Analysis

  • max time kernel
    129s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-01-2025 18:38

General

  • Target

    223222172afb8524c029bd41c2caed91dca570c21eca259225048cf5c29e0d48.exe

  • Size

    1.2MB

  • MD5

    7cda509ca49db183290aeb01e6176902

  • SHA1

    251929de07d28dff8f036ee2df4da5ced309bdde

  • SHA256

    223222172afb8524c029bd41c2caed91dca570c21eca259225048cf5c29e0d48

  • SHA512

    928d7504946a105627d581c3654b1e93e2a0b6f9957b14a75614716a054d6848b21c06e613fed2b1eddad7f491b21878b35c040b416312bbec6462501ecead8f

  • SSDEEP

    24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiK:WIwgMEuy+inDfp3/XoCw57XYBwKK

Malware Config

Signatures

  • Detect PurpleFox Rootkit 7 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Gh0strat family
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Purplefox family
  • Drops file in Drivers directory 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • VMProtect packed file 10 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 7 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\223222172afb8524c029bd41c2caed91dca570c21eca259225048cf5c29e0d48.exe
    "C:\Users\Admin\AppData\Local\Temp\223222172afb8524c029bd41c2caed91dca570c21eca259225048cf5c29e0d48.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4752
    • C:\Users\Admin\AppData\Local\Temp\AK47.exe
      "C:\Users\Admin\AppData\Local\Temp\AK47.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:5004
    • C:\Users\Admin\AppData\Local\Temp\AK47.exe
      C:\Users\Admin\AppData\Local\Temp\\AK47.exe
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:436
    • C:\Users\Admin\AppData\Local\Temp\AK74.exe
      C:\Users\Admin\AppData\Local\Temp\\AK74.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4352
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4580
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4616
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4768
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
    1⤵
      PID:768
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
        C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240638281.txt",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2012
    • C:\Windows\SysWOW64\Ghiya.exe
      C:\Windows\SysWOW64\Ghiya.exe -auto
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1896
      • C:\Windows\SysWOW64\Ghiya.exe
        C:\Windows\SysWOW64\Ghiya.exe -acsi
        2⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Executes dropped EXE
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:712

    Network

    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      7.98.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      7.98.22.2.in-addr.arpa
      IN PTR
      Response
      7.98.22.2.in-addr.arpa
      IN PTR
      a2-22-98-7deploystaticakamaitechnologiescom
    • flag-us
      DNS
      69.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      69.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      197.87.175.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      197.87.175.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      85.49.80.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      85.49.80.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      21.49.80.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      21.49.80.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      133.130.81.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.130.81.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ghiya.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • 43.249.193.73:54997
      223222172afb8524c029bd41c2caed91dca570c21eca259225048cf5c29e0d48.exe
      260 B
      5
    • 43.249.193.73:54997
      223222172afb8524c029bd41c2caed91dca570c21eca259225048cf5c29e0d48.exe
      260 B
      5
    • 43.249.193.73:54997
      223222172afb8524c029bd41c2caed91dca570c21eca259225048cf5c29e0d48.exe
      260 B
      5
    • 43.249.193.73:54997
      223222172afb8524c029bd41c2caed91dca570c21eca259225048cf5c29e0d48.exe
      260 B
      5
    • 43.249.193.73:54997
      223222172afb8524c029bd41c2caed91dca570c21eca259225048cf5c29e0d48.exe
      260 B
      5
    • 43.249.193.73:54997
      223222172afb8524c029bd41c2caed91dca570c21eca259225048cf5c29e0d48.exe
      260 B
      5
    • 43.249.193.73:54997
      260 B
      5
    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      7.98.22.2.in-addr.arpa
      dns
      68 B
      129 B
      1
      1

      DNS Request

      7.98.22.2.in-addr.arpa

    • 8.8.8.8:53
      69.31.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      69.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      197.87.175.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      197.87.175.4.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      85.49.80.91.in-addr.arpa
      dns
      70 B
      145 B
      1
      1

      DNS Request

      85.49.80.91.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      21.49.80.91.in-addr.arpa
      dns
      70 B
      145 B
      1
      1

      DNS Request

      21.49.80.91.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      133.130.81.91.in-addr.arpa
      dns
      72 B
      147 B
      1
      1

      DNS Request

      133.130.81.91.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ghiya.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\AK47.exe

      Filesize

      91KB

      MD5

      423eb994ed553294f8a6813619b8da87

      SHA1

      eca6a16ccd13adcfc27bc1041ddef97ec8081255

      SHA256

      050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218

      SHA512

      fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095

    • C:\Users\Admin\AppData\Local\Temp\AK74.exe

      Filesize

      400KB

      MD5

      b0998aa7d5071d33daa5b60b9c3c9735

      SHA1

      9365a1ff0c6de244d6f36c8d84072cc916665d3c

      SHA256

      3080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a

      SHA512

      308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850

    • C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

      Filesize

      92B

      MD5

      29ce53e2a4a446614ccc8d64d346bde4

      SHA1

      39a7aa5cc1124842aa0c25abb16ea94452125cbe

      SHA256

      56225be6838bc6e93ea215891eacf28844ae27a9f8b2b29bf19d3a8c2b1f58df

      SHA512

      b2c5a2708c427171a5715801f8ea733ffe88d73aaaaf59c5c752ea32cbe7aae8526cc26eabe84ad5043174c0c69b1d6b15a9fb125c15accfac3462d5d08a0faa

    • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

      Filesize

      753B

      MD5

      4fad5057a42ee67f052617964bc9cba2

      SHA1

      2731d731c7a42fffabd4243a678ca9608aef2e0a

      SHA256

      9dd6558fc9e4bae67119a3a8b5211353b09b176dc66d91a746a0ce256a635625

      SHA512

      1e357208208770bec7a7b9fb4f1763b0da499ccbefc155816d283161c73a3d573982f99f18a00349fd52f02bb29d4ffb0181cfe0afaa0837a0482ff78bbf618a

    • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

      Filesize

      1.2MB

      MD5

      77dfb73f77b2b45a460cb163fc2b0aab

      SHA1

      1b620e6688cd4a7178cd47be2ea46f8f90763ad2

      SHA256

      2819f4b80be075fc9c4b570b2ded26ff46ef92082b37004ea00029c5ecdbcd54

      SHA512

      6a808cb6e7ea274c4579f88820efb1aa4f13f92ab96f920857a15eb9a48f8e933fdd4bfd31fd2c3ce63b31682da5a16d2b6745c3b23460c09c59f9c7386e9738

    • C:\Windows\SysWOW64\240638281.txt

      Filesize

      49KB

      MD5

      17557b4d8cc1e0d7f214209dd6c9e7c4

      SHA1

      a5d46611b055b6381d41a43ab239c038a9daa3c3

      SHA256

      e43c35eef4719d992e596d8898ab4b663ac3dd8364f5774271fcd61acc704e8b

      SHA512

      5fbed80c4f940502b32313f07d13835c8a71d70e7228c4e70aafdabbbc8680f18108b34edb4ba2a47ece2a58cd376dde0dece22e8bfd946f4acd26446a6abf83

    • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

      Filesize

      60KB

      MD5

      889b99c52a60dd49227c5e485a016679

      SHA1

      8fa889e456aa646a4d0a4349977430ce5fa5e2d7

      SHA256

      6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

      SHA512

      08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

    • memory/712-54-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/712-49-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/712-52-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/1896-39-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/1896-38-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/1896-36-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/4352-31-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/4352-28-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/4352-30-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/4752-0-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4752-70-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4752-73-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4752-76-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4752-80-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4752-1-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4752-83-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4752-86-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4752-89-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.