Malware Analysis Report

2025-01-02 15:25

Sample ID 240525-hdwlpahe7s
Target 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287
SHA256 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287
Tags
gh0strat purplefox persistence rat rootkit trojan upx discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287

Threat Level: Known bad

The file 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx discovery

Detect PurpleFox Rootkit

PurpleFox

Gh0st RAT payload

Gh0strat

Drops file in Drivers directory

Sets DLL path for service in the registry

Sets service image path in registry

Executes dropped EXE

UPX packed file

Loads dropped DLL

Modifies file permissions

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Runs ping.exe

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-25 06:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-25 06:37

Reported

2024-05-25 06:40

Platform

win7-20240419-en

Max time kernel

150s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatfor.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259394749.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatfor.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\259394749.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52CC66E1-1A61-11EF-8004-DAAF2542C58D} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603d2d286eaeda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422780945" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d23e3a7aa35359ee301dc01dac67f05ce3ed54308db7a341f2caf8cd4b285769000000000e800000000200002000000070fceb0e2f779c090a82d2be0af213c553dbdc7805e826f727a66768b943b31e900000002901fcccaa6ea002e8de0918330505c099ff0bb81b5beff3ea34662ffe06f4a9b72b508efb77a5bfdb7f33452468f47965369fbec95152a9495d416fbcf81f305e84ea83ba8aad32530dd7189184234ad07169137891b9b3b16fab48bff10d38cd82f87c09ae6a13c8558967a808ccf68be70aa96ae0e1cfc92d937ece3099ef99235f3af1d5886feae06d7c4fc0420440000000ce68b43342bc32247f8e715649f187a0d621aceae44db10613177634835946ebc1631436e0b65929522c825ae675b452c30b8fe4331a6735847ee79c09741911 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e25426ca9e464a7c60a98483db48d9ea8654c315b76f0fd0ae3ad492712f707f000000000e8000000002000020000000f841b350dd9868fa75466a428644e4ee4c94937419cf16c954378d75a3c576e52000000020283642642c8254c4743a1159413f9892551450a48973b66ca8976f4919915d40000000fcefef9486dd5f026448d176d56f88b86e0fabc45aa62ec4c25f914a155e219a357b54437b2393614d722b02592116ab9036cb3ac29e5fbd2743ae2cd7a18ef1 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2288 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2288 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2288 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2288 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2288 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2288 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2288 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2288 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2288 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2288 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2288 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2144 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2144 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2144 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2144 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2104 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2104 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2104 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2104 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2104 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2104 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2756 wrote to memory of 2104 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2288 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe
PID 2288 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe
PID 2288 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe
PID 2288 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe
PID 2668 wrote to memory of 2552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2668 wrote to memory of 2552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2668 wrote to memory of 2552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2668 wrote to memory of 2552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2260 wrote to memory of 2424 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2260 wrote to memory of 2424 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2260 wrote to memory of 2424 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2260 wrote to memory of 2424 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 2752 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2752 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2752 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2752 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2712 wrote to memory of 1996 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2712 wrote to memory of 1996 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2712 wrote to memory of 1996 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2712 wrote to memory of 1996 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe

"C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe"

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe

C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\Remote Data.exe

"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259394749.txt",MainThread

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/download-jdk/microsoft-jdk-17-windows-x64.msi

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 aka.ms udp
GB 92.123.242.18:443 aka.ms tcp
GB 92.123.242.18:443 aka.ms tcp
GB 92.123.242.18:443 aka.ms tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\R.exe

MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

\Windows\SysWOW64\259394749.txt

MD5 abbff166b925b71e16e2f02236946cfb
SHA1 a36cccb5fcf54c8d94a0f86f76e8597e8a255f5f
SHA256 b0fe8eee6dcb4e576fb4e0970b0d9a029211c8a72c33b80e12185a79d97d8274
SHA512 513b5c4c24d27446a6faef3b61e984d62b9a5123092180e2cd2a6cab75079febf2c93e6ff2b64d1c7c3acebcded1259ca9035eae795e32375a0d02d884350af9

\Users\Admin\AppData\Local\Temp\N.exe

MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

memory/2144-18-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2144-21-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2144-20-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe

MD5 c40aebee2bf4002f042241a4625176d4
SHA1 3bfb5be63e2438788e431440865cb0dc42f34ef7
SHA256 8e4f917471e96a7f28802a0e816d000aa7156a040a066887672207ca9cb6474e
SHA512 6fabce39177305db58cc95bd7ffac3bf4348c738c158e0c420e1d9bef7020ec81512ddf1d4accceb324bd0127b7d611ae316b418340db465b4ca925c90eaaa3f

memory/2104-46-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2104-43-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2104-49-0x0000000010000000-0x00000000101B6000-memory.dmp

\Windows\SysWOW64\Remote Data.exe

MD5 51138beea3e2c21ec44d0932c71762a8
SHA1 8939cf35447b22dd2c6e6f443446acc1bf986d58
SHA256 5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512 794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

C:\Users\Admin\AppData\Local\Temp\Cab2A3E.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar2A9E.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ccc1949ff4fdccdd3a95aa0d6d4d90df
SHA1 90b92690b636f367062726e9570431561fcf6218
SHA256 e02353096618c3da5d7578a6892342c8985822d81306da110f56b13a7690d93a
SHA512 4a2eaa0a6834299c2804e6612b1e23d446e836854ca82c8fbdbe2539f2042d10e5161576f1e63be96eef2bf33a49036ce82a8bdbbf04e7102e3acd771ed89881

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96ff08c085739792cf01b85d7b5a5475
SHA1 da63312ba126328b47f949ef28e9b4a8cfc50c76
SHA256 9b37ad51f04d050e51eb9c92613bd9a73054cd3044a28ca1d0d1be905bdffa6c
SHA512 29e364842520dd522908e871c6189a37b0c7bc48cbcd09e584760332c874657557abd9505f8e07c717360de7d4e884cd7aa5822eb2f57adad2a1b78f263066b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 475420ac43a8c23fb451a761a711cd8b
SHA1 aef5f4dfcd895df9fa61c8478c6b238026a4f7ac
SHA256 1369db41843af437879394a2725850805d7de31e94ae410999067d07e701dc62
SHA512 6fccc114fd474e6e9f5ace1275f2e4639c4851d9cff1d35647bc11e1f5a3e437afdeab3e6558bf414a22c83f5b2aad368843bd748ce5347aea3fc2ae8c23e2d3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 297b89cb280a81837cc076b23523a75e
SHA1 59ffeafce8f7a96bc46ef6e315a2024230b111ae
SHA256 e735a1b7c1c6ad5a7b5141bfee116173c6a65c672ce0e3aa3c2f45f9402c270c
SHA512 869af9f4740f4c3a71015809eb18285404d6fdd75853f6f5a457efa60fef1c06d0868300dd1b547a64ec2d63ac9e0a75dacbba29ebe7150be1571db6cc130700

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53e117e7de09dd47f15cc68b26f5ede9
SHA1 6cfd7cfd45f783d3b366e2f54a386d33605bae73
SHA256 6dc76cd003ab499723b0e16a005241a4c78d443cd468c74e06bb93cfe136b520
SHA512 e9d12aac3eec5767628b662078bdb30d400c00a27e8500471f6c27da6a582ba85986975f40aedd4db96c1ca19eed7aff9902a467e4dc552b25296071c1ed07ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a5477fa41ce0b852d20d7f1ce1697e4
SHA1 f663befd6efb9e425cfadb95ef2a549b28e73c8f
SHA256 f660315f8def656084c60e06735d51476d99ee4e62cfc71756ba783e47d933d8
SHA512 b9adde4023a70d6fa70be435cd475e16abcf7f36300d45b38c82bcadb9d178aeac28f88e0b0f8502948eac662023d8b5bb71b032b4f93220706263270763880e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6b3eb979091c7c62c98310560ddf49cd
SHA1 ed4a424dd6ccb852e2f44312480930a5cc676275
SHA256 dd8700133b8d6275364e4d0a174e0326f919c8075d582fd37219edfe67dff1ec
SHA512 9c6bf4ea0360e0d0c40e60db9ef830e79b9b67aadc33872a4b378f159dede1990c46033db9c904e75240e13ceb1e1988369ae1e1ef266b6eaad8257b1bada73c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b06ca2aad559565c42e2ca20ca7ee1ff
SHA1 0922783fbd0a6a819d2a2e2e6fefdbfa2c9c227a
SHA256 2458c02327be12968558ec7db6c70715f149ecefe2ece91f25a2f794cf1d6738
SHA512 1ed5396700ca21836870bda7e33f70876039528b18d45d16f848cfad015e9ae3afa9bb6d11205a289afd5ddb31fc71adee055d1c73a1de2ebabded5c9ab0da21

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b24764218befbbdc2c056714cc8bf865
SHA1 b19c37ee41c642ec761e4b139de63e2aaac151b3
SHA256 a95410815e08d1fd2d03f115ee27a7e4c1c033d1d802b6302c8f578017282d0e
SHA512 1c6a7bafcf5afa4aed80d00fde651f8d1c24036f50e48b3d68cef7b46f45067d9ac0344ea576d329c6479e0b3d8b4f107c10d0ab9027ca2df88e3c9eb6996d46

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f0a4fc251431f4c67e85be34f3b93a86
SHA1 f914e863b4322e76c7c46bdc11b579648da5dba7
SHA256 2be59da555936468d0d85cab2b0471b18adbe671de91d6aa0a9a6153a37bc1f8
SHA512 9230706567a5b96392de2954f42208d513b866f2d3af6f1a96b03826c4c1bce8755cc0bfc588f5b43ef8edcbe6c91066230f4fd24619f04aeb899e00c41ba322

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9eaa8a955cb7ac28154e0bf5296390b
SHA1 60d24fe0554272ab4d662b5d2ceb37504a745c85
SHA256 00155d84fd19bde2d98aa5c061a95ccefde09fc98bd9c250dd74799dfa233599
SHA512 864073fdfd72dfb6c42354cf940610b08343d2a38a92ebe5ab8698349fc88babd01adad6b2467733e686a49688d64221d91f73bc9ff7c8b92379fa8f6b253f1c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3dba48ec9a9a8b5d0cef0687c629786e
SHA1 9a67f34a3168bc12e1cee2c0f8c7888ac2e33e02
SHA256 bfb5971ec0c5c7f39d30618d6335a541c290773eedf40c5a69027168be15e8a0
SHA512 431ffa07f14ee529131e6ba84ffd6c3248cda970f3aa8f33fc97112b92828b4c76bbf193379569b44013262228d63e150ef35f342e1b13b0e17af08c0859a7e0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fce8f96d6d6eb27ee9a7c8276ead7af6
SHA1 4c553a18bf556fcc42d23142820dd4faeccbc42b
SHA256 1b389364b0c4a32aeb69549ca5b9243d6e88aed5acf7a45177d3283176f6cca9
SHA512 36a841e86dae7d20a567c61756823f9b927708b71c259f9ba9f6b2555b651f9cd5a54e1665d86248ac01e325131e15831ba0291f0c84f4d13d90fba1ebde3371

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d702e21d6db01ef8e44b5b5f6eadc170
SHA1 415b87f57bb51d1774873de5afedaa415bf644df
SHA256 a43fa866ff5d5949756d6d67f9fcc42a4bfdc0c5b0333435ef797aa285d8b400
SHA512 0e5d9b2bc0b7ac1422bb7c8bf26140c9d83399c20c0740babc944c33f88199f7316190266d480028274bf4bf1b7ede8a75be64a9a5467ff57bb9316131d65d8a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c55964d089666bebe5dc5b9fa6b9d676
SHA1 1f956a052fa3e30a01ff48f8259613b36d732681
SHA256 30d8a3fea49722407f93873c3601f03029ead2a8fcef27467f363df60b1621bb
SHA512 70d7c5974366b643c382f594377c7de6ffe59bc423465a74c8e6a97bd6fe7f30502747a3c61a6d5dc272aad9ad8da8c5a3270d4fab0c5600e032186ede0dcade

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f3a2ba866857018f057087b30703c65
SHA1 b5658b34e445d0b52252f4f30b33f972e5ad537e
SHA256 55279e70e3492eb2016f32d76ed3bebf93a3beb23084723a39e89998ee0d845e
SHA512 c38fa62d5fa391a04c694f57df2c6c7363289e3cc68502a3893a288f86b76e4095cf3870710974254ee43e046595dea91a90438aeba18347b248602471d699cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0067fa3dd67dfb198873c9edbabe6262
SHA1 6c47a85fdd19013c1252027cc48a982a9d770be6
SHA256 1a5886111e028082173518d1d8000610fa7935561654190e9bb820a6a2aaf453
SHA512 40f3c0f975a2f5383a7bc84a14ac3e8076672d4a9688ec599a6b242b974b8bb1d7faec280f267cfa5d71cd9c280e3e0b3b56f27a683263811ef2363083a8526a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f99067291f09d2de3366dd9c7868f0b4
SHA1 13c6350587a3e501effe822cf57a7b34114d5bb9
SHA256 e22e2410d9ca36c05527d72da26a30ccf484a3919b65c3bad797c002514dcf27
SHA512 4521e3e1a942d5c49e609c5a6be03bd8173ca6e000384fe42611c0c6583c3f901538351df57d0620bb3a96c80fec877c967f2ebde356280780a1199f0e2dde65

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b69b01ad543e71778b8b2243d46e96a5
SHA1 6a665687a298d4c4728935276de0e2f44830386d
SHA256 bcf20d7be076e0ca373c8b0102cfa818b183b10b8ef95fa62eb54756d4540f56
SHA512 5f7eace37b631ae64076ba8e84ddf1ebeb6178dc7d1cbc7dd88ab912591b658e222d1eee982e495d1c35153e13ae7f780d1de49bdd503b8d32549e9301285ba7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 df00e9b8e6b6c178380843587cf24b14
SHA1 75e857ef9e7fa2ef38b4b78c5d1580c707a697b1
SHA256 f13362c55a2536541fd2a61e3db364f9fa6400ee06efc6fe902f47886a6a8bb0
SHA512 70a03dd5b78de44f4a471af4e07322912e67d08c95d44cc2b936d051bb0a2bc64d1cb319c5a4f88f88213ca2a0146ab4e9ea06ea06a75a87989cb59932894562

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a359ec895aa943088f38453b78113dfc
SHA1 b5a84fc15084afb07d4bccb2744f0a6dfc51ec06
SHA256 a99dec68b0706aec4ce0e0e43fc7163db806dd9e95d910215cb19f8e0b2677c6
SHA512 57d0d7b70ee272662bdc95240374465d1830f6216b92c17d8f518338c8b86b8f7bf576972e674fe3c51ac8cfcd791c837b0729eeb1d2fc2cb28200f1e0e15d83

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bdb8d25ab9f58f1514905e9b55662550
SHA1 9bcb1e358e669be0d8fdc32b711dafe3e98ccdef
SHA256 34a6e688b3dc52752621db3b47cce4bcaca30a56b2ae54eb8aebbc3e2d08dbc8
SHA512 6ae749b357d8ccf9c6649eae3fe890b3bc3295690ef1b8cf25c851833a649597e00ce82cd2ac6f277f1a8eed1b6c1020afd409ae386b4a50572ecd38b18a58e4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6cac192f8d09b3476daeb423aeaf775c
SHA1 78a94e08f63cdae94c1fc9fc2a4b5950150cb49c
SHA256 edfef55759ef4d8844f87d405aad456597ec1c192c765dee5b3122a14c9cb02f
SHA512 f496e41b87c99b5ceb1db1f2d43fa691ea1e8b02ab5fb3b4b8d230ae5b6a748233073ec76c5aace236a8b7bbd75efcf62e1d05b56dfd1ce3a273219c51507acd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 02e648b2a624b5c4ae27f7ee677bbd1b
SHA1 f892c16002f8670b5532da412dc314627bce88a7
SHA256 aa01d33c0a8276a0cc07c5e39d226214013c408512a0b7dbc654f703c76fa859
SHA512 1fa161c17a3ff39172b89cc55bc1821846a620f99d522a67f9130b5f1ad1b59494b35437a3a2d5bd99c067bc13c56756cac198f00ad6cc50dce974a52ece4331

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a7b3c98b4f4745c77289d2c0ffdc5c95
SHA1 6203be2e429a19ab3671ba842ca2c67ac75dd3b3
SHA256 0d3b282b568e665b166b62a727a341446bb45750951ca24648d820de51962ec8
SHA512 354f6d8a2622eba5f1edad951d2b7e55b3fa66b4af257094bcd173c86a5fe4c0cdc2b0475991f06dfde244d0461def2a5e3337051ba7175d19bc67502d2121d4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5fd5f2799094c3f96a650f6a7209984e
SHA1 71f3b236d777832dc98e8b73162945b680dcc7fd
SHA256 2075a1dcc1fcc2a37c616cfee84d4c97797b1be8b3e8090fc08e99c8358eeca7
SHA512 ab406204afc29b3b461eac95d34c940312b1e36f6c7f020ea1c19ec50184eb3342675c188c852114421c683d5071baafd56190a3581a967e34c66eb9b053ed14

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1429cb663aa4e54dbcd3c21c5999921f
SHA1 64e5bf8f4d34b537ae5436245b48394772c3d667
SHA256 f52c6c41c23002207a9612d9724fba533d865980db5c1ad68124fc302f7b33a1
SHA512 f3ea45b49e506eeabc69df86fb1b109e306bec87357e2d446199c52f87d9d0d771091f7322668aae1fd59114a00c0b01731d4dde960ed2ebdf5b424dfed9a4d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 99a12b87926433ececa4c3228bd5e5ac
SHA1 2baf787541f21357947f52d0ca4f8419b78dbb12
SHA256 b98aa9f4d18ae470e60c40206e81289cc95e1673c4df02705a91a97057316e1d
SHA512 454d52e5732e1ca414082df722cf0a372e0dc5ee1062b1ab5eb3df2293ba21ea642e88f7ecdd8ac694d43a966115c481a7b4b1e3ca73780941ee0629374d6dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ecebd167cd2b03dc6f869051f089a56c
SHA1 48f718abff9f800bd7066342cf575a265be4d7c2
SHA256 f443f187d35d89c7ae2a40cd9e55513d1d27202e17cdb899536f08547c86c3e7
SHA512 d4aeed74f3ef621eb9eef91c84b9317001c07758794964087c34d69275fb00f32d63e387b45fc4f00441782b23cdcef93e44d12027f668e0ff2a5a9f342ffcfe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 774a813a7cead80e880a20bd8f6d15bf
SHA1 813e60eca7fe0f286dde65c62093627cee4f4502
SHA256 fd425e928d679a00efb9bc16981dc240e382fdaf81deaef8a4fbebda9cb3db7c
SHA512 e431912f8e1162f4b186929f9926e7acebb44be84c6226fb375ab41fadcc9b1002186f1ac10a8eea577ccc043676d6263281ec8f426d926a1d190151bddc576c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dddd5dc846ea38fcbb9062091e27cb39
SHA1 0c82a444e058c1c8673cb3ffd0bb8093e07524f5
SHA256 4b38003748f032291fcfecd4ad8ecfe2535a2e6018ec2f9355cf9fbc442a66bc
SHA512 402eb4ebf9f9b560c455096c1be74431769a4707fb5036720c04592e9b1a49a1c9a06b2c712829d0fe1e4ffc9f4e6aa1f8939f021355a690b255128796902e0a

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 171a226dee5aaa5d81a1fdaf619b2d5e
SHA1 04de24f275712462e48764824527ee85c423fa6e
SHA256 8ab75d2cf26d6147f3385edf5959a41bc18cd45b14bdc04f3fbe1faa1d23912d
SHA512 a0420bffaa224ac4266fd5850c9c002fc2d1cb9f7fa8e32860028a5cf175ae84065f2a913038a996c59ba83181df31514ec0df6f18848cf440cfe2f929a7219c

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-25 06:37

Reported

2024-05-25 06:40

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatfor.exe N/A

Sets DLL path for service in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240606359.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatfor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\R.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\Remote Data.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File created C:\Windows\SysWOW64\240606359.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2832 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2832 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2832 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2832 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2832 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2832 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 4548 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 4548 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 4548 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 4996 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 4580 wrote to memory of 4996 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 4580 wrote to memory of 4996 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2832 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe
PID 2832 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe
PID 2832 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe
PID 3532 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Program Files\Java\jdk-1.8\bin\javaw.exe
PID 3532 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe C:\Program Files\Java\jdk-1.8\bin\javaw.exe
PID 3244 wrote to memory of 4516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3244 wrote to memory of 4516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3244 wrote to memory of 4516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3200 wrote to memory of 2520 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\system32\icacls.exe
PID 3200 wrote to memory of 2520 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\system32\icacls.exe
PID 3200 wrote to memory of 1064 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 3200 wrote to memory of 1064 N/A C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\SYSTEM32\cmd.exe
PID 3812 wrote to memory of 2412 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 3812 wrote to memory of 2412 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 3812 wrote to memory of 2412 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe

"C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe"

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe

C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

"C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=15 -jar "HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe"

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\system32\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

C:\Windows\SYSTEM32\cmd.exe

cmd ver

C:\Windows\SysWOW64\Remote Data.exe

"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240606359.txt",MainThread

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 littleskin.cn udp
US 8.8.8.8:53 bmclapi2.bangbang93.com udp
CN 58.49.197.160:443 bmclapi2.bangbang93.com tcp
US 104.21.0.107:443 littleskin.cn tcp
US 8.8.8.8:53 107.0.21.104.in-addr.arpa udp
US 8.8.8.8:53 authlib-injector.yushi.moe udp
US 185.199.108.153:443 authlib-injector.yushi.moe tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 153.108.199.185.in-addr.arpa udp
CN 58.49.197.160:443 bmclapi2.bangbang93.com tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
CN 58.49.197.160:443 bmclapi2.bangbang93.com tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
CN 58.49.197.160:443 bmclapi2.bangbang93.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 185.199.108.153:443 authlib-injector.yushi.moe tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
NL 23.62.61.97:443 www.bing.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\R.exe

MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

C:\Windows\SysWOW64\240606359.txt

MD5 abbff166b925b71e16e2f02236946cfb
SHA1 a36cccb5fcf54c8d94a0f86f76e8597e8a255f5f
SHA256 b0fe8eee6dcb4e576fb4e0970b0d9a029211c8a72c33b80e12185a79d97d8274
SHA512 513b5c4c24d27446a6faef3b61e984d62b9a5123092180e2cd2a6cab75079febf2c93e6ff2b64d1c7c3acebcded1259ca9035eae795e32375a0d02d884350af9

C:\Users\Admin\AppData\Local\Temp\N.exe

MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

memory/4548-20-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4548-23-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4548-19-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4548-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4580-26-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4580-29-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4580-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4996-37-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4996-41-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4996-42-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe

MD5 c40aebee2bf4002f042241a4625176d4
SHA1 3bfb5be63e2438788e431440865cb0dc42f34ef7
SHA256 8e4f917471e96a7f28802a0e816d000aa7156a040a066887672207ca9cb6474e
SHA512 6fabce39177305db58cc95bd7ffac3bf4348c738c158e0c420e1d9bef7020ec81512ddf1d4accceb324bd0127b7d611ae316b418340db465b4ca925c90eaaa3f

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 171a226dee5aaa5d81a1fdaf619b2d5e
SHA1 04de24f275712462e48764824527ee85c423fa6e
SHA256 8ab75d2cf26d6147f3385edf5959a41bc18cd45b14bdc04f3fbe1faa1d23912d
SHA512 a0420bffaa224ac4266fd5850c9c002fc2d1cb9f7fa8e32860028a5cf175ae84065f2a913038a996c59ba83181df31514ec0df6f18848cf440cfe2f929a7219c

C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp

MD5 743dd63743c5c0261fe8270af305e511
SHA1 855b4592ae7a74d42c26d241e87b6680b3928771
SHA256 c76503321dabc5d0ad37221c3c9889955817c7ff3b4a9217919c99f1f8556851
SHA512 59f2a7461c8878fdfb9e468d81d92cd57be45f1fcc1ad40a153630c18d44713d6db9e741e782a1ce2eddf30ec41e8f692721a1dd2a769597faebcc90e50fd91d

memory/3200-69-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-71-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-79-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-111-0x0000020D36580000-0x0000020D36581000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hmcl.json

MD5 90f35d77c9f7d8124cd12986f0528712
SHA1 11c4527f1d33cd7383f50c2128a3812166658cea
SHA256 f08afba233387e4f273149c4990f60cd1642e67c68477a2081f41d2b764be425
SHA512 fb18aa3e57839db7e66eb2b4ce31f63ec51063a98d729d7639e956ea263e878ed6357a5fc3493bb5d02de2fb095e4fa9d3e3798e6d8362232a089df113080ade

C:\Windows\SysWOW64\Remote Data.exe

MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

C:\Users\Admin\AppData\Local\Temp\hmcl.json

MD5 d4084216850a615b37ebd35eb2b8d155
SHA1 fdb87602b59bfa2ccd5617d0ae8d4a57ffe560eb
SHA256 82fdcc3b988db5a376701810b0ba203185d4624b1b647fbae44479ca1b57f6df
SHA512 6bf57587dc647a0ac2703020517aa7c86152384600bb1bef0d2ce138b88987dcf3e026768bc310883d05b9a375678630ab48f2379ea645eaf2ac72d17cf93853

memory/3200-152-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-175-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-204-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-209-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-207-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-212-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-226-0x0000020D36580000-0x0000020D36581000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hmcl.json

MD5 c458dfec4fef766b6879ff1ad3e0c340
SHA1 3aec48fc6b28ce16460a443acc855b643fc76d35
SHA256 b37784c2082b7adb63a2beab81f842fd5c016706663234b179d1f5c9a4623032
SHA512 54334b08df55df78cd84cf43f0c14b999822c9489cf8a591327cb48cf0a911194ce80567bd663e117c9a667aac606a12771182105c4560573ec1d45054eaa6da

memory/3200-242-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-243-0x0000020D36580000-0x0000020D36581000-memory.dmp

memory/3200-245-0x0000020D36580000-0x0000020D36581000-memory.dmp

C:\Users\Admin\AppData\Roaming\.hmcl\authlib-injector.jar

MD5 c60d3899b711537e10be33c680ebd8ae
SHA1 1eca6aa7faf7ac6e3211862afa6e43fe2eedd07b
SHA256 3bc9ebdc583b36abd2a65b626c4b9f35f21177fbf42a851606eaaea3fd42ee0f
SHA512 5b0634bdd4193e9d5423b4e0490b980132081df0a845d3832031c8be637d93616aee82bbaeb427fb6f617aeeb381e7246ee5e83a79bde071ef0b02a81cb91289