Overview

overview

10

Static

static

10

9ba9faee4b...3N.exe

windows7-x64

10

9ba9faee4b...3N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2024, 08:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe

  • Size

    2.6MB

  • MD5

    96eb7e99f0364070a0e8d3471d231e10

  • SHA1

    55fc4d4d24ff2f37064b1a7d5c12ad365eeb0fd9

  • SHA256

    9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293

  • SHA512

    7bedca620ff5a2a7525bebb952833f80d0dfc4112b087f9bfdaa009dc16f258cce32cb3fac0ed6e295f2c9e22ad3262a78b77cc80619449aba936aa924277573

  • SSDEEP

    49152:xxTc2H2tFvduyS9xnsHyjtk2MYC5GDo0agE3nfmuO7diyvJFzcOt:3cy2Lk9xnsmtk2afaEPmuO7Iyv/zb

Score
10/10
gh0stratpurplefoxxredbackdoordiscoverypersistenceratrootkittrojanupx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Detect PurpleFox Rootkit 6 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 6 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Purplefox family
    purplefox
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 14 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
    "C:\Users\Admin\AppData\Local\Temp\9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Users\Admin\AppData\Local\Temp\RVN.exe
      C:\Users\Admin\AppData\Local\Temp\\RVN.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:576
    • C:\Users\Admin\AppData\Local\Temp\HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
      C:\Users\Admin\AppData\Local\Temp\HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Users\Admin\AppData\Local\Temp\._cache_HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1852
        • C:\VoiceRecorder\VoiceRecorder.exe
          "C:\VoiceRecorder\VoiceRecorder.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1220
          • C:\Windows\SysWOW64\control.exe
            "C:\Windows\System32\control.exe" mmsys.cpl,,1
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1488
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL mmsys.cpl,,1
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1028
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
            5⤵
              PID:2164
            • C:\Windows\explorer.exe
              "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
              5⤵
                PID:2612
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                5⤵
                  PID:1120
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                  5⤵
                    PID:2268
                  • C:\Windows\explorer.exe
                    "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                    5⤵
                      PID:2140
                    • C:\Windows\explorer.exe
                      "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                      5⤵
                        PID:1144
                      • C:\Windows\explorer.exe
                        "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                        5⤵
                          PID:1552
                        • C:\Windows\explorer.exe
                          "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                          5⤵
                            PID:2700
                          • C:\Windows\explorer.exe
                            "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                            5⤵
                              PID:2588
                            • C:\Windows\explorer.exe
                              "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                              5⤵
                                PID:2160
                              • C:\Windows\explorer.exe
                                "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                                5⤵
                                  PID:2060
                                • C:\Windows\explorer.exe
                                  "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                                  5⤵
                                    PID:1572
                                  • C:\Windows\explorer.exe
                                    "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                                    5⤵
                                      PID:3036
                                    • C:\Windows\explorer.exe
                                      "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                                      5⤵
                                        PID:1692
                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1248
                                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:1860
                              • C:\Windows\SysWOW64\TXPlatforn.exe
                                C:\Windows\SysWOW64\TXPlatforn.exe -auto
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:2588
                                • C:\Windows\SysWOW64\TXPlatforn.exe
                                  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
                                  2⤵
                                  • Drops file in Drivers directory
                                  • Sets service image path in registry
                                  • Executes dropped EXE
                                  • Suspicious behavior: LoadsDriver
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2524
                              • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
                                "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                                1⤵
                                • System Location Discovery: System Language Discovery
                                • Enumerates system info in registry
                                • Suspicious behavior: AddClipboardFormatListener
                                • Suspicious use of SetWindowsHookEx
                                PID:2468
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                PID:2936
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:1040
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2332
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:1776
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2316
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:992
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2084
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:1608
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2708
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2268
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:1144
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2216
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2116
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2648

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Temp\HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
                                      Filesize

                                      2.0MB

                                      MD5

                                      87731a0da9c52858fb470dcb6566a5cb

                                      SHA1

                                      d2afe4486ae3314bea12b2951f467d0d48779024

                                      SHA256

                                      c0a13b107b3128203822d063e21c392663110f09280008749939901704586201

                                      SHA512

                                      a0882c5c67747056dc5037b503a141e331466314af40564ef7b8858f11b06fac845388c3e8b80f626d3cc22f7090fa072af2cb9c80967cacef6b08888a001905

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\HD_X.dat
                                      Filesize

                                      704KB

                                      MD5

                                      7f9963fc8594f7ce175b43a8b5085c51

                                      SHA1

                                      916db8da2719c520f58f416b6d39ffff102efe79

                                      SHA256

                                      92ec73e13ce61c4599273887e61fe9f10fec1e8a30b0b32d0987a74f1e1508d4

                                      SHA512

                                      de32bfed76326ae1a4ff7bd00cd9f6110df3df9561f4979d779c07f568e86bc9c857ae84237f153d20d87eb6a3611210eb0f1a2723b08afdfa113e644239cd87

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Wh5sTQkD.xlsm
                                      Filesize

                                      17KB

                                      MD5

                                      e566fc53051035e1e6fd0ed1823de0f9

                                      SHA1

                                      00bc96c48b98676ecd67e81a6f1d7754e4156044

                                      SHA256

                                      8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

                                      SHA512

                                      a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      128KB

                                      MD5

                                      4ab90cf87d928c8f693f8c831ff46598

                                      SHA1

                                      a50c6445a9a9ef52f2b40f04b35707f1da96cae9

                                      SHA256

                                      44a3ca2f134cb0a52a931df3c09f2c52cb816e841e9fadeb0788a7bbd3e894ed

                                      SHA512

                                      0b96a12e8e38171e7febec42377990c5362a90dbd0b0c272b76b189e9aed4a31c182443ac90521a31e056b0f6bd1dd535177dbaacca654ac59a6d3c681d04f7f

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      256KB

                                      MD5

                                      aef435e7baa4baff4e1f0ae99293af3d

                                      SHA1

                                      b1dc787a4811475dec6e81a642be1caf55e41001

                                      SHA256

                                      6cfda8a5353f0e0709cb67ea9756df8287391b5ab6a64a291343d39b3c2e335c

                                      SHA512

                                      0b844f095e1cc73a63533030f17f9f6d433b68de7ca9057a1ef0adf05dcbb33d3b3c802cfe51576c1d0f6620f6c25f6c5822bf25655c7a477350d406ecc020c6

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      384KB

                                      MD5

                                      d086e9091b835459201ed761672d3522

                                      SHA1

                                      4d5e1f8314132b9de99c207d2621232ab1de29e2

                                      SHA256

                                      004af09948b24725857b225f7c4c691c304875483a18fa5063d7e8a173d59c74

                                      SHA512

                                      7ef1b64bf43f5f3495e99dabe96a798eb1aaef9c4ab0241c6e746485136f61d0b3eb5079577c0a926771b6bf59bdb96e8443e5a1a054bfc4439e2e3d33bb6bb2

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      576KB

                                      MD5

                                      02fc9bedcd5d5a2d0afbb257173df053

                                      SHA1

                                      351a6012a400e0d0cbbed65ba7e9c327e4e8c513

                                      SHA256

                                      643b940feb8354696500f38b8809430f9b98b51d438794c406a51caa33529dde

                                      SHA512

                                      6afe46a38905d1fb651668544827fcef537272959f32535fd637302d4d57eef0dbfba06b3a254134f108b4b6eb860db9bea388719d3ef288f5a6180ab4fd2bd5

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      704KB

                                      MD5

                                      4bb5eff51fd0539a831adc9c8150fd53

                                      SHA1

                                      697a5753d67ce1883d6b7900bdf6d36eeffa0bb2

                                      SHA256

                                      ce523ed309a6aa1f8f6efd3b8f917ca82607355abf2a6c0c01524ea112d8d276

                                      SHA512

                                      1e7be83e4e67fa4e11f1d8c74a91bd12fd12a386926d2dc00550eade4fa1e9ff0b8c7ee3f2d739698973ea35cc4a98e819222952d051a3d409b9e8df6933050e

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      832KB

                                      MD5

                                      52ea1663457b7ac74eb07322dcafdd0b

                                      SHA1

                                      c781aa61cb2b0e63b0eaca6964a7da89608cd21d

                                      SHA256

                                      45306de5b3ebc7231413ed5f93a9b82239979b8e66b82e1e977eaf4544b1a461

                                      SHA512

                                      c4ca97eedf0e74bd6c32daab8c2ac742191b927c040995bbd7c831f29bf9970bb57fe48b02e7293a45a622845ff37588b4ab72039f791faf20b39d5ec51315d2

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      960KB

                                      MD5

                                      1557f633daa7f3bc1b2a170e0e053108

                                      SHA1

                                      306b519b8dc2e26d09c8d7ac4fc4fb51f9a66d90

                                      SHA256

                                      c1a4aa8f462f29c5a89f86255043ded0149ce6299796a1e25fc7ee36e0788b23

                                      SHA512

                                      60cd4310a971d2130d8e29aa8b3d799f9dd9e5d7766b4335e80d96574e64ff953d166211109997ef832c561f2f3d8c1b2ed1c4a13dfd2712d56618aeac85e4aa

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      1.1MB

                                      MD5

                                      0f766bbf09f94fea8d8cfab6024053a0

                                      SHA1

                                      6965d2264d2afa9cb9b81c7ef2e3c4b42921a2a1

                                      SHA256

                                      742ed4feb8de4ad61fbded6cbfa0d0c8679b6d9b9618ced2b8bf689900956417

                                      SHA512

                                      80914af94aec53d31c89bb2303844f490bbd76d34cf342b7dd77ebe79dea59704407720afb5004cc676df99bba301aaf165c680703ceb9857b954d6bccd8f0b4

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      1.2MB

                                      MD5

                                      443086c143a936f46adf1e31ffd345f7

                                      SHA1

                                      5f0d08b178b779afcffc41b8b25e1f7a9bc047a8

                                      SHA256

                                      40602c7a8cae3ef2de8f232b6772bd0e23050d417761ae19158d3b7751fe623f

                                      SHA512

                                      374ffca8769e2f58a06025797702b15d5fa66b18cbc63e2766e6b78c2befc05ab83576fc67a365d158e2708395a9a228ce37527dafd490e1f04a96f3f2d7e41d

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      1.4MB

                                      MD5

                                      21b2a6e2f410136e799ea8b2877d2706

                                      SHA1

                                      ddf82e6d0f3138d8aa34651ef409f4116ef6f77e

                                      SHA256

                                      a9eb7b5d65d6596e235f0d602e4cb9322e572a4bc77c501cb24cb05ad12095a3

                                      SHA512

                                      f3ee9e29ce340f60c26592e0072e23cbf548e984f500d46855618d60da3bd6f20d7c0d43715a5c1a2394bb27a54e2c97f0d581c4d21fa06694a66fc3aa2240b9

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      1.6MB

                                      MD5

                                      fa44c31a0f94f4373caceab990432fd0

                                      SHA1

                                      885f60a325f6e2adc139aa27f3b9f5aeb4675f61

                                      SHA256

                                      634fca3d02c8a2375d2163ebfaf2898e9b05caa906661832d6fa0c67ef8d2be7

                                      SHA512

                                      4e927757929fbc5e874d40085780e98a8fc180661c914bf2c0cb453c647a2e32675de9ecd26fecfc2142836807c3c515d53f9127df5ebfcf7264410c666ff1f4

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      1.7MB

                                      MD5

                                      a6d15bf3c1ca10ba4d61c79989e4427c

                                      SHA1

                                      0dff36555e0b5d8c77b956f47d03f620230e0478

                                      SHA256

                                      19245e8f85240ba5f0086b0a84d359e50be3a3773fd6e99380d6a6533c6ead65

                                      SHA512

                                      5ba84271cbfab82b3a8c48e9814948a3cc4c1d310895e131e22ef42474f19c3a887da9af70f5f307eee4896a181798be5692a04ed39bc98eed2e367716b19891

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      1.8MB

                                      MD5

                                      3bc78ba8e3cf8fa50acdd710c14c8744

                                      SHA1

                                      71cc6cf88d8f3babcfa0c389122a1fb3bf69d7a6

                                      SHA256

                                      f745f943c4e2f532beac484138c4f1e1937a9e88511e6f52c8feb50a4586f014

                                      SHA512

                                      d95958168f6dde6941b3d5fbf3c04278ab8742e509554fe1a87116b5d199588a79b9885e1c9ba29b6b476861cd3077aa84b13fb3f23c35438279926989e8003e

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Voice.mp3
                                      Filesize

                                      1.9MB

                                      MD5

                                      055a01e72e6f53e185371b66f680e21c

                                      SHA1

                                      6b963a718b3ab325dc6631ddc5a0beffcf8ff4cd

                                      SHA256

                                      122e89a281236f91395bd16eeb5a251911d622b336a7b24899d7f524421545a5

                                      SHA512

                                      75491c630bef8b1b255437178f02628639b4682cf67ed656c0f3e521c5435cbf76e0871c9cbca6f99822d6ac99cd3edd8e1980cf6948fd67a24420df50c08d7e

                                      Download Submit

                                    • C:\\VoiceRecorder\lame_enc.dll
                                      Filesize

                                      380KB

                                      MD5

                                      09c1c1f8cc22889cfaf6409a5bd1b44a

                                      SHA1

                                      798634aab2a364410d6733d46942261a89589910

                                      SHA256

                                      de6bf1467ba398d3fbc11e1e5adddf7f8dc78394503f365942f7963f73e31dcb

                                      SHA512

                                      ffc0e82ffe0c8079a1291f116a92b37d65a8079d37231ecdb785ad27aecf93ce3b83acd151fdab87305ed168226a0ef1b18b41f6556d5fd3b126bc79756c5de7

                                      Download Submit

                                    • C:\\VoiceRecorder\lame_enc.dll.COPYING
                                      Filesize

                                      24KB

                                      MD5

                                      c46bda00ffbb0ba1dac22f8d087f54d9

                                      SHA1

                                      1679b0cb5406c6e4624f779c02e32985497f7aa7

                                      SHA256

                                      bfe4a52dc4645385f356a8e83cc54216a293e3b6f1cb4f79f5fc0277abf937fd

                                      SHA512

                                      5a8c5f4fc81fa2810a6901bcbd03a42d33330d54dfb29309c3033b3c9d33d28a73800342da5347b19903f2163493ec5ece3bb6b859cc85d3db721566b43e9741

                                      Download Submit

                                    • C:\\VoiceRecorder\lame_enc.dll.LICENSE
                                      Filesize

                                      707B

                                      MD5

                                      d83cc5a5e2fc3067b816c3dde356828f

                                      SHA1

                                      2309bbf695618cf23da8edd9b316c59f977bbd5a

                                      SHA256

                                      65bf0bf783b664daf3fa3e7e58d2238f26cceb5f3d05ef2371f8391689eb2b38

                                      SHA512

                                      6a4b83ae42a19971f1767cd8bfd5d477255180ebf7050b22216fd623d38381f3b220a5ec83c33aceff68162e6b33a3ddd80fb587bc660c40a253a981341e5ba4

                                      Download Submit

                                    • C:\\VoiceRecorder\lame_enc.dll.README
                                      Filesize

                                      1KB

                                      MD5

                                      98ec33313365031dd0bbdec70cef20e4

                                      SHA1

                                      525cbfe27188525ea394db9df459aba0c0efb290

                                      SHA256

                                      05c2c2b5b9e74190a22ce1bd9d4f6c2fd4df3537e7a67fdef7c0930c09712cbc

                                      SHA512

                                      c33c611edfe1fb3674f1c129fb85d4782d74c64ad80ae249e98d0a51ae874ab376e73252f4bac575ededaff6895fd47c3c97ed62714baff3af449a5a09ea7ea1

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\._cache_HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
                                      Filesize

                                      1.2MB

                                      MD5

                                      7160b7a1f3955696d5ee7cb492c4db93

                                      SHA1

                                      ed7ae36ab42b319362025ac6f8dcc64d85b83b3f

                                      SHA256

                                      ddbd3385f560d2d5061d26c9ad74465e4fa56be3bd112f7a77092fa2624b8567

                                      SHA512

                                      5f07b12b1500bd10ab927e8a8e5698bc4fc626b689c68eb20df018a070e1f5617a622a94ef4d544e401ed62c36de61fd24f703582c5faf880c0e6fe928954911

                                      Download Submit

                                    • \Users\Admin\AppData\Local\Temp\RVN.exe
                                      Filesize

                                      377KB

                                      MD5

                                      80ade1893dec9cab7f2e63538a464fcc

                                      SHA1

                                      c06614da33a65eddb506db00a124a3fc3f5be02e

                                      SHA256

                                      57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

                                      SHA512

                                      fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

                                      Download Submit

                                    • \Users\Admin\Desktop\InitializeDismount.exe
                                      Filesize

                                      945KB

                                      MD5

                                      e2a886f76de99e30f69a31f3782f870f

                                      SHA1

                                      de30397048b551083c66a2386cae1bac635c60ae

                                      SHA256

                                      c558879018f01f017df4e4949b0d82ad560fb5b25459d02de2604c17eda07c67

                                      SHA512

                                      4d59bfffaeaebafde7b7f27db0ab08f64a7bd6fcb91f07f2bc531be6ae419925a7068843e8cf1d3c033ecd029e34911983394c600df0a911a2a647bf8f56f03c

                                      Download Submit

                                    • \VoiceRecorder\VoiceRecorder.exe
                                      Filesize

                                      2.4MB

                                      MD5

                                      8e1ea51fc6e52bef4d4d82a3a7cf5e04

                                      SHA1

                                      401a12aa949ea67dbfbcb2efe7489115e84280cb

                                      SHA256

                                      cfa0551ea138c1382129247117fa2e50e9e4dda07d183a88b2336f0d1c77c96d

                                      SHA512

                                      1bfd6fef09e6342f9694e6706abd2f9d313a801527cfbddf7217eccffa69938c64be601e02315671af03f00bc5b9d107cabe33eece3bb0bb177bcfe38795c392

                                      Download Submit

                                    • memory/1248-138-0x0000000000400000-0x00000000005F9000-memory.dmp

                                      Filesize

                                      2.0MB

                                      Download

                                    • memory/1248-145-0x0000000000400000-0x00000000005F9000-memory.dmp

                                      Filesize

                                      2.0MB

                                      Download

                                    • memory/1248-193-0x0000000000400000-0x00000000005F9000-memory.dmp

                                      Filesize

                                      2.0MB

                                      Download

                                    • memory/1248-141-0x0000000000400000-0x00000000005F9000-memory.dmp

                                      Filesize

                                      2.0MB

                                      Download

                                    • memory/2468-118-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/2524-43-0x0000000010000000-0x00000000101B6000-memory.dmp

                                      Filesize

                                      1.7MB

                                      Download

                                    • memory/2524-50-0x0000000010000000-0x00000000101B6000-memory.dmp

                                      Filesize

                                      1.7MB

                                      Download

                                    • memory/2524-40-0x0000000010000000-0x00000000101B6000-memory.dmp

                                      Filesize

                                      1.7MB

                                      Download

                                    • memory/2852-71-0x0000000000400000-0x00000000005F9000-memory.dmp

                                      Filesize

                                      2.0MB

                                      Download

                                    • memory/2852-17-0x0000000000220000-0x0000000000221000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2936-142-0x0000000003A90000-0x0000000003AA0000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/2940-20-0x0000000010000000-0x00000000101B6000-memory.dmp

                                      Filesize

                                      1.7MB

                                      Download

                                    • memory/2940-22-0x0000000010000000-0x00000000101B6000-memory.dmp

                                      Filesize

                                      1.7MB

                                      Download

                                    • memory/2940-21-0x0000000010000000-0x00000000101B6000-memory.dmp

                                      Filesize

                                      1.7MB

                                      Download

                                    • memory/2940-18-0x0000000010000000-0x00000000101B6000-memory.dmp

                                      Filesize

                                      1.7MB

                                      Download