gh0strat | 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
Size

2.3MB
MD5

273744044bbc6e49baffda91a9dd6b38
SHA1

1088749a1051fc3c909959cdcb8c8d6a1d8af316
SHA256

8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50
SHA512

e077864cebcc5305f1f5c7c4d6380a84b6cd304a8fda198609da77d1d19d2bb2298ee3a1861cd8854e10c48f9cf9d44612aa6ea6f98bd82a2bb5645e96683daf
SSDEEP

49152:M09XJt4HIN2H2tFvduySCpEWoxv8nsHyjtk2MYC5GDs:xZJt4HINy2LkCKZxknsmtk2aR

Score

10^/10

gh0strat purplefox xred backdoor discovery macro persistence rat rootkit trojan upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Detect PurpleFox Rootkit 9 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/2816-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2816-12-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2816-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2808-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2572-37-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2572-36-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2572-72-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2572-70-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2572-75-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

resource	yara_rule
behavioral1/memory/2816-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2816-12-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2816-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2808-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2572-37-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2572-36-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2572-72-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2572-70-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2572-75-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Suspicious Office macro 6 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x000600000001960a-147.dat
behavioral1/files/0x000600000001960c-160.dat
behavioral1/files/0x000800000001960a-171.dat
behavioral1/files/0x000800000001960c-182.dat
behavioral1/files/0x000a00000001960a-193.dat
behavioral1/files/0x000600000001960d-206.dat

Executes dropped EXE 7 IoCs

pid	Process
2816	RVN.exe
2808	TXPlatforn.exe
2572	TXPlatforn.exe
2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
536	._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
1588	Synaptics.exe
532	._cache_Synaptics.exe

Loads dropped DLL 10 IoCs

pid	Process
2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
2808	TXPlatforn.exe
2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
1588	Synaptics.exe
1588	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2816-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2816-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2816-12-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2816-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2808-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2572-37-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2572-36-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2572-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2572-72-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2572-70-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2572-75-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RVN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatforn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2064	cmd.exe
1504	PING.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1504	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1780	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2572	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2816	RVN.exe
Token: SeLoadDriverPrivilege	2572	TXPlatforn.exe
Token: 33	2572	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2572	TXPlatforn.exe
Token: 33	2572	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2572	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
1780	EXCEL.EXE

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2816	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	30
PID 2776 wrote to memory of 2816	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	30
PID 2776 wrote to memory of 2816	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	30
PID 2776 wrote to memory of 2816	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	30
PID 2776 wrote to memory of 2816	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	30
PID 2776 wrote to memory of 2816	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	30
PID 2776 wrote to memory of 2816	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	30
PID 2816 wrote to memory of 2064	2816	RVN.exe	32
PID 2816 wrote to memory of 2064	2816	RVN.exe	32
PID 2816 wrote to memory of 2064	2816	RVN.exe	32
PID 2816 wrote to memory of 2064	2816	RVN.exe	32
PID 2808 wrote to memory of 2572	2808	TXPlatforn.exe	33
PID 2808 wrote to memory of 2572	2808	TXPlatforn.exe	33
PID 2808 wrote to memory of 2572	2808	TXPlatforn.exe	33
PID 2808 wrote to memory of 2572	2808	TXPlatforn.exe	33
PID 2808 wrote to memory of 2572	2808	TXPlatforn.exe	33
PID 2808 wrote to memory of 2572	2808	TXPlatforn.exe	33
PID 2808 wrote to memory of 2572	2808	TXPlatforn.exe	33
PID 2776 wrote to memory of 2664	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	35
PID 2776 wrote to memory of 2664	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	35
PID 2776 wrote to memory of 2664	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	35
PID 2776 wrote to memory of 2664	2776	8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	35
PID 2064 wrote to memory of 1504	2064	cmd.exe	36
PID 2064 wrote to memory of 1504	2064	cmd.exe	36
PID 2064 wrote to memory of 1504	2064	cmd.exe	36
PID 2064 wrote to memory of 1504	2064	cmd.exe	36
PID 2664 wrote to memory of 536	2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	37
PID 2664 wrote to memory of 536	2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	37
PID 2664 wrote to memory of 536	2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	37
PID 2664 wrote to memory of 536	2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	37
PID 2664 wrote to memory of 1588	2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	38
PID 2664 wrote to memory of 1588	2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	38
PID 2664 wrote to memory of 1588	2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	38
PID 2664 wrote to memory of 1588	2664	HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe	38
PID 1588 wrote to memory of 532	1588	Synaptics.exe	39
PID 1588 wrote to memory of 532	1588	Synaptics.exe	39
PID 1588 wrote to memory of 532	1588	Synaptics.exe	39
PID 1588 wrote to memory of 532	1588	Synaptics.exe	39

C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
"C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1504
- C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
  C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:536
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:532

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2572

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

Filesize
89KB

MD5
fd5137d1998bf8fcbab832123dd72256

SHA1
155e5dd08ecbe6483167f596c927208f4cca8a39

SHA256
86ee28923d4e7255762442fe93f220237197a756182ce320f5f6887b5c7147c5

SHA512
fd9270902cec43a84048a0e90ded14e56c9bae46ef067081d10784c82ec1a0ef7dc605b11d8819c9c5d75dea342df8a419bdd61f8ef7411c25fee932038ea465

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

Filesize
843KB

MD5
db06bd4b57933fb4dd26188ab9a013c7

SHA1
24fb49c4fbe2993e96595d1085dbae18d8a73db4

SHA256
5d3ccb3cf874eed6dabe680217d17a22096711ddfe184ecb825cf66b46837600

SHA512
cd20b5a3abc4b649ae490553e8ef4973a25b77cc6fc669f096928737eec359fdb53e00985314f14f94d3598bebf119ac17c760ece3cb45a0a56bc36c3521a784

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.5MB

MD5
43a309d76c3bb4a91e3d464b2adb1a70

SHA1
d12fc070e16edf51a1dbe8621fd3e1b2c4be60d3

SHA256
10801369a0b307d0b9abf07dab6a92263b7c66fa6fc66bb6d0c86260d2fba649

SHA512
6925d0cc83c2d8ca52fa58d49d98e94b667ec68d6e2de68d6bf3f3a406bc027a2db7f1aa3e5f4b13c84503d488b9d7392fcaf61e548dc27ddb102e45d327b9c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

Filesize
20KB

MD5
20ce3abe8f903992e7589b6b3237e429

SHA1
9e3445e1930e59f93e833046485d68d0adfdcf07

SHA256
8289c8e41c3cfafe03f8e041f78c2b8cd316c635434a09de6bb88c73c2f21c63

SHA512
e1c858f3b9226ba5d8e883ce5c8a20c5936451a461a7c24ffc09246c34db3c5e0047592a9efe1741bc7bcfd424278d9068790b1851470a8e21e2fad02145b2ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

Filesize
22KB

MD5
417d0181cf991fd6a706b4b29ba50a6d

SHA1
3a73f6fa3ed64989d891b2eeeaccb6b11c02a89e

SHA256
631e46f2cd6c097142c76e20bdd80879108218380d10698132547397a67041bc

SHA512
adfe038ab9deb7080251d34b9308bfe00471a67638b5a7f6c9dec6d6f386b7bce765f01b7fec54ab1c5348187041dddf0d22d7e0f6c4b17dcac9358aadff109a

Download Submit
C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

Filesize
26KB

MD5
15e176cb4a35320314790087b0d97bfa

SHA1
232b4d0319a9faf9a4f60f754a61c8e46cbb81e1

SHA256
986692be586b758ba71b75e4572887dd7a74155671db80831a3c9ecce03e700d

SHA512
10874f32c93bfe50a3b864ca1780f4c218dd96c6afaa4d084f8ee0c709738520c7042ec3411a0c5f7decb29e43c2b4e7e9c8ca24c03f2e7af14e51b6503d9239

Download Submit
C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

Filesize
25KB

MD5
09353ea8e5ca14c637e1c6aec099e92e

SHA1
aa1c85f33793f6231412b19ad776347231463e14

SHA256
b75bcfd3824bd2a03a4218ce2149b9a0e6da9511f9a9630bb42b6dbe766766dc

SHA512
964e5170c9fd509252e2925cc3fd84b1ea06b9cb52273e4affd09fd1a0a22c7954c9b96d5d97903b784b39b618bb2332c3e0fa734e66aeb370bf9549b1f6d2e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

Filesize
26KB

MD5
66973a669370a7755443735dc922b08f

SHA1
b35339ab698fb5ce976bbc5ab767264cc95ebd08

SHA256
7749e8696b3732253dffae21c928227254f9b5b5b4a9305a8006fc25ce11b805

SHA512
adc1aac6cfee5f155bc72a603369b929bebb060e3b2f685d57bf694190982c01facd1a7ddc9a52303013f304fe459e5a584af05f10304b5bb839f4893d6d7f25

Download Submit
C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

Filesize
23KB

MD5
5ea291c1a5890f888b20df62fb8c364d

SHA1
1bad63e61cb8e4df6ba463ff2e8fea1cf65f0a32

SHA256
1e6ed2f4d0484fc5fe34dc3deb522a127dcdaae0b6c047ae1c098f851410d298

SHA512
374e00367a80e9290731b95391ce157519f482ccdc888046177bf6028acb208c74695c77e8153f145588c70a1fa9fd4f8c8b8a27ab76c2712b1685d9128db8e6

Download Submit
C:\Users\Admin\Desktop\~$ConvertFromExpand.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\RVN.exe

Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
memory/1588-211-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1588-251-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1588-267-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1780-128-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-134-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-210-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1780-118-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-126-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-125-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-124-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-122-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-120-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-117-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-115-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-123-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-121-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-119-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-116-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-129-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-138-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-137-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-136-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-112-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1780-133-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-131-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-135-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-130-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-127-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1780-132-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/2572-70-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2572-72-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2572-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2572-75-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2572-36-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2572-37-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2664-101-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2808-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-12-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download