xred | 71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LWQDFZ.exe
Size

1.6MB
MD5

27bcc0d927e9f13250b1dff9e122e9af
SHA1

2f9f09f46fe7ee2a495247292b3f2be0777c2873
SHA256

71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1
SHA512

1bdf5d3ba61b8d99955b92b87377fcbea08db248aae1089a9028a0613eb06c43e330bd781edf66ec955b1042c811094207b8962e391b37fc516a4b93664c7653
SSDEEP

49152:cnsHyjtk2MYC5GDchloJf5fj22pkXaxMa:cnsmtk2alhlyLZ

Score

10^/10

xred backdoor discovery macro persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x000600000001879b-99.dat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MHDFGY.lnk	._cache_LWQDFZ.exe

Executes dropped EXE 5 IoCs

pid	Process
2124	._cache_LWQDFZ.exe
2056	Synaptics.exe
1260	._cache_Synaptics.exe
1744	KQNALS.exe
2492	KQNALS.exe

Loads dropped DLL 6 IoCs

pid	Process
2440	LWQDFZ.exe
2440	LWQDFZ.exe
2440	LWQDFZ.exe
2056	Synaptics.exe
2056	Synaptics.exe
2124	._cache_LWQDFZ.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	LWQDFZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\MHDFGY = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\KQNALS.exe\""	._cache_LWQDFZ.exe

AutoIT Executable 20 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1260-42-0x0000000000080000-0x000000000026E000-memory.dmp	autoit_exe
behavioral1/memory/1260-41-0x0000000000080000-0x000000000026E000-memory.dmp	autoit_exe
behavioral1/memory/2124-131-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/1260-132-0x0000000000080000-0x000000000026E000-memory.dmp	autoit_exe
behavioral1/memory/2124-133-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-136-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-138-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-140-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-142-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/1744-148-0x00000000013D0000-0x00000000015BE000-memory.dmp	autoit_exe
behavioral1/memory/2124-151-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-179-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-181-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-183-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-185-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-187-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2492-190-0x00000000013D0000-0x00000000015BE000-memory.dmp	autoit_exe
behavioral1/memory/2124-191-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-193-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe
behavioral1/memory/2124-195-0x00000000001F0000-0x00000000003DE000-memory.dmp	autoit_exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000d000000012262-17.dat	upx
behavioral1/memory/2124-18-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/1260-42-0x0000000000080000-0x000000000026E000-memory.dmp	upx
behavioral1/memory/1260-41-0x0000000000080000-0x000000000026E000-memory.dmp	upx
behavioral1/memory/2124-131-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/1260-132-0x0000000000080000-0x000000000026E000-memory.dmp	upx
behavioral1/memory/2124-133-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-136-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-138-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-140-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-142-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/1744-146-0x00000000013D0000-0x00000000015BE000-memory.dmp	upx
behavioral1/memory/1744-148-0x00000000013D0000-0x00000000015BE000-memory.dmp	upx
behavioral1/memory/2124-151-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-179-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-181-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-183-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-185-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-187-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2492-190-0x00000000013D0000-0x00000000015BE000-memory.dmp	upx
behavioral1/memory/2124-191-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-193-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx
behavioral1/memory/2124-195-0x00000000001F0000-0x00000000003DE000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_LWQDFZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KQNALS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KQNALS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LWQDFZ.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2	._cache_LWQDFZ.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2556	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2116	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe
2124	._cache_LWQDFZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2124	._cache_LWQDFZ.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2116	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2124	2440	LWQDFZ.exe	28
PID 2440 wrote to memory of 2124	2440	LWQDFZ.exe	28
PID 2440 wrote to memory of 2124	2440	LWQDFZ.exe	28
PID 2440 wrote to memory of 2124	2440	LWQDFZ.exe	28
PID 2440 wrote to memory of 2056	2440	LWQDFZ.exe	29
PID 2440 wrote to memory of 2056	2440	LWQDFZ.exe	29
PID 2440 wrote to memory of 2056	2440	LWQDFZ.exe	29
PID 2440 wrote to memory of 2056	2440	LWQDFZ.exe	29
PID 2056 wrote to memory of 1260	2056	Synaptics.exe	30
PID 2056 wrote to memory of 1260	2056	Synaptics.exe	30
PID 2056 wrote to memory of 1260	2056	Synaptics.exe	30
PID 2056 wrote to memory of 1260	2056	Synaptics.exe	30
PID 2124 wrote to memory of 2508	2124	._cache_LWQDFZ.exe	32
PID 2124 wrote to memory of 2508	2124	._cache_LWQDFZ.exe	32
PID 2124 wrote to memory of 2508	2124	._cache_LWQDFZ.exe	32
PID 2124 wrote to memory of 2508	2124	._cache_LWQDFZ.exe	32
PID 2124 wrote to memory of 2500	2124	._cache_LWQDFZ.exe	34
PID 2124 wrote to memory of 2500	2124	._cache_LWQDFZ.exe	34
PID 2124 wrote to memory of 2500	2124	._cache_LWQDFZ.exe	34
PID 2124 wrote to memory of 2500	2124	._cache_LWQDFZ.exe	34
PID 2508 wrote to memory of 2556	2508	cmd.exe	35
PID 2508 wrote to memory of 2556	2508	cmd.exe	35
PID 2508 wrote to memory of 2556	2508	cmd.exe	35
PID 2508 wrote to memory of 2556	2508	cmd.exe	35
PID 2096 wrote to memory of 1744	2096	taskeng.exe	42
PID 2096 wrote to memory of 1744	2096	taskeng.exe	42
PID 2096 wrote to memory of 1744	2096	taskeng.exe	42
PID 2096 wrote to memory of 1744	2096	taskeng.exe	42
PID 2096 wrote to memory of 2492	2096	taskeng.exe	43
PID 2096 wrote to memory of 2492	2096	taskeng.exe	43
PID 2096 wrote to memory of 2492	2096	taskeng.exe	43
PID 2096 wrote to memory of 2492	2096	taskeng.exe	43

C:\Users\Admin\AppData\Local\Temp\LWQDFZ.exe
"C:\Users\Admin\AppData\Local\Temp\LWQDFZ.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\._cache_LWQDFZ.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_LWQDFZ.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn MHDFGY.exe /tr C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn MHDFGY.exe /tr C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe /sc minute /mo 1
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2556
- - C:\Windows\SysWOW64\WSCript.exe
    WSCript C:\Users\Admin\AppData\Local\Temp\MHDFGY.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2500
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1260

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2116

C:\Windows\system32\taskeng.exe
taskeng.exe {B92F5E08-3979-4562-B071-29B508ED61FA} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1744
- C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.6MB

MD5
27bcc0d927e9f13250b1dff9e122e9af

SHA1
2f9f09f46fe7ee2a495247292b3f2be0777c2873

SHA256
71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1

SHA512
1bdf5d3ba61b8d99955b92b87377fcbea08db248aae1089a9028a0613eb06c43e330bd781edf66ec955b1042c811094207b8962e391b37fc516a4b93664c7653

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_LWQDFZ.exe

Filesize
893KB

MD5
541fc19be6471027afb1dd324e4a8a80

SHA1
ed39e0a9aa016595f1ead34c221ce0b878e7cf64

SHA256
0a438a59e23472911fd3e08a50f58cad8008d01733a1159bb20b06b20b21aac0

SHA512
da7965709aded6570c282e02536e2fcdf51e6a42ced919adf75be4fb694017bcd332c229db4b07684265b471df6d2001d62a1c5327cd93f35520ff4fad83e086

Download Submit
C:\Users\Admin\AppData\Local\Temp\MHDFGY.vbs

Filesize
848B

MD5
93615efe60fa271e2c9a6ece88cc437e

SHA1
12891e90ac9f80c46989e1b64ddb68bfeb8308a7

SHA256
da8140f470730dcf0cce8791fea5e3aa24f1c29a72f07a0afc53f2d6797d9d64

SHA512
e0b0050bf27dbb8b6d7d1f66edc40922b8a060949f9882a7572a4b856d6b8ee34038fcd7ac41f3c7b187df73b498655d408775c892af4e56a36af74b4c4ce67a

Download Submit
C:\Users\Admin\AppData\Local\Temp\xa4jAfI9.xlsm

Filesize
22KB

MD5
af2c378020baf65dbee9eb785997d056

SHA1
8c8efd8c3707f303890d39a3bd184736117f9079

SHA256
9ed52030a9cdd3001eab25dcc3e1bff44efd51eee87570f5434ec3324ae5adbb

SHA512
45d1c4ec71964b582e8241816cffc03a76e498627eb0388937412490aa2adcb69e6137236dd325b081344be99098e68f6f0e6fb4ea645538c87cb32002d3466a

Download Submit
C:\Users\Admin\AppData\Local\Temp\xa4jAfI9.xlsm

Filesize
23KB

MD5
f2249b71db2239101a620a928be1d1f2

SHA1
4febd5d1360d8366dcf2315a037db3f1305c62a7

SHA256
add9e0fe37a7c8ce4f8342de91b6da59bb2c47ecd5266516854f971fc627477e

SHA512
d1f5fae1398689129a07ed50083cf8ae9c3d21ab30cc1a5b9032db7f33c35a0a23d32e949c7d5b61416c351af131dd39ee5e89b66a0abc5ebfcb01a007ced4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\xa4jAfI9.xlsm

Filesize
24KB

MD5
26e2da22ced949da491a775845ecd784

SHA1
3c267cf37c776a1b90120fba25c11701d2711d91

SHA256
a21b136e6bc0e0d4b0e2b860e2fb53d303afdf46a1e1ee9c29bf89fc577cee77

SHA512
2432503e64e26fc6f1cbc3a7777da21db6a27aa00e4d1b6c76b6a6c832709a7bd75dd4839d344cef8dede743081cc8885207759ecd0882eca11ab66d1ec2fa33

Download Submit
C:\Users\Admin\AppData\Local\Temp\xa4jAfI9.xlsm

Filesize
26KB

MD5
59a1362e57ae15e209ac07ceb14923e2

SHA1
d83bf014a2d40f9112cda6df68b949af98aca2a1

SHA256
4061a69b5d53cd5ef6e88de714322489345729e065e6a1bebb8fc816ebadf291

SHA512
98473fa8fd5d392abc0220efc8654f5fa892aed466fc9cef2b71f8dd7a42eb2074e8bd6b166e927d2c074ee3545c0675821ccf683cda69ed9373fc5ecf8b118f

Download Submit
C:\Users\Admin\AppData\Local\Temp\xa4jAfI9.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\Downloads\~$CompareClear.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
memory/1260-132-0x0000000000080000-0x000000000026E000-memory.dmp

Filesize
1.9MB

Download
memory/1260-41-0x0000000000080000-0x000000000026E000-memory.dmp

Filesize
1.9MB

Download
memory/1260-42-0x0000000000080000-0x000000000026E000-memory.dmp

Filesize
1.9MB

Download
memory/1744-148-0x00000000013D0000-0x00000000015BE000-memory.dmp

Filesize
1.9MB

Download
memory/1744-146-0x00000000013D0000-0x00000000015BE000-memory.dmp

Filesize
1.9MB

Download
memory/2056-134-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2056-180-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2056-40-0x00000000042E0000-0x00000000044CE000-memory.dmp

Filesize
1.9MB

Download
memory/2056-137-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2116-43-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2124-136-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-151-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-135-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/2124-195-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-131-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-18-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-138-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-140-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-142-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-193-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-191-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-133-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-179-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-63-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/2124-181-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-183-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-185-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2124-187-0x00000000001F0000-0x00000000003DE000-memory.dmp

Filesize
1.9MB

Download
memory/2440-27-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2440-16-0x00000000057A0000-0x000000000598E000-memory.dmp

Filesize
1.9MB

Download
memory/2440-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2492-190-0x00000000013D0000-0x00000000015BE000-memory.dmp

Filesize
1.9MB

Download