xred | 62edc73eb9d18f60b28e98b66eb7e3e1adb0d414d58bc9c6f96fd4fda0b47300

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
submitted
05/08/2024, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aeb1cb71bfe51c1e50d92d6471af370N.exe
Size

917KB
MD5

0aeb1cb71bfe51c1e50d92d6471af370
SHA1

6c50f5017e1f09c0bc6ffb05840ddb2529230f77
SHA256

62edc73eb9d18f60b28e98b66eb7e3e1adb0d414d58bc9c6f96fd4fda0b47300
SHA512

f5c83000d6628a41965572f3cfe0a81f14e97f7956a19f847ec6674ea8d7bd14cb3d53f678b2e09150e9086c55d680ef4d9568e3de59b4bb2c4846531d7f1ed3
SSDEEP

12288:UMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9QvFUNDaVs2:UnsJ39LyjbJkQFMhmC+6GD9IFOaVh

Score

10^/10

xred backdoor discovery evasion persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	0aeb1cb71bfe51c1e50d92d6471af370N.exe

Executes dropped EXE 12 IoCs

pid	Process
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
3288	Synaptics.exe
1320	._cache_0aeb1cb71bfe51c1e50d92d6471af370n.exe
3840	icsys.icn.exe
64	explorer.exe
1644	spoolsv.exe
4972	._cache_Synaptics.exe
4976	svchost.exe
3664	spoolsv.exe
1088	._cache_synaptics.exe
720	icsys.icn.exe
4416	explorer.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	0aeb1cb71bfe51c1e50d92d6471af370N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	._cache_Synaptics.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0aeb1cb71bfe51c1e50d92d6471af370N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	0aeb1cb71bfe51c1e50d92d6471af370N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3620	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
3840	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
64	explorer.exe
4976	svchost.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
3840	icsys.icn.exe
3840	icsys.icn.exe
64	explorer.exe
64	explorer.exe
1644	spoolsv.exe
1644	spoolsv.exe
4976	svchost.exe
4976	svchost.exe
4972	._cache_Synaptics.exe
4972	._cache_Synaptics.exe
3664	spoolsv.exe
3664	spoolsv.exe
720	icsys.icn.exe
720	icsys.icn.exe
3620	EXCEL.EXE
4416	explorer.exe
4416	explorer.exe
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE
3620	EXCEL.EXE

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 844	3344	0aeb1cb71bfe51c1e50d92d6471af370N.exe	88
PID 3344 wrote to memory of 844	3344	0aeb1cb71bfe51c1e50d92d6471af370N.exe	88
PID 3344 wrote to memory of 844	3344	0aeb1cb71bfe51c1e50d92d6471af370N.exe	88
PID 3344 wrote to memory of 3288	3344	0aeb1cb71bfe51c1e50d92d6471af370N.exe	89
PID 3344 wrote to memory of 3288	3344	0aeb1cb71bfe51c1e50d92d6471af370N.exe	89
PID 3344 wrote to memory of 3288	3344	0aeb1cb71bfe51c1e50d92d6471af370N.exe	89
PID 844 wrote to memory of 1320	844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe	90
PID 844 wrote to memory of 1320	844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe	90
PID 844 wrote to memory of 3840	844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe	91
PID 844 wrote to memory of 3840	844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe	91
PID 844 wrote to memory of 3840	844	._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe	91
PID 3840 wrote to memory of 64	3840	icsys.icn.exe	92
PID 3840 wrote to memory of 64	3840	icsys.icn.exe	92
PID 3840 wrote to memory of 64	3840	icsys.icn.exe	92
PID 64 wrote to memory of 1644	64	explorer.exe	93
PID 64 wrote to memory of 1644	64	explorer.exe	93
PID 64 wrote to memory of 1644	64	explorer.exe	93
PID 3288 wrote to memory of 4972	3288	Synaptics.exe	94
PID 3288 wrote to memory of 4972	3288	Synaptics.exe	94
PID 3288 wrote to memory of 4972	3288	Synaptics.exe	94
PID 1644 wrote to memory of 4976	1644	spoolsv.exe	95
PID 1644 wrote to memory of 4976	1644	spoolsv.exe	95
PID 1644 wrote to memory of 4976	1644	spoolsv.exe	95
PID 4976 wrote to memory of 3664	4976	svchost.exe	97
PID 4976 wrote to memory of 3664	4976	svchost.exe	97
PID 4976 wrote to memory of 3664	4976	svchost.exe	97
PID 4972 wrote to memory of 1088	4972	._cache_Synaptics.exe	98
PID 4972 wrote to memory of 1088	4972	._cache_Synaptics.exe	98
PID 4972 wrote to memory of 720	4972	._cache_Synaptics.exe	99
PID 4972 wrote to memory of 720	4972	._cache_Synaptics.exe	99
PID 4972 wrote to memory of 720	4972	._cache_Synaptics.exe	99
PID 720 wrote to memory of 4416	720	icsys.icn.exe	100
PID 720 wrote to memory of 4416	720	icsys.icn.exe	100
PID 720 wrote to memory of 4416	720	icsys.icn.exe	100

C:\Users\Admin\AppData\Local\Temp\0aeb1cb71bfe51c1e50d92d6471af370N.exe
"C:\Users\Admin\AppData\Local\Temp\0aeb1cb71bfe51c1e50d92d6471af370N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Users\Admin\AppData\Local\Temp\._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:844
- - \??\c:\users\admin\appdata\local\temp\._cache_0aeb1cb71bfe51c1e50d92d6471af370n.exe
    c:\users\admin\appdata\local\temp\._cache_0aeb1cb71bfe51c1e50d92d6471af370n.exe
    3⤵
    - Executes dropped EXE
    PID:1320
- - C:\Windows\Resources\Themes\icsys.icn.exe
    C:\Windows\Resources\Themes\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:64
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        6⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3664
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe
      c:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate
      4⤵
      Executes dropped EXE
      PID:1088
  - - C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:720
    - - \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4416

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
917KB

MD5
0aeb1cb71bfe51c1e50d92d6471af370

SHA1
6c50f5017e1f09c0bc6ffb05840ddb2529230f77

SHA256
62edc73eb9d18f60b28e98b66eb7e3e1adb0d414d58bc9c6f96fd4fda0b47300

SHA512
f5c83000d6628a41965572f3cfe0a81f14e97f7956a19f847ec6674ea8d7bd14cb3d53f678b2e09150e9086c55d680ef4d9568e3de59b4bb2c4846531d7f1ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_0aeb1cb71bfe51c1e50d92d6471af370N.exe

Filesize
164KB

MD5
51e9530b1ec13b565affb0a896b8dac7

SHA1
ab6b5bb75958e5a0676028b2d108a259c45d04b2

SHA256
c7c5ca459d3f5618631f1296f3d5d986d50a038fbb5ea00e7bf5a8f80bd4255f

SHA512
b97947dc27af04d42f51b4ffc8f977828543bdcb2b9f59b34cf63c19b71ef5eed72d4c72d532e2f558fe69d3f4179db64a8d22042929a2eb67bc664ba2d0dee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\02D75E00

Filesize
24KB

MD5
281eea253bbba8c4821ca2e656e6440d

SHA1
b1f6ea114e0a2f8d55f198967b93c884bd021822

SHA256
58d3f82eb9c8b3d8e6076a5653275a8713e2eab3ed372aba5ca7e466a3a6fccb

SHA512
d3028a6a961eb1276069de4520e2b03b711690bff3ed0c8bda55c2f407342dabb1a8c69b4b8ee1372802e1c979a3ee56065cac842d6d22aa7d2477014215eda0

Download Submit
C:\Users\Admin\AppData\Local\Temp\I7q2DLmV.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
47ec39a45c71737e631e317c0fcfeb14

SHA1
402e7a311f7f0375b33af555cac0c0039ea8176c

SHA256
d190dd1edf6b551f0a06deee9725e1a2d2c4c926339e47195d6fa57d5c10e11c

SHA512
437f0278fb8f0c649586e67b0226cd43a740243946514bb954d5d49611a0fb7c7e799c208d34ceb21f4df8348f3f5acb674254e471d51b3bff2548cab35f11e6

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
ae8d0e6d33bf6fd32d89b984937ece4c

SHA1
a180790d7dcdbaad7e631c95b1d5cbb6d53a6954

SHA256
fe17ad94604121f51e09fde81e3fcf92184ae4647f059203bbd9df1ab395b0e5

SHA512
9371e2405e2bf598161b77487691ba3b4672ba90238e114d4a901653e0b71dfdc0dd3d9d5f24510ae4f170b9dfdcfdfb560bd22cee32cc144b27ccb3cfe0c578

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
244d64edcbef376480c5d80718e21ec9

SHA1
802fabba454c31e844afd16adb794bc44f48163d

SHA256
87108bda012d1c80e4d488294072a4625c06ce645b317e2a8f67c07450793e69

SHA512
b087d64529acfc793589cd6d052142af2690f658c7d190ae7fc63c2c076acbda985325e218e1dbd0eaf839330d747db3848575848e39c6dc47cfb793c0fd63c1

Download Submit
\??\c:\users\admin\appdata\local\temp\._cache_0aeb1cb71bfe51c1e50d92d6471af370n.exe

Filesize
29KB

MD5
dbd2194b7a5b38636edf7112ebc6fe91

SHA1
6fea8daee367fbdee5a299a214c0419ef04ea7bb

SHA256
927004a7ed771954853acfd331baf0a2d74c84037d4adff5a4a65fb1b287e586

SHA512
238cf410957b64bc0f8997fb3669b6f362e6b170c942fecca43ddc72a73ebffe75d829f0bade82cc712ca6786d6083921df9648d8c7a19ddc1e0de55cc526d42

Download Submit
\??\c:\windows\resources\spoolsv.exe

Filesize
135KB

MD5
1ebf55b1db7620151d66542940abfe88

SHA1
d5d4f74654d7016edf04eac47179ffb910051daa

SHA256
b3f6a7a31292516a0e26aed767fc7434af00f6fe205533db42180d27eb3b5019

SHA512
a04d86546fcc9f4655b6213bcb4b714e9f08a1c3d5bf3261eeb7d69beed2633693cb1cf5fc91305101c62ce7b250d1a27867bf4a87375fba408b06c9e2b1da87

Download Submit
memory/720-263-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/844-248-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/844-60-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1088-316-0x00000193DFE80000-0x00000193E0029000-memory.dmp

Filesize
1.7MB

Download
memory/1320-141-0x00000133A84A0000-0x00000133A84AE000-memory.dmp

Filesize
56KB

Download
memory/1320-315-0x00000133C2AF0000-0x00000133C2C99000-memory.dmp

Filesize
1.7MB

Download
memory/1644-245-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3288-134-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/3288-313-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/3288-314-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3288-354-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3344-0-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/3344-133-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/3620-244-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/3620-256-0x00007FFC1F7C0000-0x00007FFC1F7D0000-memory.dmp

Filesize
64KB

Download
memory/3620-258-0x00007FFC1F7C0000-0x00007FFC1F7D0000-memory.dmp

Filesize
64KB

Download
memory/3620-249-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/3620-239-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/3620-241-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/3620-242-0x00007FFC21D50000-0x00007FFC21D60000-memory.dmp

Filesize
64KB

Download
memory/3664-240-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3840-246-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3840-193-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4416-262-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4972-264-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4976-231-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download