gh0strat | 1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
Size 2.3MB
Sample240625-pecnjaygjf
SHA256 1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2
MD5 620e8b125c506fb365f138d363cbd829
SHA1 a97a5e246b4033ae6f76cfb724df6449cd8ed411
SHA512 3b2f147c42ca2153e5da0704b931ac36be39102adc3f7f99faead113e7f570a84ca4a28a784235cb817e6aae231d839212b17573675caa7c0eadd0cbdd316189
SSDEEP 24576:ZQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVHonGsAJuH0:ZQZAdVyVT9n/Gg0P+WholGlN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox discovery evasion persistence rat rootkit spyware stealer trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 11 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/2760-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2760-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2760-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2976-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2976-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/424-32-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/424-40-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/424-42-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2976-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/424-45-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2976-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 12 IoCs

resource	yara_rule
behavioral2/memory/2760-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2760-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2760-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2976-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2976-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/424-32-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/files/0x0007000000023527-36.dat	family_gh0strat
behavioral2/memory/424-40-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/424-42-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2976-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/424-45-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2976-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240596765.txt"	svchos.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	HD_msedge.exe

Executes dropped EXE 24 IoCs

pid	Process
2760	svchost.exe
2976	TXPlatforn.exe
424	TXPlatforn.exe
3312	svchos.exe
1916	HD_1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
5020	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
3956	msedge.exe
3268	svchost.exe
3260	TXPlatforn.exe
2672	TXPlatforn.exe
3948	svchos.exe
3976	HD_msedge.exe
1984	HD_msedge.exe
4816	HD_msedge.exe
2592	HD_msedge.exe
2200	HD_msedge.exe
2316	HD_msedge.exe
4936	HD_msedge.exe
604	HD_msedge.exe
3088	HD_msedge.exe
4848	HD_msedge.exe
1660	HD_msedge.exe
4948	HD_msedge.exe
3232	HD_msedge.exe

Loads dropped DLL 3 IoCs

pid	Process
3312	svchos.exe
3964	svchost.exe
5020	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2760-4-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2760-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2760-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2760-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2976-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2976-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2976-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/424-32-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/424-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/424-42-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2976-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/424-45-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2976-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HD_msedge.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	HD_msedge.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ini.ini	svchos.exe
File created	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatforn.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	svchost.exe
File created	C:\Windows\SysWOW64\240596765.txt	svchos.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HD_msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4964	PING.EXE
4836	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
3956	msedge.exe
3956	msedge.exe
2592	HD_msedge.exe
2592	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
3232	HD_msedge.exe
3232	HD_msedge.exe
3232	HD_msedge.exe
3232	HD_msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
424	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2760	svchost.exe
Token: SeLoadDriverPrivilege	424	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	3268	svchost.exe
Token: 33	424	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	424	TXPlatforn.exe
Token: 33	424	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	424	TXPlatforn.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe
3976	HD_msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2760	2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	82
PID 2912 wrote to memory of 2760	2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	82
PID 2912 wrote to memory of 2760	2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	82
PID 2760 wrote to memory of 4848	2760	svchost.exe	85
PID 2760 wrote to memory of 4848	2760	svchost.exe	85
PID 2760 wrote to memory of 4848	2760	svchost.exe	85
PID 2976 wrote to memory of 424	2976	TXPlatforn.exe	86
PID 2976 wrote to memory of 424	2976	TXPlatforn.exe	86
PID 2976 wrote to memory of 424	2976	TXPlatforn.exe	86
PID 2912 wrote to memory of 3312	2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	87
PID 2912 wrote to memory of 3312	2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	87
PID 2912 wrote to memory of 3312	2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	87
PID 4848 wrote to memory of 4964	4848	cmd.exe	91
PID 4848 wrote to memory of 4964	4848	cmd.exe	91
PID 4848 wrote to memory of 4964	4848	cmd.exe	91
PID 2912 wrote to memory of 1916	2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	93
PID 2912 wrote to memory of 1916	2912	1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	93
PID 3964 wrote to memory of 5020	3964	svchost.exe	99
PID 3964 wrote to memory of 5020	3964	svchost.exe	99
PID 3964 wrote to memory of 5020	3964	svchost.exe	99
PID 1916 wrote to memory of 3956	1916	HD_1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	101
PID 1916 wrote to memory of 3956	1916	HD_1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	101
PID 1916 wrote to memory of 3956	1916	HD_1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe	101
PID 3956 wrote to memory of 3268	3956	msedge.exe	102
PID 3956 wrote to memory of 3268	3956	msedge.exe	102
PID 3956 wrote to memory of 3268	3956	msedge.exe	102
PID 3268 wrote to memory of 2960	3268	svchost.exe	104
PID 3268 wrote to memory of 2960	3268	svchost.exe	104
PID 3268 wrote to memory of 2960	3268	svchost.exe	104
PID 3260 wrote to memory of 2672	3260	TXPlatforn.exe	105
PID 3260 wrote to memory of 2672	3260	TXPlatforn.exe	105
PID 3260 wrote to memory of 2672	3260	TXPlatforn.exe	105
PID 3956 wrote to memory of 3948	3956	msedge.exe	106
PID 3956 wrote to memory of 3948	3956	msedge.exe	106
PID 3956 wrote to memory of 3948	3956	msedge.exe	106
PID 3956 wrote to memory of 3976	3956	msedge.exe	108
PID 3956 wrote to memory of 3976	3956	msedge.exe	108
PID 3976 wrote to memory of 1984	3976	HD_msedge.exe	109
PID 3976 wrote to memory of 1984	3976	HD_msedge.exe	109
PID 2960 wrote to memory of 4836	2960	cmd.exe	110
PID 2960 wrote to memory of 4836	2960	cmd.exe	110
PID 2960 wrote to memory of 4836	2960	cmd.exe	110
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111
PID 3976 wrote to memory of 4816	3976	HD_msedge.exe	111

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	HD_msedge.exe

C:\Users\Admin\AppData\Local\Temp\1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
"C:\Users\Admin\AppData\Local\Temp\1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4964
- C:\Users\Admin\AppData\Local\Temp\svchos.exe
  C:\Users\Admin\AppData\Local\Temp\\svchos.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\HD_1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
  C:\Users\Admin\AppData\Local\Temp\HD_1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\\svchost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3268
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2960
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\svchos.exe
      C:\Users\Admin\AppData\Local\Temp\\svchos.exe
      4⤵
      Executes dropped EXE
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks system information in the registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeecf46f8,0x7fffeecf4708,0x7fffeecf4718
        5⤵
        Executes dropped EXE
        
        PID:1984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:4816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
        5⤵
        
        PID:4624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2116,17073733916117088674,11458676858999330602,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3952 /prefetch:2
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3232

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:424

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
PID:3464

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
  C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240596765.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5020

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Executes dropped EXE
  PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 3.2MB
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe
SSDEEP 49152:+t3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMlTZZ2y/B5:+HCLX7nkDnaDIZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.8MB
SHA256 bda71139510cb329e7d38b9e84062f5d3fdda223c2f95fc5cdf02dafc920a600
MD5 5e51bc0845a0feafa306f7af32846bfb
SHA1 5e7758782279902815bdce4167bafd13a1d1160b
SHA512 af7a10abbabc7ff0ec5d9557cae1873f3b5bd7b232599b326a2c7a13688a8221cb7d5274f5ff752822d21fff484eddb1bf6a85227065b159b8c753d4b6ddc57e
SSDEEP 49152:ZQZAdVyVT9n/Gg0P+Whoht3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMt:KGdVyVT9nOgmh4HCLX7nkDnaDIZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fb46a75039958f7ab407aefd56911a8acd7e6763f07de17d9e063aef44f64532
MD5 3642c73ab52fb1c17499a8b420a73cf2
SHA1 872b0a2969c1b89655edc342e525fcb86a91c0b3
SHA512 4dfa1700c98647aa7db83d37a9d29048309e3c8510eeb86803210e87776b1335da35e2b832c0573f7762bb448b402be8b95264d7b16d437409220b18f8912117
SSDEEP 96:nXkXFI1n/wpvWMoiVmdeH2WfroKUWQyV+VD7AiEwb:nXk+F/GWMX7Hrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f17a2909e8423ac49910705c21c719c41681b489ca2aa7c3d02e4594ca40dc73
MD5 640cf596c6dd600d0570bb8c13c725d5
SHA1 4849efb4e9150e97dcaee5b911caefa804638e5d
SHA512 3a8990bd6ae916211279254e73ea7ad327b9eb82ae7458d31d5bf89e70b57232df8fb457adf8c87487442efcc5ae4f6b4bdccedd9462afa090640ffd7bc51281
SSDEEP 96:nXkXOI1n/wpvWMoiVmdeH2WfroKUWQyV+VDCziEwb:nXkzF/GWMX7Hro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7877f2cc1af54a1b75264fed08125bc42ab4d5fd77a10502ea8e8adf0513de18
MD5 4216819b3e173ed5dc60905e464eb709
SHA1 30b36f0f292b5463d025c0c7ee078d02da609ffd
SHA512 5173c14bb7d4505a2e0042251f1f29addbe6143c89944514e5d13b46cbbebea0f7cdd41396905c0bd883c9123b66df87d381ff4151cc4a1a99747b7e1c9d7f1b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOHfbe2RU+Ghh/73z2OMDCx:A9iIxuERzA83h09RZxY0Tu/7aOMWRHq0
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_1fcf098042d1c8953a709262a29a46648af2d8686df167e652b994b408867bf2.exe
Size 647KB
SHA256 caaa46d47506f6503156f4ada2543981741250468a63d54bc6a937818372f9c4
MD5 776fdc0e7331d3d16a6e2eeb956a52b8
SHA1 1960568f4f7d47966e9ce5e3d6fd646b129fe322
SHA512 e53e244770c249622968133b8b217c5084d8cd55dba2a047dd1317deef080c04afa96ee2c51a8cf77ea9449e5d0d322e043ab88773c42c3677f9ed1db1557b8a
SSDEEP 6144:mntDDE565kzLGKlMy7j6solJL4KyyK29PRZH0:mntHE565kzLGnAj9AL4SnVH0
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.7MB
SHA256 30dd01160d29e8bc86013f66b665ca142d5fad6c26ac06e2bd308f9f1d2b81f3
MD5 e37eb7399d39b84aec5c38fb6b0b507f
SHA1 fcbd0b93ddbbbda630e3081aba3ee428304fe274
SHA512 e5cea2a1eea28a0b1d6701181f5867cacfa6edd4ee58e29cfc6ef37b5a8b884ac52043eec80c9b637d934836b73a882f0e450d5122bffc299e06a0ab64fac240
SSDEEP 24576:ZQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVH8:ZQZAdVyVT9n/Gg0P+Who/
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchos.exe

Path C:\Users\Admin\AppData\Local\Temp\svchos.exe
Size 93KB
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
SSDEEP 1536:ktbE7m8nNEQ2O6ReWMWfPbp2WTrW9L3JPPgJ+o5FJYHvh/P6:Bm+2LReWjTrW9rNPgYoTJYHvh
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 377KB
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YgL7:HclcceBKlKwAg0Mja/UafOVwbhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

240596765.txt

Path C:\Windows\SysWOW64\240596765.txt
Size 50KB
SHA256 7ed8c5ad0d962c8d3c4afea0ababcb4a369fdf10c89c41aaaebcb8a7ce8b3757
MD5 730cc57306ac50e3b62084f1a60ca525
SHA1 99a236d798f599c1274253c8c7e9c67be78d8d0d
SHA512 f99186867540db9f1d2c694e0fb9899ce3419413d80df58f2d989a8c010ca213137580375e10621878d9d62f0373ea009b7b97dedc0d53a44fc7d7bf57fba649
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5+JYH:W5ReWjTrW9rNPgYoYJYH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Path C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/424-32-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/424-45-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/424-42-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/424-40-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/604-191-0x00000203AA760000-0x00000203AAAB5000-memory.dmp

Download

memory/1660-207-0x0000022B4BB40000-0x0000022B4BE95000-memory.dmp

Download

memory/2200-143-0x00007FFFFD2B0000-0x00007FFFFD2B1000-memory.dmp

Download

memory/2200-227-0x000001E005B90000-0x000001E005EE5000-memory.dmp

Download

memory/2316-173-0x0000021580010000-0x0000021580365000-memory.dmp

Download

memory/2760-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2760-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2760-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2760-4-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2976-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2976-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2976-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2976-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2976-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3088-234-0x000002F9B8140000-0x000002F9B8495000-memory.dmp

Download

memory/4816-235-0x000001A5C16E0000-0x000001A5C1A35000-memory.dmp

Download

memory/4816-226-0x000001A5C16E0000-0x000001A5C1A35000-memory.dmp

Download

memory/4848-206-0x000002631EB40000-0x000002631EE95000-memory.dmp

Download

memory/4936-177-0x000001A762D40000-0x000001A763095000-memory.dmp

Download

memory/4948-237-0x000001FC901A0000-0x000001FC904F5000-memory.dmp

Download