gh0strat | d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
Size 3.6MB
Sample260810-vnv45atdrc
SHA256 d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6
MD5 d2854e34d8ff69ea17e8bd787d453018
SHA1 8774653a698c1eec9262249b231e7117a5e8b035
SHA512 a3545a3ea32de460229817376d77a4463bb283f4c5b00b06166d686985bf548d1693d23375e5d28703517dbba9305a27347081728b3f9ae583a338e452713cf5
SSDEEP 49152:9CwsbCANnKXferL7Vwe/Gg0P+WhZ5nsHyjtk2MYC5GDq98:Aws2ANnKXOaeOgmhfnsmtk2aN98
TLSH
T1B0066C027151C4F6C3C4A631CE92F6765B243DAD2BF302E67AB4ADC879682467F211E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution gh0strat purplefox xred persistence rat rootkit trojan upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Detect PurpleFox Rootkit 8 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4580-21-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4580-20-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4580-22-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3956-27-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3956-26-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4904-72-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4904-94-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4904-95-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c6e5-6.dat	family_gh0strat
behavioral2/memory/4580-21-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4580-20-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4580-22-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3956-27-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3956-26-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4904-72-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4904-94-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4904-95-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240748281.txt"	R.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 9 IoCs

pid	Process
4408	R.exe
4580	N.exe
3956	TXPlatfor.exe
6944	HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4904	TXPlatfor.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4136	Synaptics.exe
1712	Synaptics.exe
3344	Remote Data.exe

Loads dropped DLL 3 IoCs

pid	Process
4408	R.exe
4440	svchost.exe
3344	Remote Data.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240748281.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4580-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4580-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4580-22-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4580-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3956-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3956-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3956-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4904-72-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4904-94-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4904-95-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1692	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatfor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Data.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1692	cmd.exe
3260	PING.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Synaptics.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3260	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6700	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
252	d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
252	d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4904	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4580	N.exe
Token: SeLoadDriverPrivilege	4904	TXPlatfor.exe
Token: SeDebugPrivilege	4936	._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
Token: 33	4904	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	4904	TXPlatfor.exe
Token: 33	4904	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	4904	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
252	d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
252	d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
6700	EXCEL.EXE
6700	EXCEL.EXE
6700	EXCEL.EXE
6700	EXCEL.EXE
6700	EXCEL.EXE
6700	EXCEL.EXE
6700	EXCEL.EXE
6700	EXCEL.EXE
6700	EXCEL.EXE
6700	EXCEL.EXE
6700	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 4408	252	d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe	90
PID 252 wrote to memory of 4580	252	d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe	93
PID 4580 wrote to memory of 1692	4580	N.exe	96
PID 252 wrote to memory of 6944	252	d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe	97
PID 3956 wrote to memory of 4904	3956	TXPlatfor.exe	98
PID 1692 wrote to memory of 3260	1692	cmd.exe	101
PID 6944 wrote to memory of 4936	6944	HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe	103
PID 6944 wrote to memory of 1712	6944	HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe	106
PID 4440 wrote to memory of 3344	4440	svchost.exe	110

C:\Users\Admin\AppData\Local\Temp\d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
"C:\Users\Admin\AppData\Local\Temp\d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4408
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3260
- C:\Users\Admin\AppData\Local\Temp\HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
  C:\Users\Admin\AppData\Local\Temp\HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6944
- - C:\Users\Admin\AppData\Local\Temp\._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1712

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:5616

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\Remote Data.exe
  "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240748281.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3344

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "Remote Data"
1⤵
PID:4228

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4136

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 744KB
SHA256 5c6cb5391f0335bc052d842134385c2de0cbf0891b652a85e206a802816426ec
MD5 4cd50c771b3c3192400a6efddfcea937
SHA1 00a69c23c35c89f3d9071d854165616ac8c53e02
SHA512 86e9816bf0f638ad1c50f7ef1aed16bb22d5fbf78bb2eb375a684066e73dfdf6ab822fb3729c593218b70e63c65c9887e72fa4fa28bf49fcdf6fe06cd0a159b8
SSDEEP 12288:fMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V98I:fnsJ39LyjbJkQFMhmC+6GD9v
TLSH
T1BEF47D32F2D19437D1721A3D9C6BA3A5982ABE512E38754E3BF91E4C4F3D68138252D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
Size 505KB
SHA256 9da5cc6a97f1e0440a6ca13be209bf637c33b04db435c6d4d376848e66175973
MD5 b2584614d3a5ddb1631bdae744eca842
SHA1 4c607dd5d075b3c13be463d9ad2bfe351678790b
SHA512 ca79af34fc09f9659de3028f7867146fa6766c1049c4d4e9e5d7e7f124fbfd79c9cc2707b67b64be378298cbd3a04689d24ed9ab6702ca7e60b3ef3989f873fc
SSDEEP 6144:7dCzhWAC+t/+0aQQs/BGDdlLLoth/B+kFUPoNoiJcUiU1UmchXPxL5eytUwF/EFP:7dCtbp1JGXLLUhoCcMO5xJXncR
TLSH
T1B2B494152539C2E6D3D1EB3256C1FA3214180DA9AB7793474F7271D23CB0B862FA94FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9B995E00

Path C:\Users\Admin\AppData\Local\Temp\9B995E00
Size 22KB
SHA256 55a3e9acd41a2e8d8196882fee082b5263d3cc1e36161c61b80511e6aa7e9526
MD5 01d322cbe133f1ff07eda21a671147d8
SHA1 b3a799dfa26133ea794f74ceef0e50501c317484
SHA512 db27acc99491bf51e179ecd2bc20c33cbca57918dd020bd79f7b65812cc19c0916c35e3c1d3fad1a5954753a968ef303ffd0e4b7530e94923f615e74b2934b0e
SSDEEP 384:M84dEb8x1WQp+o5bedUcZWDudEQtmcEpIUZUwfFGgahqQV:M84d/N4o5bEUcZWadtmZph1fFGgaoQV
TLSH
T108A2C057CF19BC06E4D1987C560443E2BA8829C971E2254FBF92F558D9866C3236B4CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 2.4MB
SHA256 32b59b1427904ceaff7802cccbd5e3a325aa4cfb8124782f8d7848b18cfd7ce4
MD5 643deae0721d8b4d771107bea40233f9
SHA1 e18c947ebe2879fa64d55288f5071a97c859f41c
SHA512 6ed9d35e6ce8cf4e263151325de800697e74e49147ba2d48afba3e1d70b6726d55bd346a53a54730efafb5e79595cf04b101461fc7220e2b466690de68d8c054
SSDEEP 24576:9CwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHR:9CwsbCANnKXferL7Vwe/Gg0P+WhZ0
TLSH
T103C57C43B55104F6C3C87571DF62D9BB9B207ABE27F301F67688ADC8766C206BA21127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_d7f3dd6065be87d2f8f495cdaf51d5bff45539680143515d29e58a78893eb0c6.exe
Size 1.2MB
SHA256 1d233d1f0269ae2038794afba34f8de5548f75f2e77f0a6523cd71dbb6e64121
MD5 7e0d238f2d3641af03c7326e9ac6ded2
SHA1 a39161f7dfff42c62cac67eb42449fc3a5bd8bfa
SHA512 532ee3a503ff162826621b3d1e0b9f6da634ed9de2103ef5bc97e4fe5b3e858f67bd6a28dc0422d61cdb14b47130c3ded8684bc82038312f27152628a7cdf540
SSDEEP 24576:7nsJ39LyjbJkQFMhmC+6GD9tybpyLYmCcV/Xc2:7nsHyjtk2MYC5GDq98
TLSH
T1BA4539217265C1F7C3A2AB3949C2F63114293DA56F3763476BB129C53D74A822FA80F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N.exe

Path C:\Users\Admin\AppData\Local\Temp\N.exe
Size 377KB
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
TLSH
T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R.exe

Path C:\Users\Admin\AppData\Local\Temp\R.exe
Size 941KB
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
TLSH
T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sHmlqjk6.xlsm

Path C:\Users\Admin\AppData\Local\Temp\sHmlqjk6.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240748281.txt

Path C:\Windows\SysWOW64\240748281.txt
Size 899KB
SHA256 c08a09bed5e9b023412ba26321cccc74f32ea1802f54c10d2c9ec4d57f17e396
MD5 620cfcdc67d56b6419509ba33033621f
SHA1 159adc6e7cdc6ba2b42a79ad32bc0eaf5500d3e5
SHA512 b2a62c3a9d3f3ada16921bddff4bd76dfab14287de5e06f2f3c7c4afde74230e3c1cec04e0219c6304115a43bacbd64e47277c5dec1c05ba2ffc3fc534799e51
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXk:7wqd87Vk
TLSH
T147152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote Data.exe

Path C:\Windows\SysWOW64\Remote Data.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1712-204-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1712-212-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1712-187-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1712-224-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/3956-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3956-27-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3956-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4136-143-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/4580-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4580-22-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4580-20-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4580-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4904-95-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4904-94-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4904-72-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4936-137-0x0000000000300000-0x0000000000384000-memory.dmp

Download

memory/6700-150-0x00007FF962B00000-0x00007FF962B10000-memory.dmp

Download

memory/6700-149-0x00007FF962B00000-0x00007FF962B10000-memory.dmp

Download

memory/6700-148-0x00007FF964F20000-0x00007FF964F30000-memory.dmp

Download

memory/6700-147-0x00007FF964F20000-0x00007FF964F30000-memory.dmp

Download

memory/6700-146-0x00007FF964F20000-0x00007FF964F30000-memory.dmp

Download

memory/6700-145-0x00007FF964F20000-0x00007FF964F30000-memory.dmp

Download

memory/6700-144-0x00007FF964F20000-0x00007FF964F30000-memory.dmp

Download

memory/6944-142-0x0000000000400000-0x000000000053E000-memory.dmp

Download