xred | f5485ee25c93f2e5cc86c9e1d2c4d1eadbff308d76abbc0b06797610215e23d2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2025, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe
Size 5.6MB
Sample250104-bc9ctsspcw
SHA256 d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59
MD5 0c5dc3d854163db3f05e69da8c482963
SHA1 848e0dbd6b93c57b4178c5427f937c2826f888a1
SHA512 29414dc97fd959afe6dd6b41c4fef64942c19181b423549fd6f326ed0ca6466049449a3141965eb133defa2a714321ff34793e66ea57d5643e34f07fd9b41909
SSDEEP 98304:Rnsmtk2aIuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOb:tLK7wq1W6HqULS8djZDTaNNeCKVP5ORV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe

Executes dropped EXE 5 IoCs

pid	Process
4656	._cache_d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe
4532	Synaptics.exe
3784	Setup.exe
5108	._cache_Synaptics.exe
912	Setup.exe

Loads dropped DLL 10 IoCs

pid	Process
3784	Setup.exe
3784	Setup.exe
3784	Setup.exe
3784	Setup.exe
3784	Setup.exe
912	Setup.exe
912	Setup.exe
912	Setup.exe
912	Setup.exe
912	Setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Setup.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2780	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3784	Setup.exe
3784	Setup.exe
3784	Setup.exe
3784	Setup.exe
3784	Setup.exe
3784	Setup.exe
3784	Setup.exe
3784	Setup.exe
912	Setup.exe
912	Setup.exe
912	Setup.exe
912	Setup.exe
912	Setup.exe
912	Setup.exe
912	Setup.exe
912	Setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3784	Setup.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2780	EXCEL.EXE
912	Setup.exe
2780	EXCEL.EXE
2780	EXCEL.EXE
2780	EXCEL.EXE
2780	EXCEL.EXE
2780	EXCEL.EXE
2780	EXCEL.EXE
2780	EXCEL.EXE
3784	Setup.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4656	5080	d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe	83
PID 5080 wrote to memory of 4656	5080	d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe	83
PID 5080 wrote to memory of 4656	5080	d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe	83
PID 5080 wrote to memory of 4532	5080	d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe	84
PID 5080 wrote to memory of 4532	5080	d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe	84
PID 5080 wrote to memory of 4532	5080	d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe	84
PID 4656 wrote to memory of 3784	4656	._cache_d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe	85
PID 4656 wrote to memory of 3784	4656	._cache_d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe	85
PID 4656 wrote to memory of 3784	4656	._cache_d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe	85
PID 4532 wrote to memory of 5108	4532	Synaptics.exe	86
PID 4532 wrote to memory of 5108	4532	Synaptics.exe	86
PID 4532 wrote to memory of 5108	4532	Synaptics.exe	86
PID 5108 wrote to memory of 912	5108	._cache_Synaptics.exe	88
PID 5108 wrote to memory of 912	5108	._cache_Synaptics.exe	88
PID 5108 wrote to memory of 912	5108	._cache_Synaptics.exe	88

C:\Users\Admin\AppData\Local\Temp\d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe
"C:\Users\Admin\AppData\Local\Temp\d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\._cache_d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - \??\c:\2bfc5c9c133196eaa3bd2100\Setup.exe
    c:\2bfc5c9c133196eaa3bd2100\Setup.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3784
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - \??\c:\5c129783aa580db569ebe927e6\Setup.exe
      c:\5c129783aa580db569ebe927e6\Setup.exe InjUpdate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:912

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup.exe

Path C:\2bfc5c9c133196eaa3bd2100\Setup.exe
Size 76KB
SHA256 d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be
MD5 006f8a615020a4a17f5e63801485df46
SHA1 78c82a80ebf9c8bf0c996dd8bc26087679f77fea
SHA512 c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76
SSDEEP 1536:sYNItbBL5NWiiESc0exWZnqxMQP8ZOs0JD9rHUq:sYNAB9NWTZctc/gBJ9oq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupEngine.dll

Path C:\2bfc5c9c133196eaa3bd2100\SetupEngine.dll
Size 788KB
SHA256 7a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd
MD5 84c1daf5f30ff99895ecab3a55354bcf
SHA1 7e25ba36bcc7deed89f3c9568016ddb3156c9c5a
SHA512 e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3
SSDEEP 24576:GS62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8NmsBJj:GS62nlYAltBjPNJIkHST18QsBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupUi.dll

Path C:\2bfc5c9c133196eaa3bd2100\SetupUi.dll
Size 288KB
SHA256 11565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7
MD5 eb881e3dddc84b20bd92abcec444455f
SHA1 e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1
SHA512 5750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75
SSDEEP 3072:/LTVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZaiionv5y/y:HOoMFrz8ygAKWiiIyKf73w
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqmapi.dll

Path C:\2bfc5c9c133196eaa3bd2100\sqmapi.dll
Size 141KB
SHA256 bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
MD5 3f0363b40376047eff6a9b97d633b750
SHA1 4eaf6650eca5ce931ee771181b04263c536a948b
SHA512 537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
SSDEEP 3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9YSHlN:zDFB47UhXBh2yJ5HcOSSSHZqG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 5.6MB
SHA256 d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59
MD5 0c5dc3d854163db3f05e69da8c482963
SHA1 848e0dbd6b93c57b4178c5427f937c2826f888a1
SHA512 29414dc97fd959afe6dd6b41c4fef64942c19181b423549fd6f326ed0ca6466049449a3141965eb133defa2a714321ff34793e66ea57d5643e34f07fd9b41909
SSDEEP 98304:Rnsmtk2aIuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOb:tLK7wq1W6HqULS8djZDTaNNeCKVP5ORV
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_d9208fb65a6bd0364e830e1ff3689b07724d34dca35f5e9cd0c457278675eb59.exe
Size 4.8MB
SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
MD5 b88228d5fef4b6dc019d69d4471f23ec
SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

0F975E00

Path C:\Users\Admin\AppData\Local\Temp\0F975E00
Size 21KB
SHA256 9a0ebb46173fe3df8ed23201e7e3bf89375de9bc45461275bc00d74775cfc83f
MD5 e46be1891596c286f6b746f6b3c35dd0
SHA1 0fabf0173aa80d386691e5139a1635142352ddc0
SHA512 8a08494ac5b63b3e68578020eeabf8759c502c5a031fd68d6072fe1e198ed3057a8b8c81d0b61745b3daa23b0f6564a7bcae544f06caa733cdbc7078191ffca2
SSDEEP 384:Mm+63MHfp+o5b4mzd40N2bK3LM3jbgE++yVAM1bJIXuQCVAlHY5:Mm+6cf4o5b44d40yKbUbHidFIXNCVSHC
MD5 SHA1 SHA512 SSDEEP

Submit Download

HFI952C.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFI952C.tmp.html
Size 39KB
SHA256 16cbbc0e11ac034b704bf4ee4058ffbf65f01b79dc88ce4386e574e738cf44d6
MD5 fb40fccea7eece9d0544cc4d94468ad3
SHA1 5a363965c971e430ebf8261c9b1031fefb378f40
SHA512 749ff13bed5219a21dfecdd955771a5b6e5b7a5638c5902d156d5e369e6c387334ba2fed25f3cdf513c96d325017d7bae3099dfc890579525fe6b31e0243ff93
SSDEEP 384:fdsOT01KcBUFJFEWUxFzvHyysC6y2wxQEID:fdsOTLyUFJFEWUxFzvS6QH
MD5 SHA1 SHA512 SSDEEP

Submit Download

JElw29Jo.xlsm

Path C:\Users\Admin\AppData\Local\Temp\JElw29Jo.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\1028\LocalizedData.xml
Size 29KB
SHA256 a27f809211ea1a2d5224cd01101aa3a59bf7853168e45de28a16ef7ed6acd46a
MD5 7fc06a77d9aafca9fb19fafa0f919100
SHA1 e565740e7d582cd73f8d3b12de2f4579ff18bb41
SHA512 466dcc6a5fb015be1619f5725fa62ca46eb0fb428e11f93fd9d82e5df61c3950b3fb62d4db7746cc4a2be199e5e69eaa30b6f3354e0017cfa14d127fad52f8cf
SSDEEP 384:4Y6C7xfsxMEYgPNRAsy50keJzH7o3oDPnv:MxLJz7
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\1031\LocalizedData.xml
Size 40KB
SHA256 2aa6e8d402e44d9ee895b18195f46bf90259de1b6f44efd46a7075b110f2dcd6
MD5 b83c3803712e61811c438f6e98790369
SHA1 61a0bc59388786ced045acd82621bee8578cae5a
SHA512 e020f93e3a082476087e690ad051f1feb210e0915924bb4548cc9f53a7ee2760211890eb6036ce9e5e4a311abc0300e89e25efbbb894c2a621ffbc9d64cc8a38
SSDEEP 384:4nF+jpoHnZi8oO0GOJ2+8q6OUjEYJL/ZiITrKv:V03XjZJL/YIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\1033\LocalizedData.xml
Size 38KB
SHA256 5d90345ff74e177f6da8fb6459c1cfcac080e698215ca75feb130d0d1f2a76b9
MD5 d642e322d1e8b739510ca540f8e779f9
SHA1 36279c76d9f34c09ebddc84fd33fcc7d4b9a896c
SHA512 e1e16ae14bc7cc1608e1a08d3c92b6d0518b5fabd27f2c0eb514c87afc3d6192bf7a793a583afc65f1899f03dc419263b29174456e1ec9ab0f0110e0258e0f0d
SSDEEP 192:4kVKhG9aX0SDpI53/asO0KMv+VXxwVcPIv5COQu4SLbpmQVX5FB0zJOkue6Jjfz3:4MKhJkeZsdlNl9SJOkR6NXaxu
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupResources.dll

Path \??\c:\2bfc5c9c133196eaa3bd2100\1033\SetupResources.dll
Size 16KB
SHA256 36d0159ed1a7d88000737e920375868765c0a1dd6f5a5acbb79cf7d97d9e7a34
MD5 9547d24ac04b4d0d1dbf84f74f54faf7
SHA1 71af6001c931c3de7c98ddc337d89ab133fe48bb
SHA512 8b6048f4185a711567679e2de4789407077ce5bfe72102d3cb1f23051b8d3e6bfd5886c801d85b4e62f467dd12da1c79026a4bc20b17f54c693b2f24e499d40f
SSDEEP 192:byk5nUfwTW7JwWp0eW6jp8M+9HS8bC/TJs7kFkzQKPnEtObMacxc8hjeyveCXZBe:pgoTWp0eWB9ygC/TfFkzLXci2jpv8
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\1036\LocalizedData.xml
Size 40KB
SHA256 43f913ff28d677316f560a0f45221f35f27cfaf5fc5bd645974a82dca589edbf
MD5 e382abc19294f779d2833287242e7bc6
SHA1 1ceae32d6b24a3832f9244f5791382865b668a72
SHA512 06054c8048cade36a3af54f9a07fd8fa5eb4f3228790996d2abea7ee1ee7eb563d46bd54ff97441f9610e778194082c44e66c5f566c9c50a042aba9eb9cae25e
SSDEEP 192:4GrYAOJoFbZZ0eQiFaD4EbJeiI5hJUPu2oBknXoFDYnZCoroUnAJJFHq20/kFR/0:4GZUoRZc5ryx2fHIJR0kbG52gjfVv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\1040\LocalizedData.xml
Size 39KB
SHA256 c4c7c0ddaa6d6a3a1dc260e9c5a24bdfaa98c427c69e8a65427dd7cac0a4b248
MD5 0af948fe4142e34092f9dd47a4b8c275
SHA1 b3d6dd5c126280398d9055f90e2c2c26dbae4eaa
SHA512 d97b5fe2553ca78a3019d53e33d2db80c9fa1cf1d8d2501d9ddf0576c7e6ea38dab754fe4712123abf34b97e10b18fb4bbd1c76d3dacb87b4682e501f93423d9
SSDEEP 384:4hZo3+Ma9e1JzNZNs4fneAEJ0o5H/PuRv:NaudsJ1u
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\1041\LocalizedData.xml
Size 33KB
SHA256 01e7d24dd8e00b5c333e96d1bb83813e02e96f89aad0c2f28f84551d28abbbe2
MD5 7fcfbc308b0c42dcbd8365ba62bada05
SHA1 18a0f0e89b36818c94de0ad795cc593d0e3e29a9
SHA512 cd6f912a037e86d9e1982c73f0f8b3c4d5a9a6b5b108a7b89a46e6691e430a7cb55718de9a0c05650bb194c8d4a2e309ad6221d638cfca8e16aa5920881ba649
SSDEEP 192:4OTOo45ZyAYcou3LDnmUjMFsrHZmxqJOXhNCGYHre3iR7v:4OTOoMhYcRaOXJ6koIv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\1042\LocalizedData.xml
Size 32KB
SHA256 cccda55294aeb4af166a8c0449bca2189ddf5aa9a43d5e939dd3803e61738331
MD5 71dfd70ae141f1d5c1366cb661b354b2
SHA1 c4b22590e6f6dd5d39e5158b831ae217ce17a776
SHA512 5000d62f3de41c3fb0ed8a8e9c37dbf4eb427c4f1e3ad3823d4716c6fe62250bac11b7987a302b8a45d91aabcf332457f7aff7d99f15edeffe540639e9440e8a
SSDEEP 192:4cdsW0fwUrh+UgYUDQhGAtPN/2JWCTJSIQvPaLWL2C4oH/Drv:4cdszvrBgYUDQhF5N7IJSIQvkQfLH/Pv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\1049\LocalizedData.xml
Size 39KB
SHA256 beef0631c17a4fb1ff0b625c50c6cb6c8ce90a1ae62c5e60e14bf3d915ad509c
MD5 0eeb554d0b9f9fcdb22401e2532e9cd0
SHA1 08799520b72a1ef92ac5b94a33509d1eddf6caf8
SHA512 2180e46a5a2ea1f59c879b729806ca02a232c66660f29c338c1fa7fbee2afa4b13d8777d1f7b63cf831eb42f3e55282d70aa8e53f40616b8a6e4d695c36e313d
SSDEEP 384:4q0oG/2VrQa0inweNLvSli+CJA3aJW5cGUT3CT+v:DVFJl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\2052\LocalizedData.xml
Size 30KB
SHA256 d1735c8cfd8e10ba019d70818c19fa865e7c72f30ab6421a3748408f85fb96c3
MD5 52b1dc12ce4153aa759fb3bbe04d01fc
SHA1 bf21f8591c473d1fce68a9faf1e5942f486f6eba
SHA512 418903ae9a7baebf73d055e4774ff1917fbaab9ee7ed8c120c34bb10e7303f6dd7b7dae701596d4626387a30ae1b4d329a9af49b8718b360e2ff619c56c19623
SSDEEP 192:4Qn7cJwYTzOnyquEWTOAXUewfMcqQJywXk83GJPupIoxnb/2v:4Qn7cJxTC/uEWTfXUewiQJyoknJY9b+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\3082\LocalizedData.xml
Size 39KB
SHA256 f124d318138ff084b6484deb354cca0f72296e1341bf01169792b3e060c89e89
MD5 5397a12d466d55d566b4209e0e4f92d3
SHA1 fcffd8961fb487995543fc173521fdf5df6e243b
SHA512 7708f5a2ad3e4c90c4c216600435af87a1557f60caf880a3dd9b5f482e17399af9f0b9de03ff1dbdd210583e0fec5b466e35794ac24d6d37f9bbc094e52fc77b
SSDEEP 384:4fgA4Ukd+uYW1HCD1GO/tja2QDu7Jr++dP8z3AzOrv:tUZW1iDDdWCJi8Pg32Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

DHTMLHeader.html

Path \??\c:\2bfc5c9c133196eaa3bd2100\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ParameterInfo.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\ParameterInfo.xml
Size 8KB
SHA256 bf787b8c697ce418f9d4c07260f56d1145ca70db1cc4b1321d37840837621e8f
MD5 66590f13f4c9ba563a9180bdf25a5b80
SHA1 d6d9146faeec7824b8a09dd6978e5921cc151906
SHA512 aba67c66c2f3d9b3c9d71d64511895f15f696be8be0eedd2d6908e1203c4b0cf318b366f9f3cd9c3b3b8c0770462f83e6eea73e304c43f88d0cbedf69e7c92b3
SSDEEP 192:gCwdBdVv3CL021BqG2ahBCw2G2X2BCEj2G2KQ6G2nCw+KFl:kRPGiGPKGPGYCrKFl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupUi.xsd

Path \??\c:\2bfc5c9c133196eaa3bd2100\SetupUi.xsd
Size 29KB
SHA256 222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
MD5 2fadd9e618eff8175f2a6e8b95c0cacc
SHA1 9ab1710a217d15b192188b19467932d947b0a4f8
SHA512 a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca
SSDEEP 768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMC:1wchT+cxcDm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Strings.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\Strings.xml
Size 13KB
SHA256 e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca
MD5 332adf643747297b9bfa9527eaefe084
SHA1 670f933d778eca39938a515a39106551185205e9
SHA512 bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0
SSDEEP 384:VAZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+F:VAB
MD5 SHA1 SHA512 SSDEEP

Submit Download

UiInfo.xml

Path \??\c:\2bfc5c9c133196eaa3bd2100\UiInfo.xml
Size 35KB
SHA256 0d36a884a8381778bea71f5f9f0fc60cacadebd3f814679cb13414b8e7dbc283
MD5 812f8d2e53f076366fa3a214bb4cf558
SHA1 35ae734cfb99bb139906b5f4e8efbf950762f6f0
SHA512 1dcc3ef8c390ca49fbcd50c02accd8cc5700db3594428e2129f79feb81e4cbbeef1b4a10628b2cd66edf31a69ed39ca2f4e252ad8aa13d2f793fca5b9a1eaf23
SSDEEP 768:S4UR0d5v0SguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjT5fuPkfuS:S4UR0d5v0QYQLIN/6Fmhvk71sO0Nep3q
MD5 SHA1 SHA512 SSDEEP

Submit Download

print.ico

Path \??\c:\2bfc5c9c133196eaa3bd2100\graphics\print.ico
Size 1KB
SHA256 ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
MD5 7e55ddc6d611176e697d01c90a1212cf
SHA1 e2620da05b8e4e2360da579a7be32c1b225deb1b
SHA512 283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e
MD5 SHA1 SHA512

Submit Download

save.ico

Path \??\c:\2bfc5c9c133196eaa3bd2100\graphics\save.ico
Size 1KB
SHA256 ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
MD5 7d62e82d960a938c98da02b1d5201bd5
SHA1 194e96b0440bf8631887e5e9d3cc485f8e90fbf5
SHA512 ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67
MD5 SHA1 SHA512

Submit Download

setup.ico

Path \??\c:\2bfc5c9c133196eaa3bd2100\graphics\setup.ico
Size 35KB
SHA256 288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
MD5 3d25d679e0ff0b8c94273dcd8b07049d
SHA1 a517fc5e96bc68a02a44093673ee7e076ad57308
SHA512 3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255
SSDEEP 384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQcho:IMWQ2Bf8qqxMQP8pc4XessTJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

stop.ico

Path \??\c:\2bfc5c9c133196eaa3bd2100\graphics\stop.ico
Size 9KB
SHA256 b499e1b21091b539d4906e45b6fdf490d5445256b72871aece2f5b2562c11793
MD5 5dfa8d3abcf4962d9ec41cfc7c0f75e3
SHA1 4196b0878c6c66b6fa260ab765a0e79f7aec0d24
SHA512 69a13d4348384f134ba93c9a846c6760b342e3a7a2e9df9c7062088105ac0b77b8a524f179efb1724c0ce168e01ba8bb46f2d6fae39cabe32cab9a34fc293e4a
SSDEEP 96:uC1kqWje1S/f1AXa0w+2ZM4xD02EuZkULqcA0zjrpthQ2Ngms9+LmODclhpjdfLt:JkqAFqroMS9lD9Ngr9+m7bxpXHT5ToYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2780-331-0x00007FFB3C7D0000-0x00007FFB3C7E0000-memory.dmp

Download

memory/2780-329-0x00007FFB3C7D0000-0x00007FFB3C7E0000-memory.dmp

Download

memory/2780-328-0x00007FFB3C7D0000-0x00007FFB3C7E0000-memory.dmp

Download

memory/2780-327-0x00007FFB3C7D0000-0x00007FFB3C7E0000-memory.dmp

Download

memory/2780-330-0x00007FFB3C7D0000-0x00007FFB3C7E0000-memory.dmp

Download

memory/2780-394-0x00007FFB39FD0000-0x00007FFB39FE0000-memory.dmp

Download

memory/2780-414-0x00007FFB39FD0000-0x00007FFB39FE0000-memory.dmp

Download

memory/4532-209-0x0000000000B50000-0x0000000000B51000-memory.dmp

Download

memory/4532-520-0x0000000000B50000-0x0000000000B51000-memory.dmp

Download

memory/4532-519-0x0000000000400000-0x0000000000999000-memory.dmp

Download

memory/4532-551-0x0000000000400000-0x0000000000999000-memory.dmp

Download

memory/5080-0-0x0000000002720000-0x0000000002721000-memory.dmp

Download

memory/5080-192-0x0000000000400000-0x0000000000999000-memory.dmp

Download