xred | 5f0a58e808813f1dd8eaeb6a248e2cee72618baa3d53533b671ea81292e5d1f6

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Size 11.7MB
Sample260819-ntaxtashrd
SHA256 5f0a58e808813f1dd8eaeb6a248e2cee72618baa3d53533b671ea81292e5d1f6
MD5 4bf913d1c32ef2e23c8be71eedefd055
SHA1 6a1132ca26bdac9dfdf678b8d21f1f577e5180fe
SHA512 0d43f2d2157dded2868621f275506470384e97f467c5dc4fb87ba2f4723c619e2e126ad7e756f71646e527f9c00eae2bc7f5abd05d4740af180d3681f9a1e545
SSDEEP 196608:VL3WG7ItmR4iO8vYs/ASux1ijTD5myYXzAbmQqa/SKlQDxOJsyi0FNi9GtBCtW:VL9RE0Z4V8Z//SKlAFyzkGtBz
TLSH
T193C62231B2919532FDB206399D6E9275C5297EA22F3055CBF3F439498AF6D812C2036F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery xred persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 8 IoCs

pid	Process
2324	._cache_2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
4320	Synaptics.exe
4868	Synaptics.exe
4644	tiffview.exe
2408	._cache_Synaptics.exe
872	._cache_Synaptics.exe
3112	tiffview.exe
3848	tiffview.exe

Loads dropped DLL 2 IoCs

pid	Process
448	javaw.exe
4328	javaw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tiffview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tiffview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tiffview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2924	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4340	wmic.exe
Token: SeSecurityPrivilege	4340	wmic.exe
Token: SeTakeOwnershipPrivilege	4340	wmic.exe
Token: SeLoadDriverPrivilege	4340	wmic.exe
Token: SeSystemProfilePrivilege	4340	wmic.exe
Token: SeSystemtimePrivilege	4340	wmic.exe
Token: SeProfSingleProcessPrivilege	4340	wmic.exe
Token: SeIncBasePriorityPrivilege	4340	wmic.exe
Token: SeCreatePagefilePrivilege	4340	wmic.exe
Token: SeBackupPrivilege	4340	wmic.exe
Token: SeRestorePrivilege	4340	wmic.exe
Token: SeShutdownPrivilege	4340	wmic.exe
Token: SeDebugPrivilege	4340	wmic.exe
Token: SeSystemEnvironmentPrivilege	4340	wmic.exe
Token: SeRemoteShutdownPrivilege	4340	wmic.exe
Token: SeUndockPrivilege	4340	wmic.exe
Token: SeManageVolumePrivilege	4340	wmic.exe
Token: 33	4340	wmic.exe
Token: 34	4340	wmic.exe
Token: 35	4340	wmic.exe
Token: 36	4340	wmic.exe
Token: SeIncreaseQuotaPrivilege	4340	wmic.exe
Token: SeSecurityPrivilege	4340	wmic.exe
Token: SeTakeOwnershipPrivilege	4340	wmic.exe
Token: SeLoadDriverPrivilege	4340	wmic.exe
Token: SeSystemProfilePrivilege	4340	wmic.exe
Token: SeSystemtimePrivilege	4340	wmic.exe
Token: SeProfSingleProcessPrivilege	4340	wmic.exe
Token: SeIncBasePriorityPrivilege	4340	wmic.exe
Token: SeCreatePagefilePrivilege	4340	wmic.exe
Token: SeBackupPrivilege	4340	wmic.exe
Token: SeRestorePrivilege	4340	wmic.exe
Token: SeShutdownPrivilege	4340	wmic.exe
Token: SeDebugPrivilege	4340	wmic.exe
Token: SeSystemEnvironmentPrivilege	4340	wmic.exe
Token: SeRemoteShutdownPrivilege	4340	wmic.exe
Token: SeUndockPrivilege	4340	wmic.exe
Token: SeManageVolumePrivilege	4340	wmic.exe
Token: 33	4340	wmic.exe
Token: 34	4340	wmic.exe
Token: 35	4340	wmic.exe
Token: 36	4340	wmic.exe
Token: SeIncreaseQuotaPrivilege	2108	wmic.exe
Token: SeSecurityPrivilege	2108	wmic.exe
Token: SeTakeOwnershipPrivilege	2108	wmic.exe
Token: SeLoadDriverPrivilege	2108	wmic.exe
Token: SeSystemProfilePrivilege	2108	wmic.exe
Token: SeSystemtimePrivilege	2108	wmic.exe
Token: SeProfSingleProcessPrivilege	2108	wmic.exe
Token: SeIncBasePriorityPrivilege	2108	wmic.exe
Token: SeCreatePagefilePrivilege	2108	wmic.exe
Token: SeBackupPrivilege	2108	wmic.exe
Token: SeRestorePrivilege	2108	wmic.exe
Token: SeShutdownPrivilege	2108	wmic.exe
Token: SeDebugPrivilege	2108	wmic.exe
Token: SeSystemEnvironmentPrivilege	2108	wmic.exe
Token: SeRemoteShutdownPrivilege	2108	wmic.exe
Token: SeUndockPrivilege	2108	wmic.exe
Token: SeManageVolumePrivilege	2108	wmic.exe
Token: 33	2108	wmic.exe
Token: 34	2108	wmic.exe
Token: 35	2108	wmic.exe
Token: 36	2108	wmic.exe
Token: SeIncreaseQuotaPrivilege	2108	wmic.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2924	EXCEL.EXE
2924	EXCEL.EXE
2924	EXCEL.EXE
2924	EXCEL.EXE
448	javaw.exe
2924	EXCEL.EXE
2924	EXCEL.EXE
4656	javaw.exe
4328	javaw.exe
2924	EXCEL.EXE
448	javaw.exe
2924	EXCEL.EXE
4328	javaw.exe
2924	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 2324	396	2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe	85
PID 396 wrote to memory of 4320	396	2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe	87
PID 2324 wrote to memory of 4644	2324	._cache_2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe	88
PID 4320 wrote to memory of 2408	4320	Synaptics.exe	90
PID 4644 wrote to memory of 448	4644	tiffview.exe	91
PID 448 wrote to memory of 4340	448	javaw.exe	93
PID 4868 wrote to memory of 872	4868	Synaptics.exe	97
PID 2408 wrote to memory of 3112	2408	._cache_Synaptics.exe	98
PID 3112 wrote to memory of 4656	3112	tiffview.exe	99
PID 872 wrote to memory of 3848	872	._cache_Synaptics.exe	100
PID 4656 wrote to memory of 2108	4656	javaw.exe	101
PID 3848 wrote to memory of 4328	3848	tiffview.exe	103
PID 4328 wrote to memory of 1340	4328	javaw.exe	106
PID 448 wrote to memory of 4400	448	javaw.exe	108
PID 448 wrote to memory of 2536	448	javaw.exe	110
PID 4328 wrote to memory of 1804	4328	javaw.exe	114
PID 4328 wrote to memory of 1616	4328	javaw.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:396
- C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\I1787139657\Windows\tiffview.exe
    C:\Users\Admin\AppData\Local\Temp\I1787139657\Windows\tiffview.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
      "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -Xms16777216 -Xmx50331648 -classpath "C:\Users\Admin\AppData\Local\Temp\I1787139657\InstallerData\IAClasses.zip;C:\Users\Admin\AppData\Local\Temp\I1787139657\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1787139657\Windows\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1787139657\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1787139657\Windows\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1787139657\InstallerData;C:\Users\Admin\AppData\Local\Temp\I1787139657\Windows\InstallerData;" com.zerog.lax.LAX "C:/Users/Admin/AppData/Local/Temp/I1787139657/Windows/tiffview.lax" "C:/Users/Admin/AppData/Local/Temp/lax11ED.tmp"
      4⤵
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:448
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get name
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4340
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get name
        5⤵
        
        PID:4400
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get version
        5⤵
        
        PID:2536
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\I1787139659\Windows\tiffview.exe
      C:\Users\Admin\AppData\Local\Temp\I1787139659\Windows\tiffview.exe InjUpdate
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -Xms16777216 -Xmx50331648 -classpath "C:\Users\Admin\AppData\Local\Temp\I1787139659\InstallerData\IAClasses.zip;C:\Users\Admin\AppData\Local\Temp\I1787139659\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1787139659\Windows\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1787139659\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1787139659\Windows\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1787139659\InstallerData;C:\Users\Admin\AppData\Local\Temp\I1787139659\Windows\InstallerData;" com.zerog.lax.LAX "C:/Users/Admin/AppData/Local/Temp/I1787139659/Windows/tiffview.lax" "C:/Users/Admin/AppData/Local/Temp/lax3014.tmp" InjUpdate
        5⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4656
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get name
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\tiffview.exe
    C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\tiffview.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
      "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -Xms16777216 -Xmx50331648 -classpath "C:\Users\Admin\AppData\Local\Temp\I1787139666\InstallerData\IAClasses.zip;C:\Users\Admin\AppData\Local\Temp\I1787139666\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1787139666\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1787139666\InstallerData;C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\InstallerData;" com.zerog.lax.LAX "C:/Users/Admin/AppData/Local/Temp/I1787139666/Windows/tiffview.lax" "C:/Users/Admin/AppData/Local/Temp/lax3757.tmp"
      4⤵
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4328
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get name
        5⤵
        
        PID:1340
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get name
        5⤵
        
        PID:1804
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get version
        5⤵
        
        PID:1616

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b42e2c7343ed8efb3a434261c95de2d3cb8c71f9aae245b6f59e9ead92c7a16b
MD5 7edf89745aaf2a81c4c964f697c2c4b1
SHA1 bde6b98fedd9f9418f97b22ef8152fcda4701443
SHA512 08710e5b8ed8262992dabdd063620fa8e307f35adee5659e9fd842f5c201ef06cb794712366c4520f52331dd94afa5dd492f84205b7ef1a390d23fe8b72f37f2
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 a47926eb494755e54a90ee8aa5b85da6c3f5e558507f4a3dc2f5f753025bfe88
MD5 18c5b086770d6bcc38023758ca83cd1c
SHA1 ac867589a7bf042c22620fc6c56f88176070e4e0
SHA512 fff1eb8d39fdc0ef0a38e2831f0fc92607847d58dc3e27c0fc1b9f4d673c58f69140a024195702f5641d2cdb2d01b8d4c88edebb6e15705af98890e83d485869
MD5 SHA1 SHA512

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 11.7MB
SHA256 5f0a58e808813f1dd8eaeb6a248e2cee72618baa3d53533b671ea81292e5d1f6
MD5 4bf913d1c32ef2e23c8be71eedefd055
SHA1 6a1132ca26bdac9dfdf678b8d21f1f577e5180fe
SHA512 0d43f2d2157dded2868621f275506470384e97f467c5dc4fb87ba2f4723c619e2e126ad7e756f71646e527f9c00eae2bc7f5abd05d4740af180d3681f9a1e545
SSDEEP 196608:VL3WG7ItmR4iO8vYs/ASux1ijTD5myYXzAbmQqa/SKlQDxOJsyi0FNi9GtBCtW:VL9RE0Z4V8Z//SKlAFyzkGtBz
TLSH
T193C62231B2919532FDB206399D6E9275C5297EA22F3055CBF3F439498AF6D812C2036F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-19_4bf913d1c32ef2e23c8be71eedefd055_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hawkeye_remcos_smoke-loader.exe
Size 10.9MB
SHA256 12d23bf8f27c834365b40c4fbf03e5e38af0c2174e26eb052a30d350f3b214c0
MD5 2615d6482e6c4a4ea5d8a4f1bd5a08df
SHA1 53d841bc9c67c47e4683d3087e5e21e1414f748e
SHA512 17e2625da75d71df75d4c9690deb317188ea865f6d4a93be4d6b3d5ff7b59793744bc8630a8837d12f207b398943d09735039ad4ae416736e371d2b5643e51b0
SSDEEP 196608:BWG7ItmR4iO8vYs/ASux1ijTD5myYXzAbmQqa/SKlQDxOJsyi0FNi9GtBCt9:t9RE0Z4V8Z//SKlAFyzkGtB8
TLSH
T1ADB623306291E622FDF246319A7D8632D56A7DF26B6085CBF3B4314A89F2DC15D7032E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6B485E00

Path C:\Users\Admin\AppData\Local\Temp\6B485E00
Size 20KB
SHA256 94241c962cb6c329963792f09e4dd02d2156a192c561782beadaff4d43aa9613
MD5 c7494342dd61bd39e7ce779bea71eb1a
SHA1 90f44ba9acbafc91a72dbd495af0092f4381e7ac
SHA512 d59eef12313827dc161330dc60ac5e58a72bd14e5bdbe8b4f65c5f6c223596e3f49c881af966d10d69279c3ae1b9ed7b104d841304ed8b33e05d0fb7d9f4ef2c
SSDEEP 384:MWVx7+xu0su2Lp+o5bPyZDuVWvwVUGoFMyi9ur12BrVdSz4z9wy:MWnKuS2L4o5bPyZDuQvwVU7FM/9Y4djT
TLSH
T1D392C018AE0DA84BDBB24C3C000535B5F75629D9E614B8DE785493AD8FC45BF439F5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Execute.zip

Path C:\Users\Admin\AppData\Local\Temp\I1787139657\InstallerData\Execute.zip
Size 4.7MB
SHA256 8b78b20bda6f88bc680aa69adf95f365ad22e3bf0a9db4b898d930db7c08f94a
MD5 ecf6b9b230b678445d3898d901d855ff
SHA1 265d8fa3a993c4e8b57419eb446c0b4a3be47a1b
SHA512 73470f4117cb23baaf0c4ef40fc24927333f5feeff07911e7da2e51f3363eba75fb7df57e50e224faebc8be636c470e1787fb540797e9f526022d920b8d0544b
SSDEEP 98304:zeC7QviEEvJX23h2rTQQpsobLehpgY/AlvEQ:zeCEaEEvJXdPQQKmeh/A9B
TLSH
T19E360130A6D48225FDB3923449BD8132DA7A7CA2877196CBE3F476499DF3D804D21B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IAClasses.zip

Path C:\Users\Admin\AppData\Local\Temp\I1787139657\InstallerData\IAClasses.zip
Size 4.4MB
SHA256 be992a22870c73d7022bc430594b01cfaa1555daa8f232237a0f7842a3c6354f
MD5 27fb90df40dd064d158187f51232c11e
SHA1 91cc905308f18ea79430744710bad63b4399a293
SHA512 9e315efc275e403b060bc29aaea2889355f84211ca0e66ce93615cf037c8be2e49a1494f6070cb09d6a9f98751a3a8c856b90b5e5ea1e161d3c7377b403017b9
SSDEEP 98304:qIAzdgSG44/Tx+mTSSsIJzyJmpdNIBzWBPWwNV6r:rMdgSG44S7IJjdqFWBPd6r
TLSH
T1D626E113BE88213AED6752360052C633EA1B9FECF387E0256CE59981C53AED61747E1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvmspecs.properties

Path C:\Users\Admin\AppData\Local\Temp\I1787139657\Windows\jvmspecs\jvmspecs.properties
Size 448B
SHA256 b374be5a723bc5e3fff8c9ad5b9ee1aab09e814b1bed53d569e82e3653af5d9e
MD5 9ea1f68278fc08c315a1457237da584a
SHA1 0387799d27cd1944a1798d82613786fc91ade4c1
SHA512 fe02dd56c7f8b2c99e7f9673128c4867b6682c3081452bf0a78420ab910670d3a9866fa0e2ce2f891795bec8a9cc690468441130abef4e3700542f9da2d4c6f4
TLSH
T1EFF0306A6193C70AA9FC5C5C70A917F0BD629BFA899C41F240783905907BBDA64A34C7
MD5 SHA1 SHA512 TLSH

Submit Download

tiffview.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787139657\Windows\tiffview.exe
Size 540KB
SHA256 0674722ef9a5be0cbc025b0b3e6e16cfc367071aca61e32041e82951098873ac
MD5 6c91202857d8c7d344156525808edcf0
SHA1 33d6f45a8dafd2d1b74233035de17b55a2908e20
SHA512 3af700d3243fc2bd332b69969e5c3786d1322041280b9d2ad1e55be1a2d916c7be25862a79c0a081fae9f398f0a1ec8da5413c8dfaaf3614937f4e29189b408b
SSDEEP 6144:jA3Xp3Cb6dO/awVxtWl5PcPypqRIQ9s9dLgVUyV6h:jAHRC2dOSwVxtWl5SxIQ9moUygh
TLSH
T1F5C4F83026919236FDF316355A7C9232CAAA7CF29B3085CBE3B47549D9F2D409D6072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tiffview.lax

Path C:\Users\Admin\AppData\Local\Temp\I1787139657\Windows\tiffview.lax
Size 1KB
SHA256 83a9b735cbd6ced9a9558e07bd8f61a587fc1b14b941c715872f5272aeccce2e
MD5 ae92441f44944a1d76bdeea51e19d390
SHA1 54cf9697a193ab5f92177b3fab050bf0866e2d07
SHA512 a09d6c15632e8b69304e81f9ae163fec090184bf59c85e54aa0bc0717026d1df60b3a9ccea8e4f8680cb8adfbd8c5eb4a2ff1d785da384d4f016043b1dd9baa2
TLSH
T16321494E77C302E5321612AF16FA93B4212623F855E4B434B9FF590639E56DD7083C1E
MD5 SHA1 SHA512 TLSH

Submit Download

sea_loc

Path C:\Users\Admin\AppData\Local\Temp\I1787139657\sea_loc
Size 170B
SHA256 e0f547bdc50df341195b42f3c8cbf68ccab048b2a97de9ce0b2475a110fb0794
MD5 4842d2da444ea2518e053feb4911eaa4
SHA1 cdd40e4729be6415da78e0ac0d0ea9574c6d7a0c
SHA512 a3253489fbaa867c64beefac15d3cbee448d10af2e23c4ed18a2a892abe2aabf35abcd51753397a6cf772d615b17b7806ac82587c891204241120bd620903787
TLSH
T13FC0C081009FCCB20432D037C36A2889C108510F86C513202310A15C40D902BA0C3906
MD5 SHA1 SHA512 TLSH

Submit Download

sea_loc

Path C:\Users\Admin\AppData\Local\Temp\I1787139659\sea_loc
Size 57B
SHA256 8747fd85f93380741b7e130c889827bdd4595e96d7fca8f965a25bd06855041b
MD5 63a445fa5948beb29ecb1c8cc753e4ad
SHA1 3ca7cbf27cbb92fbfd62025daf5ae3250c854826
SHA512 4750decf8bcc011f2e412adf5d36b4c9f6f4bf0c424b2a1a0dc8a98dee092717a140c09134be1eeb2d1785d998326d327e3bd16a36a85814fcae383a76bc70a0
TLSH
T1DA900210D1D7CA66890451672DA1514CC56108482BB53F3067208558554A849A59B201
MD5 SHA1 SHA512 TLSH

Submit Download

MediaId.properties

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\InstallerData\Disk1\InstData\MediaId.properties
Size 118B
SHA256 042bbe079a49a6e1a204671168bdfe942aff91e060cd17806bace35ab961e56b
MD5 fded2c387d9a31db3386d4c3c408a19c
SHA1 183a2576194b9685ee2567b40367b19ae0660139
SHA512 ee235fac907daf47cce2eef972a04c1414b8249e4b39c93fbf81047709a883772fc252e49db4416762e9bd819989957e1b562fd635d4a7a9817e8616cb4ca57f
TLSH
T129B02BA71FC56160001123281A88A1041B08601C3822A01CE3810205031334161A2585
MD5 SHA1 SHA512 TLSH

Submit Download

Resource1.zip

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\InstallerData\Disk1\InstData\Resource1.zip
Size 1.7MB
SHA256 b4a46f4f783eb257d7b91f2065695757e78a66c25f6a5c5a3ad9b519f44d4153
MD5 772816a2b7f68ca9d3ca993e51e38774
SHA1 2e1367367c5a8526f887bbbf9f1e9ec74b703b78
SHA512 2a51d370c03fac863db83f30a1e7c9e3409a59f587726ffc27f46ccc678cd1c1e7e42453b3e617235db34efbaa140e6b57d34d1bae75861bd4e4a7fe1fd1b4a9
SSDEEP 49152:E3QDiefDOeeamExOe4+T+4sOj8yJ4LJ+tA:MQean4R4xj8UO+A
TLSH
T1A3851321F5C00CC4D094C8352B6BFF739579FD4296D1561BBAAB290A2DAC6D9CF73A02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstalledMedias.properties

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\InstallerData\InstalledMedias.properties
Size 543B
SHA256 52f6f3f43cb688b11830f4796c5d5c14cb6ab966514c968d7833339682fb08a9
MD5 f9468c51eb7112ddd266c10d0950bde9
SHA1 833f929d5670e64adb306d4612cdbcc418d3b57c
SHA512 4f1d9a37783463d8a05a8428af9448a5dd4f732b2bae5ef394ad6f8417e535c3738b6cf77ca51265cd6a98eafdbfa2e33b7474f67004d8c210382c8ba8fcac87
TLSH
T184F0C4C3AA0028EDB274102519B8B2D27310852A1A286A39F3B05943114BB07997AEEC
MD5 SHA1 SHA512 TLSH

Submit Download

MediaFiles.properties

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\InstallerData\MediaFiles.properties
Size 5KB
SHA256 06ae43531e0884500f2eeaf53e8e1bb41282e3422d6ca31564fa3bdf058b6566
MD5 2f635860efa37181facfc280361f7812
SHA1 f7f7239977d7dd10de2435d8d644076bb8c8c21d
SHA512 dfb4cbb16998bcf95182b2395a640845ffa23aaad7295ea1e1af8e7f1f29703595b6eeb090a905ed278206ddd2891679a6a4e436d34028cedbdc8d7408018715
SSDEEP 96:HxNiANINx+AvNgKN6AJNbNXNmANDNt8NblNNXNtNigNiN5KxNz3ANKNLNZNNZNw5:HxNiANINwAvNgKN6AJNbNXNmANDNt8NQ
TLSH
T19EB14F2F5EBE8F74A770FDC601AE40083A54B51DB4985262A7F02F3A5A35B87D0F618D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

laxmanifest.txt

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\InstallerData\laxmanifest.txt
Size 1KB
SHA256 1aab428d38e12667c7585949b032aa113c181e4656e847b17dfaaa9bb785c45c
MD5 e96e2605da8fe7ba23cdb9e79102e094
SHA1 9bc71b9fef2f2b34eed6837fdeca944c29fd8c2f
SHA512 e8433b1b1a41e2519522d8e26c0341095c5f430920ce1efd4da0a51b74b2d17fd853337de2d6c7036b369af533f0fa5d130481da8a8b19260bc338bf1c65185e
TLSH
T159314A74440052338E9B7917207097B5FAB25FDCC4ABD0945AFC899DE678EE64585730
MD5 SHA1 SHA512 TLSH

Submit Download

uninstallmanifest.txt

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\InstallerData\uninstallmanifest.txt
Size 105KB
SHA256 b3ca04584380554081286de8d0c21ecfff2eb93f214811ea9bf85751b00a6905
MD5 ba1ea572fe35ca6acbc198e7670a9519
SHA1 0b3b8484a6805f598ec7e12f8f933fb6fde67e78
SHA512 8c6a86bcd87d4cf2ce2757cced759e8c00586952b87fe56bbe318d23ac3d17869bfc8a492edb4e5f5e3d42d67920817f12881e16fc5c0e279fbb68961faee1e8
SSDEEP 3072:Vz8TFvJB3OsvJwSNL820OC+TFKgKg2UcWW0Cpn5Td14ubCQsU2i2IKe:Vz8TFvJB3OsvJwSNL820OC+TFKgKg2Uk
TLSH
T199B39920D70422732E572A4B00720671B6B7EFD4D2D7A090ADFD9D8DF56ABE12143B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Verify.jar

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\jvmspecs\Verify.jar
Size 1009B
SHA256 6007094fffce97c3ee54551f70a16de544d6c7e9ec2ba0ec90406e16e879d88b
MD5 9ce46b4b65d4ae4f9f4a5b42b1e9d86d
SHA1 b1f5b77657bb69574d484e94bd0ed64be9f6f751
SHA512 9982c32ab83a14e8e3838aa058d86d98ad7386418eb00ec83bc880795bf29ca1275c4eabe5f3c5f8155e73ada451369006eff7537fd4f819a1d12c65356d286e
TLSH
T19E119C2FE2045C1BF6C9F2781A88472F7631A13152FBE218AF4954665ED645029297E1
MD5 SHA1 SHA512 TLSH

Submit Download

ZGWin32LaunchHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\resource\ZGWin32LaunchHelper.exe
Size 93KB
SHA256 fbddbd5cbcd9581a1fc1df98088f0a9fdb5033f3db6ea3d14c4cbf11c3718b19
MD5 af911b5f3e041f2a5a5d4765a20328d8
SHA1 004df4135fa5465f83b06e32bcc5dceffd22d669
SHA512 6d5c7e50bb3df7fe77a34e6b69ded330ea7261822c68f1b45c9acfbc2616a3cf289599007a7b7dc2dd71e1783a2860191751d676287bf66150970e20cae6b77e
SSDEEP 1536:JDtJYGYXJlbU1ckR9sWjcdCJ+ZihXQUqGJD:wXzbU9kCJ+8hXQzGJD
TLSH
T1A7936C0376E18076E4E34A3059B0DA625A7FFDA24BB49C8773C8028E1E756D05F76B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iawin32.dll

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\resource\iawin32.dll
Size 108KB
SHA256 bf638aa5ee0fa9cceb0669cc5754e6b3f27377fb82174aba9062d804d3fe9780
MD5 97411ce12f63f05c2da5699128ae76f4
SHA1 feeb0d1c93718c2e42a69ec3a076fed4d25b3b5a
SHA512 fb9a3d1db9e7b956b5859f9a6e9f9271fdcd221bae281fd0d66285e6b739249e57d0952857f64c6e723158302dab4e21ff8bb3b80f5cb995295a5c2f7b5a07db
SSDEEP 1536:x1M4Ub07MUf5fp9Awx3OGtQ++YL+7ncosWjcdQj3yjEJBZLyAEK:MJAFf5fbx3OP++YL+7GQj3yjEJBZLyVK
TLSH
T1ABB36C013BD180BAD2AF0A3418749722973E7D71D9F49C5E6BD60B895DF06C1AF36B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iawin64.dll

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\resource\iawin64.dll
Size 303KB
SHA256 e8312802e4fd59f2d1253e8b5c799682c3a9f1ba8429d8eb312ce6ae081a84b4
MD5 9eaa54f82d1d5e17e67ab5ac7ec6e4b9
SHA1 e4d110c4c07a78c5f5b33c4f29e6187fcf993aed
SHA512 1bf18233e4571f62b9694b91ec36361a82c890dcc43ff866afed2f4bf014a17651736827fff260e174d506cf2de3f7062b1e0eb72158f796bbbeae8c058ac69e
SSDEEP 6144:Q0lm38mhglKT56s46AHdicJ/rgzApb0dDM8fg3DHc:Vu4Hpccpb0dDWo
TLSH
T10564E846AB42EE6BC60F033182E70B2D23F2D39557F3CB2B5A7193752E4B7891725960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iawin64_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\resource\iawin64_x64.dll
Size 130KB
SHA256 8e6878d90c4cd23f76fc79b912c4a443539bb09144b73cd4a389247dc9a4d178
MD5 df6e9c60af948f91181d42902a335662
SHA1 cdc39d8fc231b3a98a1a5d0bba9c838e247f1c4d
SHA512 27876a5455bc80ce25e4acb479b5124e4e929eacaf3fabab7c81ccbb4547b506e679a08fd48bd3ee33cad4a6fe0950df3090a1bde6d8c72d5b457a903237b23e
SSDEEP 3072:3JRwjIymIer9JBhsxeYTRBiK7pMf5NY+O4LtM0E7b3g9HUJBv6Pxb:3Alxer9DhsLTtFMfjY3yt2bMKC
TLSH
T1D4D35C4B33A400BBE5B39678C8A34A06C7727C5557B5ABCF03A042895FA37E15E39736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

invoker.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\resource\invoker.exe
Size 20KB
SHA256 22388997e82d9edfd11616c65084bc0f81a1421027e1f39ee885cfea0f54a288
MD5 4726ca7a8eeb86bdaa1c8a0ba39428dd
SHA1 2e851728e6a7fd8dd5a4c9e1b0e48945769393b8
SHA512 d8e437eb90309ea19af0da4f45277bc9d192ceb7c892b1f8a880aec48e1f7870dbe1f30dcdc9b16f582abb53af8384eb9d14394a90e940bc4b5a590818b59360
SSDEEP 192:+pmBS9Kr1xj+oqetRHLaz7kxbppHDmin+j0ianYe+PjPrSBO3Sw2/xz:+vAjUePHLgkpppHgjPanYPLWhN
TLSH
T1B7923A4B9A566072CFE28C30EA57A52DE83BA5B01BD95C477AF481844CD4BE9721E20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remove.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\resource\remove.exe
Size 191KB
SHA256 fae081828392c2ee768196dca89b20b568997c2a68c3372c74c6a2be06bfb31f
MD5 e9dea33aa3632a27f6962993ea1a2432
SHA1 83661220db3e11484924ae3616dec24a23326c14
SHA512 9dc282253a96de863c3fc8cda59c2f50f7d16e98cb3d5d3d6e80d49d11b9f5442cca1765d71e60446595c4027f4bea9c8494a0d957478a94c460cca48dda76e3
SSDEEP 1536:3V18k88XOlsuPzaSRWmrrsATFpjlbejFpRI+Uc41wkZs8jcdU85eCvOQKMEGOsai:l18NbprcI+SMU85aQyGOsec
TLSH
T1C5148C1136D180B1E1B3023615E8E7729A3DFD724FA25E8B77D84E8E0A741D06779BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win64_32.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\resource\win64_32.exe
Size 227KB
SHA256 4565774e49462cc115567df2b05be2fd7b4b42e43b462fbf49d9728910da3d9f
MD5 5a2c76ac4a09b5fb9bd5f43cf48c5d17
SHA1 b6e312aa4b97be7e8d27be2e8de83d4e97e31614
SHA512 8036e76c9903506b98fb51b37714d10308966e43a6b6f3b298ef14f3d720bdd36712529427348299dc481abb8fc5007fbfe89b994ff005b4f298ab156ef2688f
SSDEEP 6144:FxTHoinXTdfGqJs+hS6LE5UZv7/JveegT1:ruuZSO9eegT1
TLSH
T12734C6467B42EE6BC50B033182E30B2D73F2D39557B3CB2B9A3193792E4B7895725960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win64_32_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\Windows\resource\win64_32_x64.exe
Size 103KB
SHA256 7d9b7eddda5f678a7fd201ed7b9a985549f111993155d5916b7e7ac85ed8393f
MD5 ed623135e060104e4839bfa995cd6023
SHA1 a0caeb82cbc005f8e3613869ec4297376ffd1d6c
SHA512 77dd26a6c195a17a439a003c9ef4c9bc81bdcbd1ec944cca009eb499800182fe68d8336c3e63a1f9d73f61f992df71c737a15b1c1406305c995c669f21bc81bf
SSDEEP 1536:RXkKaM/hifFLjTeXlrHLQLjSosUEYu60hae+Bs8AlydO8pyju/hQx5X:RXkKa2hifFXT0pHLQnSos5DN+ft/hQ/X
TLSH
T1ECA35C4B23A430FAE1B7CA74C9A18945D772F87547719B8F57A4028A1F672C14E3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sea_loc

Path C:\Users\Admin\AppData\Local\Temp\I1787139666\sea_loc
Size 43B
SHA256 94931006a3aede8fd0ebe7b0295598a3ba2e06e8ebf34c8343a5bde409a4ea2c
MD5 0f49c07deb5bd9ba1ada52d1a68e148b
SHA1 412a2c74f4f4eb99ea34cfcdfbd20c252d88e224
SHA512 2efd6fbe7e5dae48084455f69e13eb1631e6f44cf22b9309814033fc5e6d33ddf25e44000c55001452dd0201f3711890e5cc7c3b234899f690788a6cc593e293
MD5 SHA1 SHA512

Submit Download

lax11ED.tmp

Path C:\Users\Admin\AppData\Local\Temp\lax11ED.tmp
Size 6KB
SHA256 ec9c88ecf0857e434a58ea3e80e7bba52c01e9b1607995f6085bd2db7c115055
MD5 27398320e9254276dc88c901828a5ceb
SHA1 f7b098c286f098b40a81fa340edae0af1f974d2f
SHA512 dfca63abea4e60826136d9a79b126283dad3329fe3b61bbb5557b5969d828ad468c67c19518894c00c778fdb32c347e65bd643af51a0d4ea355cd5040db134de
SSDEEP 96:cc/zWdbU65qrBfKHTi8Im3ZTkuupIHrzLDHrzRHrzme:czqrBfKHTtT5Xpme
TLSH
T1FFE18962B5A1D5B0B442271852DA1F2C92B4F41D7BE4C1E1534C9689F9F0F488B2FCF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lax3757.tmp

Path C:\Users\Admin\AppData\Local\Temp\lax3757.tmp
Size 7KB
SHA256 7cb01a98c34f3bb514ad9ada1ea0ee6295f5850a786ec0c8e72cb7cacda69095
MD5 f2cab54059c4c4c8113756aaef7e9b45
SHA1 ccb299b765d46742b8874bd07bc5effdb3e4cca0
SHA512 717ad2c187f14a4f1d3f2f9a2ef8b78140f04599cfa8f1a4889da75e2dc30cbe8dbc763518c240e500a05bc77a658c8ed8584aa85cdd552f53e35e3b66551e64
SSDEEP 96:JB9c/zWdbU65qrBfKHTi8Im3ZThLuupIHrzLDHrzRHrzme:JB9zqrBfKHTtThMXpme
TLSH
T1CEE17862B6A1D5B0B4422B1852DA1F2C82B4F41D7BD4C1E1534C9689F9F0F598B2FCF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omPh7TDI.xlsm

Path C:\Users\Admin\AppData\Local\Temp\omPh7TDI.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_b9e6d1be-5eff-4596-940c-57922ad6c7c4

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2370214745-1838013427-2987045292-1000\83aa4cc77f591dfc2374580bbd95f6ba_b9e6d1be-5eff-4596-940c-57922ad6c7c4
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/396-0-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/396-128-0x0000000000400000-0x0000000000FAE000-memory.dmp

Download

memory/396-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/448-646-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-564-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-942-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-823-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-790-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-626-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-621-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-251-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-460-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-596-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-587-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-557-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-501-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-503-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-560-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-552-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/448-544-0x00000235DA8B0000-0x00000235DA8B1000-memory.dmp

Download

memory/2924-302-0x00007FFA13730000-0x00007FFA13740000-memory.dmp

Download

memory/2924-317-0x00007FFA10F90000-0x00007FFA10FA0000-memory.dmp

Download

memory/2924-307-0x00007FFA13730000-0x00007FFA13740000-memory.dmp

Download

memory/2924-316-0x00007FFA10F90000-0x00007FFA10FA0000-memory.dmp

Download

memory/2924-301-0x00007FFA13730000-0x00007FFA13740000-memory.dmp

Download

memory/2924-303-0x00007FFA13730000-0x00007FFA13740000-memory.dmp

Download

memory/2924-306-0x00007FFA13730000-0x00007FFA13740000-memory.dmp

Download

memory/4320-402-0x0000000000400000-0x0000000000FAE000-memory.dmp

Download

memory/4320-927-0x0000000000400000-0x0000000000FAE000-memory.dmp

Download

memory/4320-861-0x0000000000400000-0x0000000000FAE000-memory.dmp

Download

memory/4320-776-0x0000000000400000-0x0000000000FAE000-memory.dmp

Download

memory/4328-673-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-724-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-562-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-515-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-505-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-456-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-677-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-683-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-686-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-688-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-715-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-771-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-730-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-751-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-758-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4328-765-0x0000015C19EE0000-0x0000015C19EE1000-memory.dmp

Download

memory/4656-473-0x000002561FB30000-0x000002561FB31000-memory.dmp

Download

memory/4656-511-0x000002561FB30000-0x000002561FB31000-memory.dmp

Download

memory/4656-399-0x000002561FB30000-0x000002561FB31000-memory.dmp

Download

memory/4656-512-0x000002561FB30000-0x000002561FB31000-memory.dmp

Download

memory/4656-494-0x000002561FB30000-0x000002561FB31000-memory.dmp

Download

memory/4656-513-0x000002561FB30000-0x000002561FB31000-memory.dmp

Download

memory/4868-329-0x0000000000400000-0x0000000000FAE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads