xred | 3176ca42c555992236c340d19c2984e7a42b46a9782a43b624f3b69dcd24a9c6

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Size 2.0MB
Sample260702-t8fphae13k
SHA256 3176ca42c555992236c340d19c2984e7a42b46a9782a43b624f3b69dcd24a9c6
MD5 ba1d88e5d137b4ce5a67561586d6129b
SHA1 c6c4e91370cc53d9121473409edfcc231fad80bc
SHA512 40722321dfdf818972c5e3968ffca5b05714d0dd8b560fe31bbba33b9f9603e727615f9b1c16103f9c707e1cadc1bef55a57338181a0201b574b2f6c95b865a2
SSDEEP 24576:LnsJ39LyjbJkQFMhmC+6GD9T94LXtoHkurhvPnns+fXTT/aGCPaG:LnsHyjtk2MYC5GDcLdoHfPns+T/qa
TLSH
T14B955C26E65390BBC45336770A8BD1DB2524BB1088307A5FAAEC1D5CFB396507C2D3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution xred persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
3316	system.exe
3884	2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
4072	._cache_2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
1428	Synaptics.exe
4288	Synaptics.exe

Loads dropped DLL 3 IoCs

pid	Process
4576	Rundll32.exe
5848	Rundll32.exe
5848	Rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system.exe	2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
File created	C:\Windows\SysWOW64\gfftvgaa.dll	system.exe
File created	C:\Windows\SysWOW64\ndmuvgaa.dll	system.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5560	sc.exe
5684	sc.exe
696	sc.exe
3440	sc.exe
6048	sc.exe
6024	sc.exe
5876	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Synaptics.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4872	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
4576	Rundll32.exe
5848	Rundll32.exe
5848	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
808	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5924	2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 3316	5924	2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe	88
PID 3316 wrote to memory of 4576	3316	system.exe	89
PID 4576 wrote to memory of 3588	4576	Rundll32.exe	90
PID 4576 wrote to memory of 3608	4576	Rundll32.exe	91
PID 4576 wrote to memory of 5684	4576	Rundll32.exe	92
PID 4576 wrote to memory of 5560	4576	Rundll32.exe	93
PID 4576 wrote to memory of 6024	4576	Rundll32.exe	96
PID 4576 wrote to memory of 6048	4576	Rundll32.exe	97
PID 4576 wrote to memory of 3440	4576	Rundll32.exe	98
PID 4576 wrote to memory of 696	4576	Rundll32.exe	99
PID 4576 wrote to memory of 5924	4576	Rundll32.exe	87
PID 4576 wrote to memory of 3316	4576	Rundll32.exe	88
PID 4576 wrote to memory of 3588	4576	Rundll32.exe	90
PID 4576 wrote to memory of 3608	4576	Rundll32.exe	91
PID 4576 wrote to memory of 5684	4576	Rundll32.exe	92
PID 4576 wrote to memory of 5560	4576	Rundll32.exe	93
PID 4576 wrote to memory of 6024	4576	Rundll32.exe	96
PID 3588 wrote to memory of 5580	3588	net.exe	106
PID 3608 wrote to memory of 2828	3608	net.exe	107
PID 4576 wrote to memory of 5876	4576	Rundll32.exe	109
PID 3316 wrote to memory of 5848	3316	system.exe	111
PID 5924 wrote to memory of 3884	5924	2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe	114
PID 3884 wrote to memory of 4072	3884	2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe	115
PID 3884 wrote to memory of 1428	3884	2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Windows\SysWOW64\system.exe
  C:\Windows\system32\system.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\gfftvgaa.dll Exbcute
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\SysWOW64\net.exe
      net stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3588
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
  - - C:\Windows\SysWOW64\net.exe
      net stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2828
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5684
  - - C:\Windows\SysWOW64\sc.exe
      sc config MpsSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5560
  - - C:\Windows\SysWOW64\sc.exe
      sc stop ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:6024
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:6048
  - - C:\Windows\SysWOW64\sc.exe
      sc stop 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3440
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:696
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" stop PolicyAgent
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5876
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\ndmuvgaa.dll Exbcute
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5848
- C:\Users\Admin\AppData\Local\Temp\2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4072
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1428

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4872

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 753KB
SHA256 eab20f2e116b5c1d856a6cef5bd13b9b26cc62fc178c3e975656b8dddac27879
MD5 872cf28e17ba20b4cf6b4dae9b4104f6
SHA1 eca0c96a36998a9027dde73b6efd52dc6ef96700
SHA512 742b62c08b1c7c4b54f5b32a3fae5f412454c77fdf2aa941cf632f377dc3775c0006120345bece0812ce4991234901ccdf7849c4b28e99264403773aee9749de
SSDEEP 12288:3MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9I9r:3nsJ39LyjbJkQFMhmC+6GD9e
TLSH
T180F47D32F2D19437D1721A3D9C6BA3A5582ABE512E38794E3BF81E4C5F3D68138252D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Size 1.0MB
SHA256 c63d9f311f0ed56e5700aedb36aea57e2486a84646b89733643cade7a529a41c
MD5 2f797e67c95723780098b5844f558539
SHA1 1be5da45565dd35d294688ae83cb3a86654aae3c
SHA512 920d1018af745cf9b03d854bfa2ab79b24e90940a915c8e3a5c8d3976bdc4f5c3913b31f7416478b828f6e2876abb39678cfd5b3cf85ed7f71d71ee3d8b402e7
SSDEEP 12288:Rcn5+mwMPLrrMmphI2MHkPmJJlyky61v66CxOC6CeeivvnPnCOs+faJmTT/:d94LXtoHkurhvPnns+fXTT/
TLSH
T1F935C7669A5390BEC4433673068794DF3624D744C4307FAFAEAC1CACFB36610696D2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-02_ba1d88e5d137b4ce5a67561586d6129b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Size 1.8MB
SHA256 d5eba0faac47fadba2ba33408f26580c359320a53aa98dfa6c7525e6649ffec2
MD5 26cdac65e3daf9492940936a227e4cb0
SHA1 db91ce22cd416831940754c05045662e4634539a
SHA512 2c78b591f2e7c97ab9e5dcaf8a692fb79cbb7762222e41617638422dcb4ad1cef9d0d548119be3c563125cdf9edac909342efadd886c44433d279df0d4f45070
SSDEEP 24576:TnsJ39LyjbJkQFMhmC+6GD9T94LXtoHkurhvPnns+fXTT/O:TnsHyjtk2MYC5GDcLdoHfPns+T/O
TLSH
T1B9854B67A65390BBC45336770A8B95DF2524BB0488307E5F6AEC1C5CFB3A6107C2D2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AD295E00

Path C:\Users\Admin\AppData\Local\Temp\AD295E00
Size 22KB
SHA256 0b75fa482646fd2a102a354463224add190e6d7e99229d19d1b710bdd730bad8
MD5 befa59a830ab0c239913e352cb114576
SHA1 fbbb83ea8b7f38a95b164f2c180dc6d86ba6bc84
SHA512 16cbf31d1c9fded104734bbf2f84b2635c3cbc54fe8e370719ebee0ba936c895224d86153d8b88959b48f249615efc52bdf37e2711fc850249f222dbca05452e
SSDEEP 384:M7aHqeyEAnX5up+o5bZ8vyq78L1qktO8jO1oAILKE/gciNOtBK3XkfM9:MuHhAo4o5bWvy5LgktljOZILKE/gCtcn
TLSH
T17DA2D05CE0338D0BEDAB0A3D6089596CE107284964DBFEC93AC9E43E598172763BF5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AD62.tmp

Path C:\Users\Admin\AppData\Local\Temp\AD62.tmp
Size 2.1MB
SHA256 974e92b2a97436569c49462a80471bbc255a8b493fc90e2456996c09aed7518b
MD5 ab643592c60ae22b34fef0ff90dc0f07
SHA1 a7ded0b66d1e3e89b285f781e9defe00c6eb0528
SHA512 a1964a377f1499866f7c5d87a70004fc059140e4249502bca540bc3b92eae9e39605b082894a4246f5381fbacf5430f4797b40d405b9e1bcb3cc49c1ee9f33b3
SSDEEP 49152:FeSoNo12Vhg0TCHn0jyuCFUj+opuJo5h4vlng5M:F1oQ+hk+yusUbpuJo5h4x
TLSH
T1BEA58C23F45960A6CCF312F0914D773A92EC97308B2488C367B55AEBF9619C15B3279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XRmoDVJi.xlsm

Path C:\Users\Admin\AppData\Local\Temp\XRmoDVJi.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gfftvgaa.dll

Path C:\Windows\SysWOW64\gfftvgaa.dll
Size 77KB
SHA256 0018ee5ad65eda4843d24464fc41ecda9ae3e051aab404f3e6c4215940168c21
MD5 02fc7f52c9bc1141c0897c985fea35a6
SHA1 eba3456099c844eaa2b912c5af9ff3329d887b67
SHA512 cd586c85b2652bbcd1a41ff2c4c5fbf06a28791139e9e0306d6b8f934cf4df0ea78dbd1ddbe56cfaf5409767dea9b009f39454abf1c9ee1959f965153811ea7a
SSDEEP 1536:He1LerP4LPg1we6+EX6Pi7U02rd9cqCmh6DY5atOXPQj:HGSEdX6Pi7U0SJV
TLSH
T15B731744F301CD36C9D004BE6261D372751D6A32AB9FA4B377DA1E5AB7302F3A629706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ndmuvgaa.dll

Path C:\Windows\SysWOW64\ndmuvgaa.dll
Size 24KB
SHA256 6e7c04e90d3c42bc9af95eb5b03c60664fc812a62129a578906aa3d9b9be1664
MD5 66ed0210db83ddb4b2ba9128d19fdd2a
SHA1 a512e102bae54b299c90de3f3fb01184ad0bfd2e
SHA512 6fda543bdacecacd6aa1eb66a4b84a9aa49a23f212c4e0c36dcbf725a0739c5843c29465daca248679368057bfa208b67d764e9cd3844ba39a94c7283c5d7de0
SSDEEP 384:deNKXvoxOHye5RizkpgYiAOu86/0WhRR4u20bD0MR9CHom9W50e:deNK/oYyeuAyYN8oMu2GDrCHIie
TLSH
T157B2B3A4FB4EED21E19640B63264EB7A64486930578FB0D3F7C34E5155342E0AA7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.exe

Path C:\Windows\SysWOW64\system.exe
Size 180KB
SHA256 46c06dd866f383c20b06761471a362d4fda0746febad27eaf887905011867f6f
MD5 99a16b42e72e7c35319ded4d3d5855e5
SHA1 90874ed400dc698523bcdfa56dc30f18a3091297
SHA512 7de0fb9c597f45f1d10c98732adeb884a5df81ed926c33c03e27998c36d48d4f3295bfef8a33574f08158a7e47d4c357af992ef64a7f4dc15277874730bbb713
SSDEEP 3072:T2Tbs/GSEdX6Pi7U0SJVnBOyYN8u2r91szoI7h+aS1G5:q5SEkJVnB+2Uzo0naG5
TLSH
T1ED048D04F741DD32C4C100BE6175D772652D6A325B9F90A3B7DA1F6ABB302E2AA39707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1428-189-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1428-180-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1428-178-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1428-195-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/3884-132-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

memory/4072-177-0x0000000000400000-0x0000000000512000-memory.dmp

Download

memory/4288-141-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4872-137-0x00007FF869DA0000-0x00007FF869DB0000-memory.dmp

Download

memory/4872-140-0x00007FF867680000-0x00007FF867690000-memory.dmp

Download

memory/4872-138-0x00007FF867680000-0x00007FF867690000-memory.dmp

Download

memory/4872-133-0x00007FF869DA0000-0x00007FF869DB0000-memory.dmp

Download

memory/4872-134-0x00007FF869DA0000-0x00007FF869DB0000-memory.dmp

Download

memory/4872-135-0x00007FF869DA0000-0x00007FF869DB0000-memory.dmp

Download

memory/4872-136-0x00007FF869DA0000-0x00007FF869DB0000-memory.dmp

Download

memory/5924-0-0x0000000000400000-0x00000000005FC000-memory.dmp

Download

memory/5924-30-0x0000000000400000-0x00000000005FC000-memory.dmp

Download

memory/5924-10-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download