xred | 77e1da6faed8b6c0eb9a1a0941050efbfc2e13eb30d3d9f1524644d2747f3b5b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2025 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cleaner.exe
Size

4.8MB
MD5

9f7814f6afd7096bf99503d1d3041fb2
SHA1

69fa12afa162ce8ae6b3fdb3a3c9c7dc4904c518
SHA256

77e1da6faed8b6c0eb9a1a0941050efbfc2e13eb30d3d9f1524644d2747f3b5b
SHA512

1e51811f4e5d671050e036f3cd007c24103a78a77df82130e1cbf2462ab16b0fcf24e00cecd7f009efa1b8f0d97460d8ddc7d92bfb0782826cc54282498e2db4
SSDEEP

98304:Wnsmtk2a8Lke9J+7dvr1tV/akJOTaHFNxIyA2NIaJlabbWeaO:ILvLkP7JptV/BWryXNIan+bWeaO

Score

10^/10

xred backdoor defense_evasion discovery persistence themida trojan

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	apple.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	apple.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	apple.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	apple.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	apple.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	apple.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	._cache_cleaner.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cleaner.exe

Executes dropped EXE 5 IoCs

pid	Process
3908	._cache_cleaner.exe
3580	Synaptics.exe
2624	._cache_Synaptics.exe
840	apple.exe
2280	apple.exe

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000a000000023b6f-211.dat	themida
behavioral2/memory/840-269-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida
behavioral2/memory/840-271-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida
behavioral2/memory/840-273-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida
behavioral2/memory/840-272-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida
behavioral2/memory/840-274-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida
behavioral2/memory/840-281-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida
behavioral2/memory/2280-283-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida
behavioral2/memory/2280-285-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida
behavioral2/memory/2280-284-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida
behavioral2/memory/2280-286-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida
behavioral2/memory/2280-289-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	cleaner.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	apple.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	apple.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
840	apple.exe
2280	apple.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cleaner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_cleaner.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3076	cmd.exe
4140	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
4732	taskkill.exe
1612	taskkill.exe
4736	taskkill.exe
3716	taskkill.exe
596	taskkill.exe
2724	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	cleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2972	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
3908	._cache_cleaner.exe
3908	._cache_cleaner.exe
3908	._cache_cleaner.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe
2624	._cache_Synaptics.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3908	._cache_cleaner.exe
Token: SeDebugPrivilege	2624	._cache_Synaptics.exe
Token: SeDebugPrivilege	3716	taskkill.exe
Token: SeDebugPrivilege	596	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	4736	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2972	EXCEL.EXE
2972	EXCEL.EXE
2972	EXCEL.EXE
2972	EXCEL.EXE
2972	EXCEL.EXE
2972	EXCEL.EXE
2972	EXCEL.EXE
2972	EXCEL.EXE

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3908	3512	cleaner.exe	82
PID 3512 wrote to memory of 3908	3512	cleaner.exe	82
PID 3512 wrote to memory of 3908	3512	cleaner.exe	82
PID 3512 wrote to memory of 3580	3512	cleaner.exe	84
PID 3512 wrote to memory of 3580	3512	cleaner.exe	84
PID 3512 wrote to memory of 3580	3512	cleaner.exe	84
PID 3580 wrote to memory of 2624	3580	Synaptics.exe	85
PID 3580 wrote to memory of 2624	3580	Synaptics.exe	85
PID 3580 wrote to memory of 2624	3580	Synaptics.exe	85
PID 2624 wrote to memory of 840	2624	._cache_Synaptics.exe	92
PID 2624 wrote to memory of 840	2624	._cache_Synaptics.exe	92
PID 840 wrote to memory of 1332	840	apple.exe	94
PID 840 wrote to memory of 1332	840	apple.exe	94
PID 1332 wrote to memory of 3716	1332	cmd.exe	95
PID 1332 wrote to memory of 3716	1332	cmd.exe	95
PID 840 wrote to memory of 4140	840	apple.exe	96
PID 840 wrote to memory of 4140	840	apple.exe	96
PID 4140 wrote to memory of 596	4140	cmd.exe	97
PID 4140 wrote to memory of 596	4140	cmd.exe	97
PID 840 wrote to memory of 2156	840	apple.exe	98
PID 840 wrote to memory of 2156	840	apple.exe	98
PID 2156 wrote to memory of 2724	2156	cmd.exe	99
PID 2156 wrote to memory of 2724	2156	cmd.exe	99
PID 3908 wrote to memory of 2280	3908	._cache_cleaner.exe	104
PID 3908 wrote to memory of 2280	3908	._cache_cleaner.exe	104
PID 2280 wrote to memory of 2076	2280	apple.exe	108
PID 2280 wrote to memory of 2076	2280	apple.exe	108
PID 2076 wrote to memory of 4732	2076	cmd.exe	109
PID 2076 wrote to memory of 4732	2076	cmd.exe	109
PID 2280 wrote to memory of 3076	2280	apple.exe	110
PID 2280 wrote to memory of 3076	2280	apple.exe	110
PID 3076 wrote to memory of 1612	3076	cmd.exe	111
PID 3076 wrote to memory of 1612	3076	cmd.exe	111
PID 2280 wrote to memory of 3876	2280	apple.exe	112
PID 2280 wrote to memory of 3876	2280	apple.exe	112
PID 3876 wrote to memory of 4736	3876	cmd.exe	113
PID 3876 wrote to memory of 4736	3876	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\cleaner.exe
"C:\Users\Admin\AppData\Local\Temp\cleaner.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Users\Admin\AppData\Local\Temp\._cache_cleaner.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_cleaner.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Users\Admin\AppData\Roaming\apple.exe
    "C:\Users\Admin\AppData\Roaming\apple.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2076
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im EpicGamesLauncher.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im FortniteClient-Win64-Shipping.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Battle.net.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Users\Admin\AppData\Roaming\apple.exe
      "C:\Users\Admin\AppData\Roaming\apple.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1332
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im EpicGamesLauncher.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4140
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im FortniteClient-Win64-Shipping.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2156
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im Battle.net.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
4.8MB

MD5
9f7814f6afd7096bf99503d1d3041fb2

SHA1
69fa12afa162ce8ae6b3fdb3a3c9c7dc4904c518

SHA256
77e1da6faed8b6c0eb9a1a0941050efbfc2e13eb30d3d9f1524644d2747f3b5b

SHA512
1e51811f4e5d671050e036f3cd007c24103a78a77df82130e1cbf2462ab16b0fcf24e00cecd7f009efa1b8f0d97460d8ddc7d92bfb0782826cc54282498e2db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_cleaner.exe

Filesize
4.0MB

MD5
b3721aa932bcab046794d3010a1f99c4

SHA1
0782d5f56c97398f4894b02424f7e305d65be9e4

SHA256
00e484be9b5d069b454762c4bd2f9c27b77ebff48e5d45cdf051a1c6865def03

SHA512
21f4ef5755058f7442518359dbd57bec159f94756e04c8f292b3a9b88470bb3bff926d7ff05b9a5b1f3033bef0e71b66987b4873172dea8b6d4671bf68ad7287

Download Submit
C:\Users\Admin\AppData\Local\Temp\E0E75E00

Filesize
21KB

MD5
922f92323de3d53e0a500477a57385af

SHA1
e6ff7e33616722e8f111dab258a202a624e86b84

SHA256
e70adb9baa454d7d9c9159d39a73a2cce25a32f93095c05821d689907b9e2f99

SHA512
92911f9d0b4b1046d2fd7db086398e406aca8f152209e965e5a41e45269de50f4e7fe23a70d8aef4b2bfcf4363670e8b0e96a8c660d24c407c05baad4e2c99ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\mW1P2KMr.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Roaming\AdvancedEventCleaner.exe

Filesize
219KB

MD5
9353ed7c3ba8e2417ce2664ae7afac16

SHA1
05699a2a2792795db1d8f59273172ad80bdc8b06

SHA256
069b31cb7f9054647b684da4fc5263fa690e32d75729ec6b5c808b0c532b9628

SHA512
cb456c14c9ef6f49a92c989668bedb423e4020b761e627c4d67f90e855e9385d58cf0d1e024a0c728126cccdad2836615d23cd3011a8447470482ca939795262

Download Submit
C:\Users\Admin\AppData\Roaming\apple.exe

Filesize
3.3MB

MD5
ba268b881bccd2784fe98289eec8ad72

SHA1
0c4e7f1473fb7ab22427480c3d784b6e0e404956

SHA256
c83921c8dda800ef24ebe873ec175617110dc9deb2629d1107f219ca30caece3

SHA512
30c836bb91ef96f5952571bba27d08c32011e619890fae392f882e5c7db7558ed26e6aa1fbdc2ce7d22c0a6aebc580e17ae807de70d99945cb2b438bd8cbbb3b

Download Submit
C:\Users\Admin\AppData\Roaming\bat1.bat

Filesize
22KB

MD5
fbd3ebe26a823f86ae2deed72df613b9

SHA1
ac360161007807aff1577ca90edc57b21c3d14c3

SHA256
8e43a6e232e9842777d3fce8c552bf942359757e6af092595c98ae101ee0e94d

SHA512
2def0b5306711a7806cdfe58196877cda39f3b0bcc5786776d9164f28310dfd85cbf922dc1619f2bba3dfa5c84a5701d1b948042e0af28b6af5c4c893ce045f5

Download Submit
C:\Users\Admin\AppData\Roaming\pchealth.bat

Filesize
123B

MD5
a0a567276adba677f093796ef6331ed6

SHA1
f094967448aed1488391db8ce705f239157af8e5

SHA256
21ee96777685cf8eb6cbce997d1045166b284986318335c131fc9679c3698b0b

SHA512
ac3765eed6ba5fdc41a8f2780f1fc88f8ac1a5f1b6087bef69c234ca57bedbe16d66e451d5751492f33fc52ba94ebea85d0134e64c03f01d50d0aa25c4ac094d

Download Submit
C:\Users\Admin\AppData\Roaming\tracefucker.exe

Filesize
426KB

MD5
a158fb5bce9e7f3adf129939d25f96df

SHA1
28adc37dee6605dc90e521fdc1c3d8c9fee2eab1

SHA256
561537d9facf1140ce4e3e25290c3bc31967c65d3d77c429afdea20557cb8e43

SHA512
5b2272fe5ec5a3fd3fd2dc0684817b7b917c81b8bbe0d50513acbd15c04e0a954d55fdf2632848f98004e4dd1eaf9c0475688ebceb97936d742338dd5a3198c5

Download Submit
memory/840-272-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/840-274-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/840-273-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/840-271-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/840-269-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/840-281-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/2280-285-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/2280-283-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/2280-289-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/2280-286-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/2280-284-0x00007FF77D780000-0x00007FF77E0A3000-memory.dmp

Filesize
9.1MB

Download
memory/2972-199-0x00007FFDCD640000-0x00007FFDCD650000-memory.dmp

Filesize
64KB

Download
memory/2972-195-0x00007FFDCFCD0000-0x00007FFDCFCE0000-memory.dmp

Filesize
64KB

Download
memory/2972-200-0x00007FFDCD640000-0x00007FFDCD650000-memory.dmp

Filesize
64KB

Download
memory/2972-194-0x00007FFDCFCD0000-0x00007FFDCFCE0000-memory.dmp

Filesize
64KB

Download
memory/2972-197-0x00007FFDCFCD0000-0x00007FFDCFCE0000-memory.dmp

Filesize
64KB

Download
memory/2972-193-0x00007FFDCFCD0000-0x00007FFDCFCE0000-memory.dmp

Filesize
64KB

Download
memory/2972-196-0x00007FFDCFCD0000-0x00007FFDCFCE0000-memory.dmp

Filesize
64KB

Download
memory/3512-129-0x0000000000400000-0x00000000008CD000-memory.dmp

Filesize
4.8MB

Download
memory/3512-0-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/3580-276-0x0000000000400000-0x00000000008CD000-memory.dmp

Filesize
4.8MB

Download
memory/3580-277-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3580-132-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3580-324-0x0000000000400000-0x00000000008CD000-memory.dmp

Filesize
4.8MB

Download
memory/3908-275-0x0000000072FFE000-0x0000000072FFF000-memory.dmp

Filesize
4KB

Download
memory/3908-259-0x0000000005390000-0x0000000005422000-memory.dmp

Filesize
584KB

Download
memory/3908-126-0x0000000072FFE000-0x0000000072FFF000-memory.dmp

Filesize
4KB

Download
memory/3908-133-0x0000000000270000-0x0000000000686000-memory.dmp

Filesize
4.1MB

Download
memory/3908-182-0x0000000002A10000-0x0000000002A16000-memory.dmp

Filesize
24KB

Download
memory/3908-192-0x0000000005680000-0x0000000005C24000-memory.dmp

Filesize
5.6MB

Download