Overview

overview

10

Static

static

10

Spoof Disk.exe

windows7-x64

10

Spoof Disk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-02-2025 04:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Spoof Disk.exe

  • Size

    761KB

  • MD5

    8dee9997b8dd95d492df00d8affbbe1f

  • SHA1

    64511af037ae3a38b96221a2364d3a54ff118d41

  • SHA256

    c92954c2e5824e4ff2d3ba75cd4f031cd2d9379e0065331ab542a90b4b8c6a84

  • SHA512

    50bcfbbcaf335a47f67fea60aab461e7d1a5723eebb85fbde6847f632aef68088da9dc61f732f22a45e87bc31a106ca1347ecc51f8d2e8d2b410ddffe6357402

  • SSDEEP

    12288:SMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9g8j:SnsJ39LyjbJkQFMhmC+6GD9P

Score
10/10
xredadwarebackdoordiscoverypersistenceprivilege_escalationstealer

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 13 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Spoof Disk.exe
    "C:\Users\Admin\AppData\Local\Temp\Spoof Disk.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Users\Admin\AppData\Local\Temp\._cache_Spoof Disk.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Spoof Disk.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3204
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 1744
        3⤵
        • Program crash
        PID:4576
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        PID:4020
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 1048
          4⤵
          • Program crash
          PID:556
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4020 -ip 4020
    1⤵
      PID:3456
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3204 -ip 3204
      1⤵
        PID:4768
      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
        1⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:4240
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTUxMERFOTYtMzhCOC00OEQ1LTk1RUItRTMyOTMwMkI2NjgxfSIgdXNlcmlkPSJ7MzY2MTUxQjItOEQ4MC00NEU5LUIzRkEtMjM1NEVFQTUxMDA2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7ODZDNjJENzUtNzYxNi00NkFFLUFFQkQtOUZDRThEMTkyOThGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjgyMTA1MjM5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        1⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:548
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\MicrosoftEdge_X64_133.0.3065.69.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\MicrosoftEdge_X64_133.0.3065.69.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        1⤵
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\MicrosoftEdge_X64_133.0.3065.69.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Installs/modifies Browser Helper Object
          • Drops file in Program Files directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2712
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff792c76a68,0x7ff792c76a74,0x7ff792c76a80
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:2404
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:1476
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff792c76a68,0x7ff792c76a74,0x7ff792c76a80
              4⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:2260
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1056
            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x1e8,0x1f0,0x22c,0x208,0x230,0x7ff650686a68,0x7ff650686a74,0x7ff650686a80
              4⤵
              • Executes dropped EXE
              PID:4104
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4420
            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff650686a68,0x7ff650686a74,0x7ff650686a80
              4⤵
              • Executes dropped EXE
              PID:3224
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1244
            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff650686a68,0x7ff650686a74,0x7ff650686a80
              4⤵
              • Executes dropped EXE
              PID:4852
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
        1⤵
          PID:4012
        • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
          "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
          1⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4056
        • C:\Windows\system32\wwahost.exe
          "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:908

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Browser Extensions

        1
        T1176

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Modify Registry

        5
        T1112

        Credential Access

        Discovery

        Query Registry

        5
        T1012

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F38A3D04-DF36-4E36-9071-FF480CB105BA}\EDGEMITMP_3EC95.tmp\setup.exe
          Filesize

          6.8MB

          MD5

          bdb1aecedc15fc82a63083452dad45c2

          SHA1

          a074fcd78665ff90ee3e50ffcccad5f6c3e7ddcb

          SHA256

          4ea0907c3fc2c2f6a4259002312671c82e008846d49957bb3b9915612e35b99f

          SHA512

          50909640c2957fc35dd5bcac3b51797aa5daa2fb95364e69df95d3577482e13f0c36a70ae098959cb9c2aaeb4cfe43025c1d8d55b5f8858b474bcb702609749d

          Download Submit

        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          Filesize

          3.9MB

          MD5

          4aaa893417cccc147989f876c6a7b295

          SHA1

          b1e35c83518bb275924ead0cd6206bf0c982d30f

          SHA256

          2c38e3c3f18e2d3fb7f04336356b9b5186cabe06b3343beec318ef0def1a9eeb

          SHA512

          109e0c88977fae65a4950fc38393ca32a70d68ef41aeb75b28e6566e0fa626e32e31be38308e7ed5b6a8ba1f56fb5f2133a07aa8bb643224c3dbb089ce9cfd0e

          Download Submit

        • C:\Program Files\msedge_installer.log
          Filesize

          73KB

          MD5

          f45b6418980fd4a2a8fd19f17e318f28

          SHA1

          21cf9f43e6bbf72d26a32f70a762f35a9beca67b

          SHA256

          e9d35d771a45e2ca0da3b81ed438e26423e07492768293e61bf2483fc243b3f3

          SHA512

          0597d7e0b815b16f24aefaf03ccdce96af526a04c6d02e027bf30f779d5526ac2236bd3101de48dc9eeec64831074df2bb61a519ad336b6da64c906674cb8b64

          Download Submit

        • C:\Program Files\msedge_installer.log
          Filesize

          99KB

          MD5

          f76f69ae7d246084f9119790d4091d17

          SHA1

          ef3a5d89b96f8e480ab8dd7b09f8e63f57c79092

          SHA256

          8a40875aec31f3aa71cc56a675769fb176efa8db3a4f6ff9f81cffece25bf186

          SHA512

          f5d92fd43c4b1bc2f0aa95a410c85a76f21252c3c21fc0287e013159323910a53f2e50c4e910f687f5e311cb3fe14591470e0e0e3b6aa82061a58acda40b231b

          Download Submit

        • C:\Program Files\msedge_installer.log
          Filesize

          103KB

          MD5

          7f93409ad07af290126d155b4b80c30e

          SHA1

          d903a3f1f7cf7936d09687830e4280234878fbdc

          SHA256

          e62ce5311393a1bcb19e49af8bd162fdd3e695d68ea6d8c4d4dc14d7021cba5b

          SHA512

          e6af2037b3389ca65ad350c6976ef9c2a5b979571353e452d50b9dca0428bb0ceeef015db73cac97dc8c519ff15b4e93d27b383fc0cab8dbc95dd0c84227ab13

          Download Submit

        • C:\Program Files\msedge_installer.log
          Filesize

          105KB

          MD5

          5756713e337bd0ffb7f995dbb90637c8

          SHA1

          24905e22bad0886656c76be43f6aede52d6a31c4

          SHA256

          793d850fc07019f209bbb6972ae8b3cc1592ca05d4240dff9ac96e4f026affdc

          SHA512

          4aa0edc22094f87851e7263501262cdfd0326f48bad1f455f697d2e22be35c71c7fa9411de369817e6b754b8fae46d2b4b0fc42c46499ecd2792111f86389f81

          Download Submit

        • C:\ProgramData\Synaptics\Synaptics.exe
          Filesize

          761KB

          MD5

          8dee9997b8dd95d492df00d8affbbe1f

          SHA1

          64511af037ae3a38b96221a2364d3a54ff118d41

          SHA256

          c92954c2e5824e4ff2d3ba75cd4f031cd2d9379e0065331ab542a90b4b8c6a84

          SHA512

          50bcfbbcaf335a47f67fea60aab461e7d1a5723eebb85fbde6847f632aef68088da9dc61f732f22a45e87bc31a106ca1347ecc51f8d2e8d2b410ddffe6357402

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\._cache_Spoof Disk.exe
          Filesize

          7KB

          MD5

          f6371499eeaa4992be70f547e250f371

          SHA1

          bb8c54bc658953b0d99f73b3ffbaf5b599c2e52e

          SHA256

          687441e5f3dd13375aba1031d6302c5f666e9320624be6f9443b3f281f613a6e

          SHA512

          9cd2d60030df9a512fbdd3b05b7d0f80be237926b2a87782ca919c3085f243909f09b116976b40156dba84778027bfe0394876412c909766d343cb931544dbc3

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1F085E00
          Filesize

          21KB

          MD5

          d33dc43690b05d7758f9e949008a2465

          SHA1

          32ffd4f3b63e3649a021bd3506cfd2e57aeb47fd

          SHA256

          58042515c51a024a5a80154ec6498415341de683a14e8947ed1931be4665b9c0

          SHA512

          980d4bd1a3357d9c503b5ce70056cc2d80e307afe7a2dd576f9e0a7627cde1300baa9420357946be70a45d081591fa65c4cbffcf08cdb8f9312edde2972ac17b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\jGfoU8AZ.xlsm
          Filesize

          17KB

          MD5

          e566fc53051035e1e6fd0ed1823de0f9

          SHA1

          00bc96c48b98676ecd67e81a6f1d7754e4156044

          SHA256

          8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

          SHA512

          a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

          Download Submit

        • memory/548-253-0x0000000073280000-0x00000000732AA000-memory.dmp

          Filesize

          168KB

          Download

        • memory/548-256-0x00000000732F0000-0x00000000732FE000-memory.dmp

          Filesize

          56KB

          Download

        • memory/548-254-0x0000000073270000-0x000000007327B000-memory.dmp

          Filesize

          44KB

          Download

        • memory/548-252-0x00000000732B0000-0x00000000732F4000-memory.dmp

          Filesize

          272KB

          Download

        • memory/2092-285-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/2092-358-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/2092-130-0x0000000000780000-0x0000000000781000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2092-192-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/2092-246-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/2092-269-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/2396-129-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/2396-0-0x0000000002360000-0x0000000002361000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3204-127-0x00000000722AE000-0x00000000722AF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3204-131-0x0000000000D90000-0x0000000000D98000-memory.dmp

          Filesize

          32KB

          Download

        • memory/4056-359-0x0000020E260F0000-0x0000020E260FE000-memory.dmp

          Filesize

          56KB

          Download

        • memory/4056-360-0x0000020E265A0000-0x0000020E265AA000-memory.dmp

          Filesize

          40KB

          Download

        • memory/4056-361-0x0000020E265D0000-0x0000020E265D8000-memory.dmp

          Filesize

          32KB

          Download

        • memory/4056-362-0x0000020E40A00000-0x0000020E40C49000-memory.dmp

          Filesize

          2.3MB

          Download

        • memory/4240-195-0x00007FFDF3B50000-0x00007FFDF3B60000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4240-193-0x00007FFDF3B50000-0x00007FFDF3B60000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4240-194-0x00007FFDF3B50000-0x00007FFDF3B60000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4240-196-0x00007FFDF3B50000-0x00007FFDF3B60000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4240-199-0x00007FFDF1750000-0x00007FFDF1760000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4240-197-0x00007FFDF3B50000-0x00007FFDF3B60000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4240-198-0x00007FFDF1750000-0x00007FFDF1760000-memory.dmp

          Filesize

          64KB

          Download