Malware Analysis Report

2025-04-13 21:02

Sample ID 250102-tqkkqsxphs
Target 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50
SHA256 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50
Tags
gh0strat purplefox xred backdoor discovery persistence rat rootkit trojan upx macro
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50

Threat Level: Known bad

The file 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox xred backdoor discovery persistence rat rootkit trojan upx macro

Purplefox family

Xred

Gh0strat family

Gh0strat

Gh0st RAT payload

PurpleFox

Detect PurpleFox Rootkit

Xred family

Drops file in Drivers directory

Sets service image path in registry

Suspicious Office macro

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

UPX packed file

Drops file in Program Files directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

System Network Configuration Discovery: Internet Connection Discovery

Checks processor information in registry

Runs ping.exe

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-02 16:15

Signatures

Xred family

xred

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-02 16:15

Reported

2025-01-02 16:18

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Xred

backdoor xred

Xred family

xred

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TXPlatforn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3180 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3180 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3180 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2896 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 3180 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 3180 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 3180 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 3068 wrote to memory of 1148 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3068 wrote to memory of 1148 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3068 wrote to memory of 1148 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1236 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1236 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1236 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 960 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 960 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 960 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 960 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 960 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 960 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2800 wrote to memory of 2996 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2800 wrote to memory of 2996 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2800 wrote to memory of 2996 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

"C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 13.73.50.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 220.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.74.250.142.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/2896-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2896-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2896-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2896-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3068-16-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

MD5 db06bd4b57933fb4dd26188ab9a013c7
SHA1 24fb49c4fbe2993e96595d1085dbae18d8a73db4
SHA256 5d3ccb3cf874eed6dabe680217d17a22096711ddfe184ecb825cf66b46837600
SHA512 cd20b5a3abc4b649ae490553e8ef4973a25b77cc6fc669f096928737eec359fdb53e00985314f14f94d3598bebf119ac17c760ece3cb45a0a56bc36c3521a784

memory/3068-29-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/960-30-0x00000000007B0000-0x00000000007B1000-memory.dmp

memory/1148-31-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1148-36-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1148-35-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1148-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3068-19-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3068-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3068-13-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 43a309d76c3bb4a91e3d464b2adb1a70
SHA1 d12fc070e16edf51a1dbe8621fd3e1b2c4be60d3
SHA256 10801369a0b307d0b9abf07dab6a92263b7c66fa6fc66bb6d0c86260d2fba649
SHA512 6925d0cc83c2d8ca52fa58d49d98e94b667ec68d6e2de68d6bf3f3a406bc027a2db7f1aa3e5f4b13c84503d488b9d7392fcaf61e548dc27ddb102e45d327b9c4

C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

MD5 fd5137d1998bf8fcbab832123dd72256
SHA1 155e5dd08ecbe6483167f596c927208f4cca8a39
SHA256 86ee28923d4e7255762442fe93f220237197a756182ce320f5f6887b5c7147c5
SHA512 fd9270902cec43a84048a0e90ded14e56c9bae46ef067081d10784c82ec1a0ef7dc605b11d8819c9c5d75dea342df8a419bdd61f8ef7411c25fee932038ea465

memory/960-207-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/2800-268-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/1904-269-0x00007FFC05F50000-0x00007FFC05F60000-memory.dmp

memory/1904-271-0x00007FFC05F50000-0x00007FFC05F60000-memory.dmp

memory/1904-270-0x00007FFC05F50000-0x00007FFC05F60000-memory.dmp

memory/1904-272-0x00007FFC05F50000-0x00007FFC05F60000-memory.dmp

memory/1904-273-0x00007FFC05F50000-0x00007FFC05F60000-memory.dmp

memory/1904-274-0x00007FFC03EF0000-0x00007FFC03F00000-memory.dmp

memory/1904-275-0x00007FFC03EF0000-0x00007FFC03F00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\59rmhhhM.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

memory/2800-295-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/2800-344-0x0000000000400000-0x00000000004D9000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-02 16:15

Reported

2025-01-02 16:18

Platform

win7-20240903-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Xred

backdoor xred

Xred family

xred

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TXPlatforn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2344 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2344 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2344 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2344 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2344 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2344 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2344 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2332 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2332 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2332 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2332 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2344 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2344 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2344 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2344 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2312 wrote to memory of 2216 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2312 wrote to memory of 2216 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2312 wrote to memory of 2216 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2312 wrote to memory of 2216 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2312 wrote to memory of 2216 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2312 wrote to memory of 2216 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2312 wrote to memory of 2216 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1028 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1028 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1028 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1028 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2672 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2672 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2672 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2672 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2672 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2672 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2672 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2672 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2648 wrote to memory of 2024 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2648 wrote to memory of 2024 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2648 wrote to memory of 2024 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2648 wrote to memory of 2024 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

"C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.83:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/2332-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2332-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2332-9-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2312-18-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2332-21-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

MD5 db06bd4b57933fb4dd26188ab9a013c7
SHA1 24fb49c4fbe2993e96595d1085dbae18d8a73db4
SHA256 5d3ccb3cf874eed6dabe680217d17a22096711ddfe184ecb825cf66b46837600
SHA512 cd20b5a3abc4b649ae490553e8ef4973a25b77cc6fc669f096928737eec359fdb53e00985314f14f94d3598bebf119ac17c760ece3cb45a0a56bc36c3521a784

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 43a309d76c3bb4a91e3d464b2adb1a70
SHA1 d12fc070e16edf51a1dbe8621fd3e1b2c4be60d3
SHA256 10801369a0b307d0b9abf07dab6a92263b7c66fa6fc66bb6d0c86260d2fba649
SHA512 6925d0cc83c2d8ca52fa58d49d98e94b667ec68d6e2de68d6bf3f3a406bc027a2db7f1aa3e5f4b13c84503d488b9d7392fcaf61e548dc27ddb102e45d327b9c4

memory/2312-60-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2216-72-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2216-76-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2216-77-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

MD5 fd5137d1998bf8fcbab832123dd72256
SHA1 155e5dd08ecbe6483167f596c927208f4cca8a39
SHA256 86ee28923d4e7255762442fe93f220237197a756182ce320f5f6887b5c7147c5
SHA512 fd9270902cec43a84048a0e90ded14e56c9bae46ef067081d10784c82ec1a0ef7dc605b11d8819c9c5d75dea342df8a419bdd61f8ef7411c25fee932038ea465

memory/2672-103-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/2948-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b4mP55Uq.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\b4mP55Uq.xlsm

MD5 e0f32187d0953c2cfdb20face00e91bf
SHA1 adb5a045eb8f1a9c03bde867d69aedf63e488638
SHA256 931f48588d24f62975d0bfe7e7d1f15d5bf67a1f84deaac1eb7436ae75f2f600
SHA512 7ba2d1e43e391d362c29705171c30cc4340b2b6a1cb5f4039d6239518966af5a75029914d46ba6a131e9f4fe9f6e78ff680c86f71cfd2adaeb41f4fa8f7e5b02

C:\Users\Admin\AppData\Local\Temp\b4mP55Uq.xlsm

MD5 666578c564e1315b575e2d24ea94a141
SHA1 8f97dca5a7532a5dd32ae6a2f3cc61f6399162fc
SHA256 be5b9f0e4e7853c18ed8724283187da9648f797b95f1a95ba74c4ae4b87d648f
SHA512 665b8761943066c0fcfd8dc78be8eead672d2716f2f9e936468d942405af600226c82ef6d634959dd2db55a6ba175e080ab7028325e5c82c346ffbff80cd8c6b

C:\Users\Admin\AppData\Local\Temp\b4mP55Uq.xlsm

MD5 ce61b4f2be3bd15d73410170c5b8dfc4
SHA1 f4ce0290d5b79507800a50f804ee7507d2390eb8
SHA256 7136d686ccc80986e18d284599cef80c5e633d95df3629f233d36f4b69b942b2
SHA512 fe81bfa7c3d6e5b45f1c30d835d60d67a38defa915d6a54023fa0cd21d0fd27774fac7085d9e2ca768ad7c962601afc40e04bb29c357f7c6ebf914f9e89906f4

C:\Users\Admin\AppData\Local\Temp\b4mP55Uq.xlsm

MD5 c25c993b44d8e4325fa10daceab563bc
SHA1 6e2199526e04433edefe9db41563fc5ead4d43d6
SHA256 62a4cc9bbc7aee09d02e1ad29a6efbb219a2d7076e2df49d4eaf0efbbf4157f9
SHA512 3c967584a1090613b2dfa273343c45ffc2488a2c2bd897421b95e7e332d6e4658e5c23fdfcd22803473144e7b7ad4511e7bddbcab2256139668415961f4a4976

C:\Users\Admin\AppData\Local\Temp\~$b4mP55Uq.xlsm

MD5 ff09371174f7c701e75f357a187c06e8
SHA1 57f9a638fd652922d7eb23236c80055a91724503
SHA256 e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512 e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

memory/2948-190-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2648-191-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/2648-197-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/2648-239-0x0000000000400000-0x00000000004D9000-memory.dmp