Overview

overview

10

Static

static

10

cc08d15b67...2f.exe

windows7-x64

10

cc08d15b67...2f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • submitted
    16/08/2024, 15:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
  • Size 1.2MB
  • Sample240816-slrmta1frd
  • SHA256 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
neshtaxredbackdoordiscoverypersistencespywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Detect Neshta payload 64 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
    "C:\Users\Admin\AppData\Local\Temp\cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Users\Admin\AppData\Local\Temp\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1276
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:944
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:804
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1832
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1424

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        2
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        3
        T1012

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROBR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
        • Size 368KB
        • SHA256 715f6420c423ae4068b25a703d5575f7c147b26e388f0fff1ae20c6abe821557
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RdrCEF.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
        • Size 9.4MB
        • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WCCHRO~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
        • Size 183KB
        • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Eula.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
        • Size 131KB
        • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FULLTR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
        • Size 254KB
        • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LOGTRA~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
        • Size 386KB
        • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        READER~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
        • Size 92KB
        • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        arh.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
        • Size 125KB
        • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        32BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
        • Size 142KB
        • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        64BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
        • Size 278KB
        • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ADOBEA~1.EXE
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
        • Size 454KB
        • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        java.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\java.exe
        • Size 366KB
        • SHA256 625a894f316118bcb6b291fcfe0d35b3bf0204285999885eb5b489bf1bd8581f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        javaw.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaw.exe
        • Size 325KB
        • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        javaws.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
        • Size 505KB
        • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GO664E~1.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE
        • Size 146KB
        • SHA256 d7f214dc55857c3576675279261a0ee1881f7ddee4755bb0b9e7566fc0f425a9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GOBD5D~1.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE
        • Size 221KB
        • SHA256 3fc32edf3f9ab889c2cdf225a446da1e12a7168a7a56165efe5e9744d172d604
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GOF5E2~1.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE
        • Size 146KB
        • SHA256 41bed95cb1101181a97460e2395efebb0594849e6f48b80a2b7c376ddf5ce0ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GOOGLE~2.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE
        • Size 258KB
        • SHA256 a892284c97c8888a589ea84f88852238b8cd97cc1f4af85b93b5c5264f5c40d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DISABL~1.EXE
        • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
        • Size 198KB
        • SHA256 d608c05409ac4bd05d8e0702fcf66dfae5f4f38cbae13406842fa5504f4d616f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MI391D~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MI391D~1.EXE
        • Size 138KB
        • SHA256 d9aefca370b6110c6eabbecd6bb9bda411c8e0bfdf15136ccf2dc651b2848daf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MICROS~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~1.EXE
        • Size 241KB
        • SHA256 1bc53119bb3acc0c7a710ac52a8dce738d9c824a1677bbced212ae2f9bb0317b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MICROS~2.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~2.EXE
        • Size 302KB
        • SHA256 f0ba8909bd6b9870d564802a5359bc2ba66387dc71813c3e5e61352d9916b881
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MICROS~3.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~3.EXE
        • Size 255KB
        • SHA256 9d23fea5415a3e6ac73f479f88db480f5312927882db83c0fa165a764e6999c7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MICROS~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13195~1.15\MICROS~1.EXE
        • Size 1.6MB
        • SHA256 4c0833c0cc0d218809efa0a90b36406a041b8df85fe555510ae93583ccf6f628
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe
        • Size 250KB
        • SHA256 4d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IDENTI~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE
        • Size 1.1MB
        • SHA256 abe398284d90be5e5e78f98654b88664e2e14478f7eb3f55c5fd1c1bcf1bebee
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE
        • Size 1.1MB
        • SHA256 34b8662d38e7d3d6394fa6c965d943d2c82ea06ba9d7a0af4f8e0571fb5a9c48
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NOTIFI~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE
        • Size 1.3MB
        • SHA256 75530dc732f35cc796d19edd11ae6d6f6ef6499ddcf2e57307582b1c5299554c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE
        • Size 1.1MB
        • SHA256 9abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe
        • Size 3.2MB
        • SHA256 2b3aa9642b291932ba7f9f3d85221402a9d27078f56ef0e9c6bca633616e3873
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
        • Size 1.1MB
        • SHA256 b71438fa2312dfd2a65277703cc1eacc080cd7e953de519ba9c54cc081ae51b1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MAINTE~1.EXE
        • Path C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE
        • Size 274KB
        • SHA256 06d363997722b0e3c4787f72ca61cb2a8ad59ea7ba8a9d14eafa8a8a550687a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UNINST~1.EXE
        • Path C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
        • Size 141KB
        • SHA256 e90c627265bc799db00828179a5d76717a577086755043ba223a9ac78510a2ff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        setup.exe
        • Path C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
        • Size 494KB
        • SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_RED~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE
        • Size 674KB
        • SHA256 ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE
        • Size 495KB
        • SHA256 45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WINDOW~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE
        • Size 650KB
        • SHA256 90cee4a89cc1401ac464818226b7df69aa930804cefce56758d4e2ea0009d924
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
        • Size 485KB
        • SHA256 8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WINDOW~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE
        • Size 650KB
        • SHA256 a6180f0aa9c56c32e71fe8dc150131177e4036a5a2111d0f3ec3c341fd813222
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WINDOW~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE
        • Size 650KB
        • SHA256 671be498af4e13872784eeae4bae2e462dfac62d51d7057b2b3bebff511b7d18
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
        • Size 495KB
        • SHA256 d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Synaptics.exe
        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 1.2MB
        • SHA256 cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        INTEGR~1.EXE
        • Path C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
        • Size 6.7MB
        • SHA256 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
        • Size 485KB
        • SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_RED~1.EXE
        • Path C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
        • Size 674KB
        • SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FILESY~1.EXE
        • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE
        • Size 293KB
        • SHA256 d2767c9c52835f19f6695c604081bf03cdd772a3731cd2e320d9db5e477d8af7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ONEDRI~1.EXE
        • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\ONEDRI~1.EXE
        • Size 2.4MB
        • SHA256 8c6f9493c2045bb7c08630cf3709a63e221001f04289b311efb259de3eb76bce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OneDrive.exe
        • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe
        • Size 1.6MB
        • SHA256 0a023355d1cc0a2348475d63aaf6aa0521d11e12a5c70102d7b3ebde092849e8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
        • Size 450KB
        • SHA256 4f603bf5e6a8d1fa2b0df6cc37fd13e55bd13029f46709c70369d669f2604324
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        18E75E00
        • Path C:\Users\Admin\AppData\Local\Temp\18E75E00
        • Size 25KB
        • SHA256 5648d09bbbf0b23435e62b4610f795aa1ad2dee1e807f80e301b3d94ccbca9b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_cc08d15b67fcc5ed8b92f3360e06e9cf229da6ecb0a887f9ae90243e3288692f.exe
        • Size 410KB
        • SHA256 8abd2e44b28a87912dd7e5f2df8e306aa44b690807edc2c136a6818115252252
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        E9aN1KfJ.xlsm
        • Path C:\Users\Admin\AppData\Local\Temp\E9aN1KfJ.xlsm
        • Size 17KB
        • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/804-170-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/944-360-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/944-365-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/944-363-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/944-357-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1424-171-0x00007FF7F7F10000-0x00007FF7F7F20000-memory.dmp
        Download

        memory/1424-152-0x00007FF7F9F70000-0x00007FF7F9F80000-memory.dmp
        Download

        memory/1424-169-0x00007FF7F7F10000-0x00007FF7F7F20000-memory.dmp
        Download

        memory/1424-160-0x00007FF7F9F70000-0x00007FF7F9F80000-memory.dmp
        Download

        memory/1424-149-0x00007FF7F9F70000-0x00007FF7F9F80000-memory.dmp
        Download

        memory/1424-154-0x00007FF7F9F70000-0x00007FF7F9F80000-memory.dmp
        Download

        memory/1424-153-0x00007FF7F9F70000-0x00007FF7F9F80000-memory.dmp
        Download

        memory/2576-355-0x0000000000400000-0x0000000000531000-memory.dmp
        Download

        memory/2576-356-0x0000000000610000-0x0000000000611000-memory.dmp
        Download

        memory/2576-110-0x0000000000610000-0x0000000000611000-memory.dmp
        Download

        memory/2576-392-0x0000000000400000-0x0000000000531000-memory.dmp
        Download

        memory/4008-0-0x00000000022C0000-0x00000000022C1000-memory.dmp
        Download

        memory/4008-103-0x0000000000400000-0x0000000000531000-memory.dmp
        Download

        memory/4540-358-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4540-354-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4540-361-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4540-366-0x0000000000400000-0x000000000041B000-memory.dmp
        Download