xred | 71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LWQDFZ.exe
Size

1.6MB
MD5

27bcc0d927e9f13250b1dff9e122e9af
SHA1

2f9f09f46fe7ee2a495247292b3f2be0777c2873
SHA256

71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1
SHA512

1bdf5d3ba61b8d99955b92b87377fcbea08db248aae1089a9028a0613eb06c43e330bd781edf66ec955b1042c811094207b8962e391b37fc516a4b93664c7653
SSDEEP

49152:cnsHyjtk2MYC5GDchloJf5fj22pkXaxMa:cnsmtk2alhlyLZ

Score

10^/10

xred backdoor discovery persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MHDFGY.lnk	._cache_LWQDFZ.exe

Executes dropped EXE 6 IoCs

pid	Process
2016	._cache_LWQDFZ.exe
2112	Synaptics.exe
1696	._cache_Synaptics.exe
2888	KQNALS.exe
3012	KQNALS.exe
1756	KQNALS.exe

Loads dropped DLL 6 IoCs

pid	Process
2868	LWQDFZ.exe
2868	LWQDFZ.exe
2868	LWQDFZ.exe
2112	Synaptics.exe
2112	Synaptics.exe
2016	._cache_LWQDFZ.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	LWQDFZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\MHDFGY = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\KQNALS.exe\""	._cache_LWQDFZ.exe

AutoIT Executable 20 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1696-41-0x0000000000FB0000-0x000000000119E000-memory.dmp	autoit_exe
behavioral1/memory/1696-43-0x0000000000FB0000-0x000000000119E000-memory.dmp	autoit_exe
behavioral1/memory/2016-132-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-134-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2888-140-0x0000000000FB0000-0x000000000119E000-memory.dmp	autoit_exe
behavioral1/memory/2016-141-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-143-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-145-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-147-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-149-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-179-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/3012-183-0x0000000001170000-0x000000000135E000-memory.dmp	autoit_exe
behavioral1/memory/2016-184-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-186-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-188-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-190-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-192-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/2016-194-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe
behavioral1/memory/1756-199-0x0000000001170000-0x000000000135E000-memory.dmp	autoit_exe
behavioral1/memory/2016-200-0x0000000000D80000-0x0000000000F6E000-memory.dmp	autoit_exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000d000000012262-4.dat	upx
behavioral1/memory/2016-18-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/1696-41-0x0000000000FB0000-0x000000000119E000-memory.dmp	upx
behavioral1/memory/1696-43-0x0000000000FB0000-0x000000000119E000-memory.dmp	upx
behavioral1/memory/2016-132-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-134-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2888-138-0x0000000000FB0000-0x000000000119E000-memory.dmp	upx
behavioral1/memory/2888-140-0x0000000000FB0000-0x000000000119E000-memory.dmp	upx
behavioral1/memory/2016-141-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-143-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-145-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-147-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-149-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-179-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/3012-182-0x0000000001170000-0x000000000135E000-memory.dmp	upx
behavioral1/memory/3012-183-0x0000000001170000-0x000000000135E000-memory.dmp	upx
behavioral1/memory/2016-184-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-186-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-188-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-190-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-192-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/2016-194-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx
behavioral1/memory/1756-197-0x0000000001170000-0x000000000135E000-memory.dmp	upx
behavioral1/memory/1756-199-0x0000000001170000-0x000000000135E000-memory.dmp	upx
behavioral1/memory/2016-200-0x0000000000D80000-0x0000000000F6E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KQNALS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LWQDFZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_LWQDFZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KQNALS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KQNALS.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2	._cache_LWQDFZ.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2836	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2116	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe
2016	._cache_LWQDFZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2016	._cache_LWQDFZ.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2116	EXCEL.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2016	2868	LWQDFZ.exe	28
PID 2868 wrote to memory of 2016	2868	LWQDFZ.exe	28
PID 2868 wrote to memory of 2016	2868	LWQDFZ.exe	28
PID 2868 wrote to memory of 2016	2868	LWQDFZ.exe	28
PID 2868 wrote to memory of 2112	2868	LWQDFZ.exe	29
PID 2868 wrote to memory of 2112	2868	LWQDFZ.exe	29
PID 2868 wrote to memory of 2112	2868	LWQDFZ.exe	29
PID 2868 wrote to memory of 2112	2868	LWQDFZ.exe	29
PID 2112 wrote to memory of 1696	2112	Synaptics.exe	30
PID 2112 wrote to memory of 1696	2112	Synaptics.exe	30
PID 2112 wrote to memory of 1696	2112	Synaptics.exe	30
PID 2112 wrote to memory of 1696	2112	Synaptics.exe	30
PID 2016 wrote to memory of 3020	2016	._cache_LWQDFZ.exe	32
PID 2016 wrote to memory of 3020	2016	._cache_LWQDFZ.exe	32
PID 2016 wrote to memory of 3020	2016	._cache_LWQDFZ.exe	32
PID 2016 wrote to memory of 3020	2016	._cache_LWQDFZ.exe	32
PID 2016 wrote to memory of 2784	2016	._cache_LWQDFZ.exe	34
PID 2016 wrote to memory of 2784	2016	._cache_LWQDFZ.exe	34
PID 2016 wrote to memory of 2784	2016	._cache_LWQDFZ.exe	34
PID 2016 wrote to memory of 2784	2016	._cache_LWQDFZ.exe	34
PID 3020 wrote to memory of 2836	3020	cmd.exe	35
PID 3020 wrote to memory of 2836	3020	cmd.exe	35
PID 3020 wrote to memory of 2836	3020	cmd.exe	35
PID 3020 wrote to memory of 2836	3020	cmd.exe	35
PID 880 wrote to memory of 2888	880	taskeng.exe	42
PID 880 wrote to memory of 2888	880	taskeng.exe	42
PID 880 wrote to memory of 2888	880	taskeng.exe	42
PID 880 wrote to memory of 2888	880	taskeng.exe	42
PID 880 wrote to memory of 3012	880	taskeng.exe	43
PID 880 wrote to memory of 3012	880	taskeng.exe	43
PID 880 wrote to memory of 3012	880	taskeng.exe	43
PID 880 wrote to memory of 3012	880	taskeng.exe	43
PID 880 wrote to memory of 1756	880	taskeng.exe	44
PID 880 wrote to memory of 1756	880	taskeng.exe	44
PID 880 wrote to memory of 1756	880	taskeng.exe	44
PID 880 wrote to memory of 1756	880	taskeng.exe	44

C:\Users\Admin\AppData\Local\Temp\LWQDFZ.exe
"C:\Users\Admin\AppData\Local\Temp\LWQDFZ.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\._cache_LWQDFZ.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_LWQDFZ.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn MHDFGY.exe /tr C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn MHDFGY.exe /tr C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe /sc minute /mo 1
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2836
- - C:\Windows\SysWOW64\WSCript.exe
    WSCript C:\Users\Admin\AppData\Local\Temp\MHDFGY.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2784
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1696

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2116

C:\Windows\system32\taskeng.exe
taskeng.exe {F49A0513-8084-4948-89E7-FE37CB1F8921} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2888
- C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3012
- C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  C:\Users\Admin\AppData\Roaming\Windata\KQNALS.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.6MB

MD5
27bcc0d927e9f13250b1dff9e122e9af

SHA1
2f9f09f46fe7ee2a495247292b3f2be0777c2873

SHA256
71c45be1d4e8d17aee605f93ee991d9117572e1f79c8991bfa2f7b37b285b5f1

SHA512
1bdf5d3ba61b8d99955b92b87377fcbea08db248aae1089a9028a0613eb06c43e330bd781edf66ec955b1042c811094207b8962e391b37fc516a4b93664c7653

Download Submit
C:\Users\Admin\AppData\Local\Temp\MHDFGY.vbs

Filesize
848B

MD5
93615efe60fa271e2c9a6ece88cc437e

SHA1
12891e90ac9f80c46989e1b64ddb68bfeb8308a7

SHA256
da8140f470730dcf0cce8791fea5e3aa24f1c29a72f07a0afc53f2d6797d9d64

SHA512
e0b0050bf27dbb8b6d7d1f66edc40922b8a060949f9882a7572a4b856d6b8ee34038fcd7ac41f3c7b187df73b498655d408775c892af4e56a36af74b4c4ce67a

Download Submit
C:\Users\Admin\AppData\Local\Temp\U5xzq1Aq.xlsm

Filesize
22KB

MD5
eec90e91669f3982ea73ecb0e2309bc4

SHA1
6e00fa1293adf7b2b139da014d09c8803b696a7a

SHA256
3300518b959e9504fec0e53c958b7910a783bbf076eefb0de9f752a8389499f0

SHA512
577ec8b5feb72467afc8affd5d90697786c09cc17020e84b1884c2e5018fd99064f6e8f6d80c972ec276eff158460b04db7230027f74299b9d88eea697911e06

Download Submit
C:\Users\Admin\AppData\Local\Temp\U5xzq1Aq.xlsm

Filesize
24KB

MD5
9aebe73c9d81f144da2cedf6f0c9d5cd

SHA1
f36b63b92be456982317cb2aad5b0a5e0493d8bb

SHA256
a830730146f1b725392b38b8a9f87753f7d4775cc13cc3fcc27fc5b6e6ee044e

SHA512
85db550544d48b9063db43db9038a8eada50f98ae31b2506e1b76cf5e4ba4d2f72a34b6af31d12c1a0a93b76554d9ec61e80025547bb5381076e23941e0e2088

Download Submit
C:\Users\Admin\AppData\Local\Temp\U5xzq1Aq.xlsm

Filesize
23KB

MD5
5f2dcfb8894e4a36dbe3cb0e73d21043

SHA1
fc1c57d85f356cd4f5b72153b8a024a0e12dc84e

SHA256
3810fa56e65bde5e86cde981c556464491e52ae46a48ced31b1d8aa5bfadafd9

SHA512
4d28f123e128d5b947e555f94277df27ea91e578ab5a060350e81d83ef06317ad851e4539743c6b1034e7f6ad973e7a4ac8de720daf15c3515f7273df3e32b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\U5xzq1Aq.xlsm

Filesize
26KB

MD5
454af1d1939f15d7391d7ed3672698f8

SHA1
ddc3d7545abded5a2ada6cbb92007a06cb68dde1

SHA256
dbb225296bdfe28ac4702c589da13e247fb516d8db4ac474111764d2f658b9fd

SHA512
0e4004d077472681591ca3db302a08e1f49cd622e299db53674c389dbc0d2a958df0a625f4b7691e861d76e5df567f71942cdad91e2af6306c789e767560b045

Download Submit
C:\Users\Admin\AppData\Local\Temp\U5xzq1Aq.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\Downloads\~$CompareClear.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_LWQDFZ.exe

Filesize
893KB

MD5
541fc19be6471027afb1dd324e4a8a80

SHA1
ed39e0a9aa016595f1ead34c221ce0b878e7cf64

SHA256
0a438a59e23472911fd3e08a50f58cad8008d01733a1159bb20b06b20b21aac0

SHA512
da7965709aded6570c282e02536e2fcdf51e6a42ced919adf75be4fb694017bcd332c229db4b07684265b471df6d2001d62a1c5327cd93f35520ff4fad83e086

Download Submit
memory/1696-43-0x0000000000FB0000-0x000000000119E000-memory.dmp

Filesize
1.9MB

Download
memory/1696-41-0x0000000000FB0000-0x000000000119E000-memory.dmp

Filesize
1.9MB

Download
memory/1756-199-0x0000000001170000-0x000000000135E000-memory.dmp

Filesize
1.9MB

Download
memory/1756-197-0x0000000001170000-0x000000000135E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-134-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-188-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-194-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-200-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-18-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-132-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-192-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-50-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/2016-190-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-179-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-186-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-184-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-141-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-143-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-145-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-147-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2016-149-0x0000000000D80000-0x0000000000F6E000-memory.dmp

Filesize
1.9MB

Download
memory/2112-135-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2112-180-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2112-142-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2112-133-0x0000000005610000-0x00000000057FE000-memory.dmp

Filesize
1.9MB

Download
memory/2112-39-0x0000000005610000-0x00000000057FE000-memory.dmp

Filesize
1.9MB

Download
memory/2116-44-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2868-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2868-28-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/2868-16-0x0000000005770000-0x000000000595E000-memory.dmp

Filesize
1.9MB

Download
memory/2888-140-0x0000000000FB0000-0x000000000119E000-memory.dmp

Filesize
1.9MB

Download
memory/2888-138-0x0000000000FB0000-0x000000000119E000-memory.dmp

Filesize
1.9MB

Download
memory/3012-182-0x0000000001170000-0x000000000135E000-memory.dmp

Filesize
1.9MB

Download
memory/3012-183-0x0000000001170000-0x000000000135E000-memory.dmp

Filesize
1.9MB

Download