asyncrat | 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1

Resubmissions

22/05/2026, 11:01

260522-m41qjsht3q

22/05/2026, 01:10

260522-bjb1xaet6110

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-uk
resource tags

arch:x64arch:x86image:win11-20260513-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Synaptics.exe
Size 764KB
Sample260522-bjb1xaet61
SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
MD5 85e3d4ac5a6ef32fb93764c090ef32b7
SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
TLSH
T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor beyond defense_evasion discovery execution asyncrat lumma xred persistence rat stealer

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

asyncrat

Botnet

Beyond

Attributes

c2_url_file
https://rentry.co/Spread4Filly/raw
delay
2
install
true
install_file
$77svchost.exe
install_folder
%AppData%

aes.plain

Extracted

Family

lumma

https://wifeplasterbakewis.shop/api
https://mealplayerpreceodsju.shop/api
https://bordersoarmanusjuw.shop/api
https://suitcaseacanehalk.shop/api
https://absentconvicsjawun.shop/api
https://pushjellysingeywus.shop/api
https://economicscreateojsu.shop/api
https://entitlementappwo.shop/api
https://palmeventeryjusk.shop/api

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral7/files/0x001900000002b613-400.dat	family_asyncrat

Downloads MZ/PE file 7 IoCs

flow	pid	Process
37	5024	._cache_Synaptics.exe
37	5024	._cache_Synaptics.exe
37	5024	._cache_Synaptics.exe
37	5024	._cache_Synaptics.exe
28	5024	._cache_Synaptics.exe
30	1392	._cache_Synaptics.exe
42	5024	._cache_Synaptics.exe

Executes dropped EXE 14 IoCs

pid	Process
5024	._cache_Synaptics.exe
692	Synaptics.exe
2900	Synaptics.exe
3460	._cache_Synaptics.exe
1392	._cache_Synaptics.exe
2940	MDClient.exe
4960	agent.exe
3316	CFXBypass.exe
5104	btpc.exe
3992	keepvid-pro_full2578.exe
4504	svchost.exe
5124	TempSpoofer.exe
416	$77svchost.exe
5060	$77svchost.exe

Loads dropped DLL 4 IoCs

pid	Process
692	Synaptics.exe
692	Synaptics.exe
692	Synaptics.exe
692	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Synaptics.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
41	pastebin.com
1	raw.githubusercontent.com
37	raw.githubusercontent.com
40	pastebin.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Files\MDClient.exe	._cache_Synaptics.exe
File created	C:\Windows\SysWOW64\Files\adpopup_1382523956.exe	._cache_Synaptics.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File created	C:\Windows\SysWOW64\Files\ScanPort.exe	._cache_Synaptics.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3992 set thread context of 1528	3992	keepvid-pro_full2578.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MDClient.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1768	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2824	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5568	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4960	agent.exe
3316	CFXBypass.exe
5124	TempSpoofer.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe
4504	svchost.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	._cache_Synaptics.exe
Token: SeDebugPrivilege	3460	._cache_Synaptics.exe
Token: SeDebugPrivilege	1392	._cache_Synaptics.exe
Token: SeDebugPrivilege	2940	MDClient.exe
Token: SeDebugPrivilege	3316	CFXBypass.exe
Token: SeDebugPrivilege	5124	TempSpoofer.exe
Token: SeDebugPrivilege	4504	svchost.exe
Token: SeDebugPrivilege	416	$77svchost.exe
Token: SeDebugPrivilege	5060	$77svchost.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5568	EXCEL.EXE
5568	EXCEL.EXE
5568	EXCEL.EXE
5568	EXCEL.EXE
5568	EXCEL.EXE
5568	EXCEL.EXE
692	Synaptics.exe
692	Synaptics.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 5024	4700	Synaptics.exe	79
PID 4700 wrote to memory of 692	4700	Synaptics.exe	81
PID 692 wrote to memory of 3460	692	Synaptics.exe	84
PID 2900 wrote to memory of 1392	2900	Synaptics.exe	88
PID 1392 wrote to memory of 2940	1392	._cache_Synaptics.exe	90
PID 5024 wrote to memory of 4960	5024	._cache_Synaptics.exe	91
PID 5024 wrote to memory of 3316	5024	._cache_Synaptics.exe	93
PID 5024 wrote to memory of 5104	5024	._cache_Synaptics.exe	94
PID 5024 wrote to memory of 3992	5024	._cache_Synaptics.exe	96
PID 5024 wrote to memory of 4504	5024	._cache_Synaptics.exe	97
PID 5024 wrote to memory of 5124	5024	._cache_Synaptics.exe	98
PID 4504 wrote to memory of 5360	4504	svchost.exe	100
PID 4504 wrote to memory of 3392	4504	svchost.exe	102
PID 5360 wrote to memory of 2824	5360	cmd.exe	104
PID 3392 wrote to memory of 1768	3392	cmd.exe	105
PID 3392 wrote to memory of 5060	3392	cmd.exe	108
PID 3992 wrote to memory of 1528	3992	keepvid-pro_full2578.exe	109
PID 3992 wrote to memory of 1528	3992	keepvid-pro_full2578.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Synaptics.exe
"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Users\Admin\AppData\Local\Temp\Files\agent.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\agent.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- - C:\Users\Admin\AppData\Local\Temp\Files\btpc.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\btpc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77svchost" /tr '"C:\Users\Admin\AppData\Roaming\$77svchost.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5360
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "$77svchost" /tr '"C:\Users\Admin\AppData\Roaming\$77svchost.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp50C1.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3392
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1768
    - - C:\Users\Admin\AppData\Roaming\$77svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\$77svchost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3460

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\SysWOW64\Files\MDClient.exe
    "C:\Windows\System32\Files\MDClient.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5568

C:\Users\Admin\AppData\Roaming\$77svchost.exe
"C:\Users\Admin\AppData\Roaming\$77svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.dll

Path C:\ProgramData\Synaptics\Synaptics.dll
Size 15KB
SHA256 b9eae90f8e942cc4586d31dc484f29079651ad64c49f90d99f86932630c66af2
MD5 c0ef4d6237d106bf51c8884d57953f92
SHA1 f1da7ecbbee32878c19e53c7528c8a7a775418eb
SHA512 c96947d47d49d8c09973c760f066b0fc600d9caa9f5972eac1d61c7d06d7c6c28c4b280827c576a63097c7daf6609b4930ad34a353fd784e748cadbdb971d4e6
SSDEEP 192:n+s61A/0LiwxqfKD6Vk/gqWhiQ7ST92s2APu4Tk8QjcW5tPx:lx0iwxqsRQmT92sPuR8Azr5
TLSH
T1C4625D47F6A29D72D000D9BCCD6A913DEB7F72373D491841CEA69CC9CD5A3910A1C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 764KB
SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
MD5 85e3d4ac5a6ef32fb93764c090ef32b7
SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
TLSH
T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_Synaptics.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
Size 10KB
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E585E00

Path C:\Users\Admin\AppData\Local\Temp\5E585E00
Size 27KB
SHA256 818dae824d346983492112add2ccbcd7458420714fbb276907ba456bc121ec9f
MD5 b38200725b0ad896457d50af7e601b3f
SHA1 839d92b185533aa9b66da36581e40b0814aebffa
SHA512 33454c6598fdbe379c19b430031680464e8f36561be89320e708eb4a256bce6fa05f03f8235c74eaf76b9200f5a11ee7ed17ea87cd5354c62319c71ea945c6f4
SSDEEP 768:MDBzINUjRW0pNO4o5bTiYT5bNWUbdy62oTg/+jUYa0ATxS:MDBcN+W0pgtVNNWUbdy/Kg/0bAI
TLSH
T1D9C2D0147ECDD02DD9304A37A84DA165B7012848CD134E97AA0AD1819E095FB7E7FAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFXBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
Size 36KB
SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
MD5 64eb7ad3aaf9b6639ccc5c0b30b6e59f
SHA1 1eb377e01e1e649b3290efb0160f25cb5d13bd21
SHA512 a6c32d40bc2a053c53f5db04e45a960695b33422cec59a58cd526cccfa8ceadbb1926ffdc8cb429f748cb2286b2bb33af3577e07e8ecd7f01901c22055634cb0
SSDEEP 768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof
TLSH
T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Round_Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Round_Setup.exe
Size 11KB
SHA256 3fe61f211905422f91d8882839e74047b55862b6f2a54a7ef4669d66629eb3d0
MD5 bccc574c58ae4328d9c63055899cb33a
SHA1 bb451cc6ae67b5cc403d05506947dfa81ed2b32e
SHA512 b34cab11e7011ca366c76fd5b737939f1188e6b0875284a9e9dd879f169ae49d2363acbd7aa6c01a3d854550b95404ae2b890c803dcd506f194dea8975f9a971
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzYki7Ca5yO0FfKYV37B6JG:sXX+/DV7k/3weauUYVV64
TLSH
T18D32C79CAFE0B2F0F22743DD37AB292D262550C72444D484FA8C6ED06F0B69D4746F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempSpoofer.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe
Size 36KB
SHA256 c96e2c1035a72c1bef5ff5887998c54dd5ce758707c261977347107122963d1d
MD5 656f110aff8ebb24d40200bb6070c2ef
SHA1 8710b6f43dd4a32195f2b36805e883d491bfecb4
SHA512 b21cf3bd8b9d6c8b05a8f2a14abd94e79544f57d8a9930b349efdf0862a351501460ade2c655817b558c1b1194119a2c577b62fa2e2c8a7fd59396cd4361bd91
SSDEEP 768:dmQZqx1lYcJnqnaFFzv1I52K3omDe0XbOfC11kqQm:d0lYov1I513omCMbO/qQm
TLSH
T1D9F25C48BB98C12FDA5F0E7D64A2066112719A620103DB8A7DCC65EFFFA77408A15FC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\agent.exe
Size 6.0MB
SHA256 3e88c306194019cb3aeb0407b46f208dd14c3aabdcc28e8fb5e782670ce87b90
MD5 d04fc2922ae435074389dddf2b0c995b
SHA1 b4050ff3ceda0827f07e143333d7d5a0b36562e1
SHA512 536944bafb29e920085ba88d4cafd6a51a91203ae88ae657130cb8c5d0fe50ebf0f69d92ad4e44db0310efdd4cf30d5fec2e07a763533d1297708f2b08e450ca
SSDEEP 49152:/fDuJwlVhxO3d5hGfxgYnv83eMAMvHK7FpJ+y4ZCMVxV3/VRUwKTK9KE3qFUUSfX:/zXnrnMiz5JWoM3qFUUSflU6fkEf
TLSH
T149565B03EC9215A9C1EAE63189629253BA717C486B3563DB3B50F7382F77BD06B78350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btpc.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\btpc.exe
Size 52KB
SHA256 82b8af3573d802255bb7d5ae34021502a8e7107cf3158aaa6d7f0029f7f52984
MD5 06f56e482c7bc153a0c59ec82d79f407
SHA1 3b359ac61b801393a38ea344b9505f697ad20db7
SHA512 b6a33f59f954554df282fac24e08031f69f1de62d93e298e2c5b13131a07ea3163a115041a3ab2fcbf295e01f6b39e31c8eec2192b6d804ee95e541de69ec8ce
SSDEEP 768:fkbmKa4sNNuB2ajXao1HqhE9aLPCyu//8JPSN1fTCI:fkqKa4bB2cBaLPCyu//8JPSNBGI
TLSH
T1F9338AB70583FF75ECC06A23E959FBE21A9E11F29B32B181D0FCCA805492717459AB74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keepvid-pro_full2578.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe
Size 9.9MB
SHA256 9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e
MD5 2627387eb5495186ee3850fdc0b2ebde
SHA1 8c062c24ad34332f8033a8cac193e4519d3d7534
SHA512 0c86e0b5de1b149913b7039fcc3fb8dcc17112617a5af731c3c90d6c822dbb7f2f5660e5790d0c134437383d5b6a71176839c0125c6c391f4ea26ffce0480b25
SSDEEP 49152:jJlStcFBY6j7b7zh0+6XM8i35UPSjVhw4LQOhXbjotS+BYsRKzOmXkcENi5Iq2rY:7SmFWivt8dYw406Lcg+BnY5REuB4Y
TLSH
T172A62A47A99694E8C0A9D234856192A1BB21BC58CB313BE33B50FBB47F76BD05F78704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
Size 63KB
SHA256 01c295a6690c48ff3196ff3ef0fef7383bdba9beaa6dadf8426e689263be5e20
MD5 da4b81bd7225f06fa1ff1a6c0f50c69f
SHA1 e630b7442a8f9cf9945216dcab8e750ebd01e307
SHA512 57017466deb54d0a7a582a5352cbc90600b08cc4b0bd7c0ebf017d30f008507ef9d5257920bc76ffb0e271b9dc358eed7dadefbb2d305d4f6da53bf51a65d3f0
SSDEEP 1536:tQGcst5j5BnihYUbfh9VTRlKQuZCdpqKmY7:Cg39BnaYUbfJttGz
TLSH
T18D536C013798C962E2AE86B8BCF2550006B1C6772516DA1E3CC850DB6B6FFC616537FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bu1apbsi.tnq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bu1apbsi.tnq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hF3Smvj2.xlsm

Path C:\Users\Admin\AppData\Local\Temp\hF3Smvj2.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp50C1.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp50C1.tmp.bat
Size 154B
SHA256 d7a28686078fb8df491ea1900f833893f97bf1950201936d16efb87681ab68ef
MD5 14a0aa36ee5edcc0ef4ffee54511b03c
SHA1 9999dfd8d4bbbeca7fc424b74bb2a53d81adfb14
SHA512 efcbb7b451e315d7a8994f42ab188765120a9714ecb8bcdb4d1eb1f724aab0f3fd834171a2582a78cf1864dcc43b8027e446b351f0dbaa8107263994fa11d0bb
TLSH
T17FC02B43A2C6EB0E280D149307FAD98E92B26C2A3F80BF90D705411E22C048CF0DA3CA
MD5 SHA1 SHA512 TLSH

Submit Download

MDClient.exe

Path C:\Windows\SysWOW64\Files\MDClient.exe
Size 554KB
SHA256 1fa15bcc25e702d940d76b98bd402d0783c25f60c1928ae7ed3612d1b9419d45
MD5 fe42e96e013688b343504698c491acc5
SHA1 c3df1aa34cdea565b62e306a7d4177253ae030a1
SHA512 9aa7b10dc4861e9864e136675cd6c52c4300f123dad4249f146998e6cdd1ddb843b5c247f680f488e1efeefd743ae02214e27a794a9d1fa9256dd38f3da1154e
SSDEEP 12288:yW7yNqbJTara8BQKGgZFKzdfKyHln0Idz6m:y49ara8BzezdScTl
TLSH
T10FC402077A942B42CA6411B5C8E3E82503FAE98B32F3D74D7F4503869E417E48DA6B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-266-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/692-280-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/692-305-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/692-292-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/692-290-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/692-131-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/692-268-0x0000000002950000-0x000000000295A000-memory.dmp

Download

memory/1528-442-0x0000000000ED0000-0x0000000000F1F000-memory.dmp

Download

memory/1528-443-0x0000000000ED0000-0x0000000000F1F000-memory.dmp

Download

memory/2900-202-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2940-327-0x0000000005E50000-0x0000000005E9C000-memory.dmp

Download

memory/2940-324-0x0000000000FB0000-0x0000000001040000-memory.dmp

Download

memory/2940-325-0x0000000005BC0000-0x0000000005C3C000-memory.dmp

Download

memory/2940-326-0x0000000005D40000-0x0000000005E18000-memory.dmp

Download

memory/3316-361-0x0000000002B70000-0x0000000002B92000-memory.dmp

Download

memory/3316-354-0x0000000000A50000-0x0000000000A60000-memory.dmp

Download

memory/3992-444-0x00007FF6EDA90000-0x00007FF6EE4D6000-memory.dmp

Download

memory/3992-441-0x00007FF6EDA90000-0x00007FF6EE4D6000-memory.dmp

Download

memory/4504-407-0x0000000000B30000-0x0000000000B46000-memory.dmp

Download

memory/4700-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/4700-127-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4700-0-0x0000000002200000-0x0000000002201000-memory.dmp

Download

memory/5024-132-0x0000000000020000-0x0000000000028000-memory.dmp

Download

memory/5024-136-0x0000000004B00000-0x0000000004B9C000-memory.dmp

Download

memory/5104-369-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5104-375-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5124-419-0x0000000000380000-0x0000000000390000-memory.dmp

Download

memory/5568-187-0x00007FF7F6110000-0x00007FF7F6120000-memory.dmp

Download

memory/5568-189-0x00007FF7F6110000-0x00007FF7F6120000-memory.dmp

Download

memory/5568-186-0x00007FF7F6110000-0x00007FF7F6120000-memory.dmp

Download

memory/5568-190-0x00007FF7F6110000-0x00007FF7F6120000-memory.dmp

Download

memory/5568-264-0x00007FF7F6110000-0x00007FF7F6120000-memory.dmp

Download

memory/5568-188-0x00007FF7F6110000-0x00007FF7F6120000-memory.dmp

Download

memory/5568-191-0x00007FF7F3AC0000-0x00007FF7F3AD0000-memory.dmp

Download

memory/5568-192-0x00007FF7F3AC0000-0x00007FF7F3AD0000-memory.dmp

Download

memory/5568-265-0x00007FF7F6110000-0x00007FF7F6120000-memory.dmp

Download

memory/5568-263-0x00007FF7F6110000-0x00007FF7F6120000-memory.dmp

Download

memory/5568-262-0x00007FF7F6110000-0x00007FF7F6120000-memory.dmp

Download