Malware Analysis Report

2025-04-13 21:02

Sample ID 250102-g6wxgszqgk
Target c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
SHA256 c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624
Tags
xred gh0strat purplefox backdoor discovery macro persistence rat rootkit trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624

Threat Level: Known bad

The file c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe was found to be: Known bad.

Malicious Activity Summary

xred gh0strat purplefox backdoor discovery macro persistence rat rootkit trojan upx

Detect PurpleFox Rootkit

Gh0strat family

PurpleFox

Xred family

Gh0strat

Gh0st RAT payload

Purplefox family

Xred

Sets service image path in registry

Suspicious Office macro

Drops file in Drivers directory

Server Software Component: Terminal Services DLL

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

UPX packed file

Drops file in Program Files directory

System Network Configuration Discovery: Internet Connection Discovery

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: LoadsDriver

Suspicious use of SetWindowsHookEx

Modifies registry class

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-02 06:25

Signatures

Xred family

xred

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-02 06:25

Reported

2025-01-02 06:27

Platform

win7-20240903-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Xred

backdoor xred

Xred family

xred

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatfor.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259432689.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259433047.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File created C:\Windows\SysWOW64\259433047.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\259432689.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TXPlatfor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\R.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TXPlatfor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Remote Data.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\R.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2524 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 2524 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 2524 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 2524 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 2352 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2352 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2352 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2352 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2524 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2524 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2524 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2524 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2352 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2352 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2352 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2352 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2352 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2352 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2352 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2828 wrote to memory of 2596 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2828 wrote to memory of 2596 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2828 wrote to memory of 2596 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2828 wrote to memory of 2596 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2596 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2596 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2596 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2596 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 2596 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2596 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2596 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2596 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2596 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2596 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2596 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2956 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 1096 wrote to memory of 276 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1096 wrote to memory of 276 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1096 wrote to memory of 276 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1096 wrote to memory of 276 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1096 wrote to memory of 276 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1096 wrote to memory of 276 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1096 wrote to memory of 276 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2352 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 2352 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 2352 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 2352 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 2336 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2336 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2336 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2336 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 2056 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1760 wrote to memory of 2056 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1760 wrote to memory of 2056 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1760 wrote to memory of 2056 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1760 wrote to memory of 2056 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1760 wrote to memory of 2056 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 1760 wrote to memory of 2056 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2596 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe
PID 2596 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe
PID 2596 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe
PID 2596 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

"C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe"

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe

C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\Remote Data.exe

"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259432689.txt",MainThread

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.146:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp

Files

memory/2524-0-0x0000000000220000-0x0000000000221000-memory.dmp

\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

MD5 a115b0f35d3da4422161412b02af7f7e
SHA1 d044c0e2e7727d799a30677fe8031e5c5dce8e06
SHA256 bea53555cb37ad8647e6b355ec0d0f615ab135c76cc5c5d860857aaf752747d6
SHA512 6dba3a3e9d3f7363b05e66af03d797462363f6e7a7ead07bd70a42899b8ac6976b160f27ffbe5a8ccc47bebfa18bfd1760d9193dc69585586c651c4fa79eb346

C:\ProgramData\Synaptics\Synaptics.exe

MD5 20f879f733df173c436f0d615406ad40
SHA1 68a90d01c584bf6de48d23605bb91eb7795833e8
SHA256 c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624
SHA512 81b638e03250bbc82cb242cbd651804a85b0a50a7c37679f96feb6bda0ee7b0bf52880174210eb5d5f5316b701b89ae723c200b7e8686e4d6908f2954014c6c2

\Users\Admin\AppData\Local\Temp\R.exe

MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

\Windows\SysWOW64\259432689.txt

MD5 94dfe3ba4da1656a4576e740036d1666
SHA1 2a11c204df6011ae6b535fc0db72e56092531c5b
SHA256 a61f32aa8d202ebe15c156ea6106926a79356995bd6e7f917ce9ea3ddbd41669
SHA512 6b73888e7b4fcf6bad10b43e260486b9bc2fd76a015fe7e918f09cc98e5deb281c5067bffdf79d99e1f7e66d76d907488e4bb597f6052acf13fc936ff4da1602

memory/2524-33-0x0000000000400000-0x0000000000764000-memory.dmp

\Users\Admin\AppData\Local\Temp\N.exe

MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

memory/2956-49-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2956-48-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2956-46-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2628-67-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\uWCLxtK4.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Windows\SysWOW64\ini.ini

MD5 237016b032c70f1c5f5c64b3490c1930
SHA1 8e262b72bdc297b2fbb5acaa6117a811c8917fba
SHA256 68451304dac6c99361ec22464ed2a1941e06dd5c84dd4b8ee98e2e066a8d2da5
SHA512 72ebc170df0fae4cdd499cd862edbc5d311adbafc07a3940b2d8fe1d39e93015e94e1cbcb6daf23457040a595a8bf26ab2f1907f652ae3c0d2ee6bb5da5ac86b

\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

MD5 bd9e6c82cee1ff84cbc06ab54357974b
SHA1 c67d17b475404fe584e577b63411507acc268e56
SHA256 e150fd0333aef42a74f26c24b46347ea547fb295bdc77e0503be9b7a085de535
SHA512 a98b2c076a80875ee5e4007d22c5ae31bcff556bd03e6be6756e470f339e9d987bbec4a9f7af32239e13e8250c07df69c279a59f86eecb8e1967f62ada6e0e1b

C:\Users\Admin\AppData\Local\Temp\uWCLxtK4.xlsm

MD5 038680e266cb0df71dfb7119a20bccc7
SHA1 94c7714478b3f548bd3121ec26fdc7b3436ac649
SHA256 91f663e1400ba79cbd806a43b6f72b929cf18e8cc72731e62f9bb3744a9f3b8b
SHA512 6d69fdbaf752368157a010fa3b073b2abe1c913168caa11a40d5e2da7b1369293170886be9de40a299c63cea3a55b64d2d0a02fa54b3c9f75236cdf6806fdf89

memory/276-161-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 97958c76750221e2953392782e393c54
SHA1 125961f3d7ba5404792478b929e331a3188c0e42
SHA256 93bba883b08d311455ffdcd4c2a8f70a5e5eb4294a158c840ef6757b10259f6b
SHA512 2d5cfb8751911c4d3980cf2059e87c37ef3d9cf02736d8494f8983a05677abbcc750613b2d609540e0c317b94359b74b8347491a9417b36a3ad5b2d03d6363e2

memory/276-135-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/276-166-0x0000000010000000-0x00000000101B6000-memory.dmp

\Windows\SysWOW64\Remote Data.exe

MD5 51138beea3e2c21ec44d0932c71762a8
SHA1 8939cf35447b22dd2c6e6f443446acc1bf986d58
SHA256 5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512 794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

memory/2828-173-0x0000000000400000-0x0000000000764000-memory.dmp

memory/2828-176-0x0000000000400000-0x0000000000764000-memory.dmp

memory/2828-210-0x0000000000400000-0x0000000000764000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-02 06:25

Reported

2025-01-02 06:27

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Xred

backdoor xred

Xred family

xred

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatfor.exe N/A

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240612093.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240612593.txt" C:\Users\Admin\AppData\Local\Temp\R.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatfor.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe C:\Users\Admin\AppData\Local\Temp\N.exe N/A
File created C:\Windows\SysWOW64\240612593.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\240612093.txt C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File opened for modification C:\Windows\SysWOW64\ini.ini C:\Users\Admin\AppData\Local\Temp\R.exe N/A
File created C:\Windows\SysWOW64\Remote Data.exe C:\Windows\SysWOW64\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TXPlatfor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\R.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Remote Data.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\R.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TXPlatfor.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\N.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatfor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3852 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 3852 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 3852 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 3676 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 3676 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 3676 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 3852 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3852 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3852 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3676 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 3676 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 3676 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 3496 wrote to memory of 4584 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3496 wrote to memory of 4584 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3496 wrote to memory of 4584 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3432 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 3432 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 3432 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 3676 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 3676 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 3676 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe
PID 4584 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 4584 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 4584 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\R.exe
PID 748 wrote to memory of 3232 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 748 wrote to memory of 3232 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 748 wrote to memory of 3232 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 4584 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 4584 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 4584 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\N.exe
PID 2408 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\N.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 4952 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2792 wrote to memory of 4952 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 2792 wrote to memory of 4952 N/A C:\Windows\SysWOW64\TXPlatfor.exe C:\Windows\SysWOW64\TXPlatfor.exe
PID 4584 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe
PID 4584 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe
PID 4584 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe
PID 3644 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3644 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3644 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2324 wrote to memory of 4072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2324 wrote to memory of 4072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2324 wrote to memory of 4072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 632 wrote to memory of 3212 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 632 wrote to memory of 3212 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe
PID 632 wrote to memory of 3212 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\Remote Data.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

"C:\Users\Admin\AppData\Local\Temp\c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe"

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k "Remote Data"

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

C:\Users\Admin\AppData\Local\Temp\R.exe

C:\Users\Admin\AppData\Local\Temp\\R.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\N.exe

C:\Users\Admin\AppData\Local\Temp\\N.exe

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul

C:\Windows\SysWOW64\TXPlatfor.exe

C:\Windows\SysWOW64\TXPlatfor.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe

C:\Users\Admin\AppData\Local\Temp\HD_._cache_Synaptics.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Windows\SysWOW64\Remote Data.exe

"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240612093.txt",MainThread

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.74.250.142.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

memory/3852-0-0x0000000000870000-0x0000000000871000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

MD5 a115b0f35d3da4422161412b02af7f7e
SHA1 d044c0e2e7727d799a30677fe8031e5c5dce8e06
SHA256 bea53555cb37ad8647e6b355ec0d0f615ab135c76cc5c5d860857aaf752747d6
SHA512 6dba3a3e9d3f7363b05e66af03d797462363f6e7a7ead07bd70a42899b8ac6976b160f27ffbe5a8ccc47bebfa18bfd1760d9193dc69585586c651c4fa79eb346

C:\ProgramData\Synaptics\Synaptics.exe

MD5 20f879f733df173c436f0d615406ad40
SHA1 68a90d01c584bf6de48d23605bb91eb7795833e8
SHA256 c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624
SHA512 81b638e03250bbc82cb242cbd651804a85b0a50a7c37679f96feb6bda0ee7b0bf52880174210eb5d5f5316b701b89ae723c200b7e8686e4d6908f2954014c6c2

C:\Users\Admin\AppData\Local\Temp\R.exe

MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

C:\Windows\SysWOW64\240612093.txt

MD5 94dfe3ba4da1656a4576e740036d1666
SHA1 2a11c204df6011ae6b535fc0db72e56092531c5b
SHA256 a61f32aa8d202ebe15c156ea6106926a79356995bd6e7f917ce9ea3ddbd41669
SHA512 6b73888e7b4fcf6bad10b43e260486b9bc2fd76a015fe7e918f09cc98e5deb281c5067bffdf79d99e1f7e66d76d907488e4bb597f6052acf13fc936ff4da1602

memory/3852-136-0x0000000000400000-0x0000000000764000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\N.exe

MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

memory/3432-150-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3432-148-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_._cache_c454bdf17f909fb2da2b13b8acd87f6fb810d660ea0945e6dbd4b5aed85e3624N.exe

MD5 bd9e6c82cee1ff84cbc06ab54357974b
SHA1 c67d17b475404fe584e577b63411507acc268e56
SHA256 e150fd0333aef42a74f26c24b46347ea547fb295bdc77e0503be9b7a085de535
SHA512 a98b2c076a80875ee5e4007d22c5ae31bcff556bd03e6be6756e470f339e9d987bbec4a9f7af32239e13e8250c07df69c279a59f86eecb8e1967f62ada6e0e1b

C:\Windows\SysWOW64\ini.ini

MD5 237016b032c70f1c5f5c64b3490c1930
SHA1 8e262b72bdc297b2fbb5acaa6117a811c8917fba
SHA256 68451304dac6c99361ec22464ed2a1941e06dd5c84dd4b8ee98e2e066a8d2da5
SHA512 72ebc170df0fae4cdd499cd862edbc5d311adbafc07a3940b2d8fe1d39e93015e94e1cbcb6daf23457040a595a8bf26ab2f1907f652ae3c0d2ee6bb5da5ac86b

memory/1300-257-0x00007FF7D9E50000-0x00007FF7D9E60000-memory.dmp

memory/1300-259-0x00007FF7D9E50000-0x00007FF7D9E60000-memory.dmp

memory/3232-265-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1300-268-0x00007FF7D7BF0000-0x00007FF7D7C00000-memory.dmp

memory/1300-269-0x00007FF7D7BF0000-0x00007FF7D7C00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 97958c76750221e2953392782e393c54
SHA1 125961f3d7ba5404792478b929e331a3188c0e42
SHA256 93bba883b08d311455ffdcd4c2a8f70a5e5eb4294a158c840ef6757b10259f6b
SHA512 2d5cfb8751911c4d3980cf2059e87c37ef3d9cf02736d8494f8983a05677abbcc750613b2d609540e0c317b94359b74b8347491a9417b36a3ad5b2d03d6363e2

memory/3232-267-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1300-262-0x00007FF7D9E50000-0x00007FF7D9E60000-memory.dmp

memory/3232-260-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1300-256-0x00007FF7D9E50000-0x00007FF7D9E60000-memory.dmp

memory/1300-255-0x00007FF7D9E50000-0x00007FF7D9E60000-memory.dmp

memory/748-217-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/748-216-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/748-214-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\JqaU1nHi.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

memory/3432-151-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DC775E00

MD5 d2aeaf117a6226aec23aefe6340dcf39
SHA1 5264f411bd22f0a061d64c61e790dc9f817291ee
SHA256 640cbda611110375fe201a4e195cfc49a008eeb11fa821104d57a5ab14402848
SHA512 e068c872bc0c8e0d7a41e1d865cb541d0ffedf5340fc07898ca4242741d58912e18d753fa4d1b44967fd87375dc4a4b60477b67e8382f44340d466809175c461

C:\Windows\SysWOW64\Remote Data.exe

MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

memory/3496-337-0x0000000000400000-0x0000000000764000-memory.dmp

memory/3496-375-0x0000000000400000-0x0000000000764000-memory.dmp