	2344	msedge.exe	93
PID 2344 wrote to memory of 3352	2344	msedge.exe	93
PID 2344 wrote to memory of 3352	2344	msedge.exe	93
PID 3352 wrote to memory of 3996	3352	svchost.exe	95
PID 3352 wrote to memory of 3996	3352	svchost.exe	95
PID 3352 wrote to memory of 3996	3352	svchost.exe	95
PID 2344 wrote to memory of 1240	2344	msedge.exe	97
PID 2344 wrote to memory of 1240	2344	msedge.exe	97
PID 2344 wrote to memory of 1240	2344	msedge.exe	97
PID 4348 wrote to memory of 3224	4348	TXPlatforn.exe	98
PID 4348 wrote to memory of 3224	4348	TXPlatforn.exe	98
PID 4348 wrote to memory of 3224	4348	TXPlatforn.exe	98
PID 2344 wrote to memory of 1252	2344	msedge.exe	99
PID 2344 wrote to memory of 1252	2344	msedge.exe	99
PID 1252 wrote to memory of 4672	1252	HD_msedge.exe	100
PID 1252 wrote to memory of 4672	1252	HD_msedge.exe	100
PID 3996 wrote to memory of 2176	3996	cmd.exe	101
PID 3996 wrote to memory of 2176	3996	cmd.exe	101
PID 3996 wrote to memory of 2176	3996	cmd.exe	101
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102
PID 1252 wrote to memory of 1160	1252	HD_msedge.exe	102

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	HD_msedge.exe

C:\Users\Admin\AppData\Local\Temp\d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
"C:\Users\Admin\AppData\Local\Temp\d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:512
- C:\Users\Admin\AppData\Local\Temp\svchos.exe
  C:\Users\Admin\AppData\Local\Temp\\svchos.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:4196
- C:\Users\Admin\AppData\Local\Temp\HD_d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
  C:\Users\Admin\AppData\Local\Temp\HD_d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\\svchost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3352
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3996
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\svchos.exe
      C:\Users\Admin\AppData\Local\Temp\\svchos.exe
      4⤵
      Executes dropped EXE
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks system information in the registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff0aea46f8,0x7fff0aea4708,0x7fff0aea4718
        5⤵
        Executes dropped EXE
        
        PID:4672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:1160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
        5⤵
        
        PID:560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2072,2132716914953529137,1994107675652823566,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2980

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1656

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
PID:4620

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
  C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240601218.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5004

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Executes dropped EXE
  PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 3.2MB
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe
SSDEEP 49152:+t3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMlTZZ2y/B5:+HCLX7nkDnaDIZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.7MB
SHA256 a9108eb8a8681d809e485f0c82ef1f808e99a1d83b453be1aa014355ea6d1b7b
MD5 e7f93dc915726aa4cf161a2e418ef83b
SHA1 ec1b92c1b998502ee61f1ec3f5b6b820f19e03ab
SHA512 35ccb99653d4ea5b926f958e2441274564dd89f89ed577850bd4c5029d3150ab46e2b053231729bc927adb3486ebf62fc177596c7c42c0049abef26ce9592fd7
SSDEEP 49152:PQZAdVyVT9n/Gg0P+WhoFXXTt3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKh:oGdVyVT9nOgmhKXXTHCLX7nkDnaDIZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a3de32a748d62f99ab75af86ef8fad0ae3a2cb67b7ad0800a09832b9cdd6ef64
MD5 b87d12a74fdc1762b6ea87f01518a2ae
SHA1 f38dec5362a94976e242d8dc3f112a684ec918fe
SHA512 8512d1c182803fc9490c7d8221879b632450108f940c0d3153e0071f8abdc87461de8065f40263735fbc78149af19e1d7ecb49737ac93610a78d032444ee0a83
SSDEEP 96:nqfkPI1VL1wpvWMoiVmdeHBrzEJUWQyV+VDCziEwb:nqfkA/1GWMXiJro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 193fce91c88235370b4b3e44de189d7af7d04db47e8dfaf1a0743846bea55df5
MD5 3dc838d338d5ed91c09469c3a3bc56c3
SHA1 c91371e9d46a97768caa0d0b7d17af1583a8932c
SHA512 926488bdec2f9c60c3d65dbbeedde91a9840f7e54c80cfda10b75d7d4e7d44209c809a15a870cf1e712cf2e7965512fa21e8f306770770698e9e4eb2ea71cbd9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphHTe2RU4jMj28u:A9iIxuERzA83h09RZxYhHDbYy8u
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.6MB
SHA256 040a276b6a4c0e567d4dff2c36331e8746a737a39db5b830441ef971e8d4ac47
MD5 8627f190aa12a6d8cf539453103491ca
SHA1 0324bf5be7cd5dad824f60eb6f3ef0319e40c634
SHA512 1caf74ae3bc9b2d1c4630a0b8aae16a109b7adc2c6711c82eaf4c85f6d9c3a2d0234f35fd5cfcceb72fb8b9519b82b1baa06ae3e8444801ee43c339d34ba59d8
SSDEEP 24576:PQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVGXXN:PQZAdVyVT9n/Gg0P+WhoFXXN
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_d2e305f35990297f5340697f791ff42e1197a923b7e7090ecd7acef300829960.exe
Size 558KB
SHA256 aef253640e5aae96460b734d449af8d93f941aebda3399f5df91a8c0a8e91546
MD5 5da929e7c69ef7f1c5968895e726d417
SHA1 52769fbb111e61bc3f87e1c900686d718e71a97c
SHA512 25db548925d23ac9879625594c60d1d77c052a988130b7b4d5f579d5bac1377321f594082717d419b7a7f6a31d38cb959ff4b836aa31dc2347207e1d35fbdcf6
SSDEEP 3072:ZVWq0xkG1LiF5eOCRMUBRpcynPnKhF5/DrGsrkUd1R3o5:yq0Wyc5eMTMihF5brG29PR3o5
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchos.exe

Path C:\Users\Admin\AppData\Local\Temp\svchos.exe
Size 93KB
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
SSDEEP 1536:ktbE7m8nNEQ2O6ReWMWfPbp2WTrW9L3JPPgJ+o5FJYHvh/P6:Bm+2LReWjTrW9rNPgYoTJYHvh
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 377KB
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YgL7:HclcceBKlKwAg0Mja/UafOVwbhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

240601218.txt

Path C:\Windows\SysWOW64\240601218.txt
Size 50KB
SHA256 8413afad05347abd78f5dae4978213171c52fb3b5eab1137f6228206bc5ebd06
MD5 1de21b050286435e8deb2eb62bc571ad
SHA1 c9e8817e719e22d4eedebcb5ee286dde7c25f24c
SHA512 1dc4fdfc074ad63b34ffff9211ab5928c272cf4b14dff4abf0a3e16e151a345ae046c700d5dee9e77e52c3060525452819e55a8ee20d09e4be1d108539f07a22
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5oJYH:W5ReWjTrW9rNPgYoKJYH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Path C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1156-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1156-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1156-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1156-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1160-223-0x0000026D0AA00000-0x0000026D0AB15000-memory.dmp

Download

memory/1160-143-0x00007FFF19130000-0x00007FFF19131000-memory.dmp

Download

memory/1656-47-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1656-50-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1656-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1656-41-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4996-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4996-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4996-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4996-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4996-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download