xred | 8a696b6c55f8fd1c409058e0f0c18c16f584ffc53fdd0784e44179aec5655ed1

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
X-Scan-v3.3/dat/WinPcap_3_1_beta4.exe
Size 1.2MB
Sample260415-e55f5ah171
SHA256 8a696b6c55f8fd1c409058e0f0c18c16f584ffc53fdd0784e44179aec5655ed1
MD5 f0c1fda886b488ab1883b3aa37df6640
SHA1 c950e1fa18c0add5a01d8bf5693e9f4292a9922d
SHA512 42bf6b76632ec08774141805514812a175afeeee7ed826abcb0ed542b44ee382466dbe8ff92d0b74e97d6d7e868c910cbce9c93d15b01ffaf7e93726828be5bc
SSDEEP 24576:rnsJ39LyjbJkQFMhmC+6GD9BSWdCW6ApD5zH6MAQCmS8:rnsHyjtk2MYC5GDLVOIDR1Ao5
TLSH
T15D45BF32F2D19437D1325A3D9C6BA3A5582ABF512E38794E3BE42E4C5F3D68238152D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery xred persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\npf.sys	._cache_WinPcap_3_1_beta4.exe

Executes dropped EXE 8 IoCs

pid	Process
2176	._cache_WinPcap_3_1_beta4.exe
4972	Synaptics.exe
4528	._cache_Synaptics.exe
4920	Synaptics.exe
704	._cache_Synaptics.exe
3532	npf_mgm.exe
3696	daemon_mgm.exe
1260	NetMonInstaller.exe

Loads dropped DLL 6 IoCs

pid	Process
2176	._cache_WinPcap_3_1_beta4.exe
4528	._cache_Synaptics.exe
2176	._cache_WinPcap_3_1_beta4.exe
2176	._cache_WinPcap_3_1_beta4.exe
704	._cache_Synaptics.exe
2176	._cache_WinPcap_3_1_beta4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	WinPcap_3_1_beta4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\packet.dll	._cache_WinPcap_3_1_beta4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrast.inf_amd64_36f5c191f6c30c9f\netrast.PNF	NetMonInstaller.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rspndr.inf_amd64_31288cf6d92f0cac\rspndr.PNF	NetMonInstaller.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netirda.inf_amd64_dbd9e98589d41a84\netirda.PNF	NetMonInstaller.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wnetvsc_vfpp.inf_amd64_af9b7897bd3ad8b9\wnetvsc_vfpp.PNF	NetMonInstaller.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_nettrans.inf_amd64_9859e6d1394d99d3\c_nettrans.PNF	NetMonInstaller.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpgm.inf_amd64_53a3ab388eb9bfff\netpgm.PNF	NetMonInstaller.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netlldp.inf_amd64_be17907d28860f8c\netlldp.PNF	NetMonInstaller.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisuio.inf_amd64_431cd021ee9bdd64\ndisuio.PNF	NetMonInstaller.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatform.inf_amd64_9958085204ee921f\ndisimplatform.PNF	NetMonInstaller.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netip6.inf_amd64_35eb4f6b0a600ef7\netip6.PNF	NetMonInstaller.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lltdio.inf_amd64_b249206e74042737\lltdio.PNF	NetMonInstaller.exe
File opened for modification	C:\Windows\SysWOW64\wanpacket.dll	._cache_WinPcap_3_1_beta4.exe
File opened for modification	C:\Windows\SysWOW64\wpcap.dll	._cache_WinPcap_3_1_beta4.exe
File opened for modification	C:\Windows\SysWOW64\pthreadVC.dll	._cache_WinPcap_3_1_beta4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nettcpip.inf_amd64_f99d463bac47c446\nettcpip.PNF	NetMonInstaller.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral14/files/0x000700000002d57f-6.dat	upx
behavioral14/memory/2176-34-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral14/memory/2176-45-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral14/memory/704-279-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral14/memory/2176-333-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral14/memory/4528-338-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral14/memory/2176-340-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral14/memory/704-348-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral14/memory/704-352-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral14/memory/2176-400-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral14/memory/2176-406-0x0000000000400000-0x0000000000456000-memory.dmp	upx

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WinPcap\npf_mgm.exe	._cache_WinPcap_3_1_beta4.exe
File opened for modification	C:\Program Files (x86)\WinPcap\daemon_mgm.exe	._cache_WinPcap_3_1_beta4.exe
File opened for modification	C:\Program Files (x86)\WinPcap\rpcapd.exe	._cache_WinPcap_3_1_beta4.exe
File opened for modification	C:\Program Files (x86)\WinPcap\NetMonInstaller.exe	._cache_WinPcap_3_1_beta4.exe
File created	C:\Program Files (x86)\WinPcap\Uninstall.exe	._cache_WinPcap_3_1_beta4.exe
File opened for modification	C:\Program Files (x86)\WinPcap\Uninstall.exe	._cache_WinPcap_3_1_beta4.exe
File opened for modification	C:\PROGRAM FILES (X86)\WINPCAP\INSTALL.LOG	._cache_WinPcap_3_1_beta4.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	NetMonInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinPcap_3_1_beta4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_WinPcap_3_1_beta4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetMonInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npf_mgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daemon_mgm.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	NetMonInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NetMonInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	NetMonInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NetMonInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	NetMonInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	NetMonInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NetMonInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NetMonInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NetMonInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NetMonInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NetMonInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NetMonInstaller.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WinPcap_3_1_beta4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
556	EXCEL.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
556	EXCEL.EXE
556	EXCEL.EXE
4528	._cache_Synaptics.exe
556	EXCEL.EXE
556	EXCEL.EXE
704	._cache_Synaptics.exe
556	EXCEL.EXE
556	EXCEL.EXE
556	EXCEL.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2176	3368	WinPcap_3_1_beta4.exe	80
PID 3368 wrote to memory of 4972	3368	WinPcap_3_1_beta4.exe	81
PID 4972 wrote to memory of 4528	4972	Synaptics.exe	82
PID 4920 wrote to memory of 704	4920	Synaptics.exe	87
PID 2176 wrote to memory of 3532	2176	._cache_WinPcap_3_1_beta4.exe	89
PID 2176 wrote to memory of 3696	2176	._cache_WinPcap_3_1_beta4.exe	91
PID 2176 wrote to memory of 1260	2176	._cache_WinPcap_3_1_beta4.exe	93

C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\WinPcap_3_1_beta4.exe
"C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\WinPcap_3_1_beta4.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\._cache_WinPcap_3_1_beta4.exe
  "C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\._cache_WinPcap_3_1_beta4.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Program Files (x86)\WinPcap\npf_mgm.exe
    "C:\Program Files (x86)\WinPcap\npf_mgm.exe" -r
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3532
- - C:\Program Files (x86)\WinPcap\daemon_mgm.exe
    "C:\Program Files (x86)\WinPcap\daemon_mgm.exe" -r
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3696
- - C:\Program Files (x86)\WinPcap\NetMonInstaller.exe
    "C:\Program Files (x86)\WinPcap\NetMonInstaller.exe" i
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    PID:1260
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4528

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:556

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetMonInstaller.exe

Path C:\Program Files (x86)\WinPcap\NetMonInstaller.exe
Size 6KB
SHA256 1975013bf589d4fdfe6d6ff78379f3079aacc4255206447e05ec92a15a142a5b
MD5 f0a994d8f40bfde2328cb4dd8ff909ec
SHA1 c30160a8243280ea73520cece4745f6e0b2ceb01
SHA512 350afa391c0ae1188907c3b9fa5fe46121e32e9ef550d5fe664eb7830c56ead82247b865732d206428b617c3e680acbe5529f6dd593629b55844df74cfe7d233
SSDEEP 48:y1eqOR0/lOHDkHDHXHfHHXUHauVU7Y4QBgSGZPZz26VoJr29Fhmr3gC1rlsFroAb:VKXLuVU7YbBgSGZNW/+rBbGdeNGC
TLSH
T1CDD121C6F7F8483CF1F28B30AA7643A55A277D1019BCEB5E4285400E2D36855AAB2777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daemon_mgm.exe

Path C:\Program Files (x86)\WinPcap\daemon_mgm.exe
Size 48KB
SHA256 26b6399940c64ed3e3e6a34f93631fa51362ffacd6c66a84a5d9c94a3b03a9e7
MD5 1610882be9fbbf5e2ca9a757c7eaca25
SHA1 ba8cf9e11b94d571290a13bfc63f28abe91e5a61
SHA512 a8c171d37425ce7e5efda31bb1ca7f9055f727291b305a978155927aa036307828d7768965a4a0b5d2bc7f7cadd3ae195579eac3373079e38cfcc07bb08d1819
SSDEEP 384:XtLwXTT1lSec3oqz9m1jZy2fGJr80WCt3rXshd9C7vWcryK/2gPE0loRoYH:BwXP1lA3p9CF8r/ADc7zyKXM0loRvH
TLSH
T1E4237BA33DD14173E8A2467040B15F3BAF7FA62207618547CBA09D463DB28A5AE3F717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npf_mgm.exe

Path C:\Program Files (x86)\WinPcap\npf_mgm.exe
Size 48KB
SHA256 be7aa32335a84a0e50029dd04787526d83e40ada425f207d170fb207f8639609
MD5 74a7390346b5e922192283af03e0b155
SHA1 f8f7b10cb44df63315e65f50a46afecdc57ff102
SHA512 f3c405e1b32dfb44e0b97400dd95ae007136c2bbdfeead40eac858ac4d00124d942069ea2f9c1e9abee046eb275c7d4975a105c9729bf528d92dc1e093e08c50
SSDEEP 768:Ey+F2oPJo2AauOHLahSRStonb9M5lJcPr:Ey+F2oPguWSRSdl2j
TLSH
T169237DA37ED10173D493467141F34F37AF7FE6220AA19487CB90AD162EB2C995D3B60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 1.2MB
SHA256 8a696b6c55f8fd1c409058e0f0c18c16f584ffc53fdd0784e44179aec5655ed1
MD5 f0c1fda886b488ab1883b3aa37df6640
SHA1 c950e1fa18c0add5a01d8bf5693e9f4292a9922d
SHA512 42bf6b76632ec08774141805514812a175afeeee7ed826abcb0ed542b44ee382466dbe8ff92d0b74e97d6d7e868c910cbce9c93d15b01ffaf7e93726828be5bc
SSDEEP 24576:rnsJ39LyjbJkQFMhmC+6GD9BSWdCW6ApD5zH6MAQCmS8:rnsHyjtk2MYC5GDLVOIDR1Ao5
TLSH
T15D45BF32F2D19437D1325A3D9C6BA3A5582ABF512E38794E3BE42E4C5F3D68238152D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splash.bmp

Path C:\Users\Admin\AppData\Local\Temp\27O1T0U3\._cache_WinPcap_3_1_beta4\splash.bmp
Size 133KB
SHA256 9009f56f3e511c795bc10e9bdd7eaaa8c00866650ed310eb362097700f63b9b4
MD5 b04877cefe4914731fb49225f3b662b5
SHA1 e5c47f08efff81baf7f3dde1797c2528861e1c29
SHA512 12d2d20bcbb0db117eb97785c7e599923bba383ba620aa5b6982462c9a446a3d563348861d43d78b62702d5390eaee0601b0587be5c1e87d6fd0d99aca334314
SSDEEP 768:Hr/xdLtnHEkIqPg2uarY4XKVVO4bwmqvMmG2murkIwHm:Ve3a0CKVVWTG2mu4IKm
TLSH
T1B7D344F63BB2DCA08737CBD4B2B6598E47694F22A51CFC4D4132B65F98311E2A439D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack.dll

Path C:\Users\Admin\AppData\Local\Temp\27O1T0U3\unpack.dll
Size 34KB
SHA256 2adc86ef09b5aea46bc3ee88d1740760b3ce6ae5fa92fb6eceb6efc1e6c942d9
MD5 97bb07c04a2f3a0dace5aff04d305455
SHA1 2a966dfb6463a5c26ffb3a247dc9281bb57d25cf
SHA512 9b00d6c26dfa946b78f73192c78edd6ae6027c377406f8e57089db8426b9664c972c77eb5b998430d9ab99c750b47d8e18203b737afcedec9a9dd09404c07c9f
SSDEEP 768:b+OD2qpLe1eKwOsJdGsngsHPNk4Lkr+DOw38sZeaPYUV5T233:b+OqqU1odGuxFvAr+7sETK
TLSH
T1EDF27C40FE62C1F2D4C802B671A5273BBD355D4416DB9283C7933D32EC62A31B52DE9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Users\Admin\AppData\Local\Temp\27O1T0VO\._cache_Synaptics\Uninstall.exe
Size 194KB
SHA256 dc870b8ade874c66d009553139eeeb07087c4a1f2e7125a140b048e349822e4b
MD5 62da2c201bc09a55c97c46f0ad73c28a
SHA1 adbdd63ff66fada5d91836caf1f62b992953964f
SHA512 157bade77af45e414a1ef3e6d0887c28be3e5bdb3e191405759f6bde1585be3e69e254861c39fa530e66b825ebdeb5b31fa3c8e9804750543e37cb57b53f9341
SSDEEP 3072:sdvRSTNzdcWwF3a1Kf1gbReHjGsOiIfXuErH8uTQBu8RBX:sMw1wKtgNeHjOvtrcu4u
TLSH
T19F149E92F980E4B7D2B1D9359C2294D4B52EFC24AE341D0B77F48F0D6AB97C159281E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.pdb

Path C:\Users\Admin\AppData\Local\Temp\27O1T0VO\._cache_Synaptics\db.pdb
Size 4KB
SHA256 26c877d0cbe0712f569b6485a699d356a3817f0d014cf92ef01a13275aa5e280
MD5 870c679c5bf932724619fccc8ff60f3e
SHA1 46ec4320f6b40abad4f1e753e67dbfc1388c53de
SHA512 d250e32d2cd6ecb73b8b118eb502851f5bc57aaed73c260d08d113ec58659389a585813a49134e031dc9881e6ed98ae462288f7f46606ab7552c9f7cd9cc2178
SSDEEP 96:mkEPK3ChiOO7O/ZxEx5SnN8LPACBO+umgbXvLOQO8Rra3:mkE7Ypx5iNTWQmcXDOQf03
TLSH
T109916C7E82FDF99269A92B819CB1E1590E9A824E01EDC770920835F356708DC38138E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enu.lng

Path C:\Users\Admin\AppData\Local\Temp\27O1T0VO\._cache_Synaptics\lng\Enu.lng
Size 5KB
SHA256 2cf57a46d77808d30ccdfe6d67801119c6cc812f0fba02d9689a91f33399a427
MD5 60f475862cf4363904975df475353bb4
SHA1 7a3dbc3ab2d7bc3f278b27e91834b5f309db316e
SHA512 ebbb9dc923424cfc194ac198fbc1aa15f20e1ce2543c5c281f627980ede4d8ce7fa5eea34b33ac66d9613048a55f44df17877933947ea71fe42b1e8a74a39ecd
SSDEEP 96:ao8GLa9D/88KW/rJWT9+2oLngH5HgrF/1KMdnDsl89HjDYz/3DfQB6DslTs2XmAj:18GLa97GqAT9+xLgH1grF/1KMdw8RjD1
TLSH
T1A0C1855DC74941F91FD303BA621B2D9AA2EE857C9A12199CF4CF110D630353DC2BB9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.pdb

Path C:\Users\Admin\AppData\Local\Temp\27O1T0VO\._cache_Synaptics\main.pdb
Size 992B
SHA256 47e2ce9e2cf32f174be90f40d3d14a1a869d4fa8365f2c41a3ede3539fbc2a95
MD5 828684d98e89e04902bbaece22e39263
SHA1 e25e46f5b19919f8b0bf697ee09bad88f9111a14
SHA512 4968fbad3accbf219f7c4d4c088dd2e9f7a62ff919fd25dab4cfe13d9a0e3cb5ebc71c8ef180f034d8affea0c85b5cdad96d2c3cfdb0026691ddbc94fb098386
TLSH
T18C11C813620C0318770A89295E0C7EF15CD3321CEB7B0DB6385352E7BA6DD56828179F
MD5 SHA1 SHA512 TLSH

Submit Download

StdUI.dll

Path C:\Users\Admin\AppData\Local\Temp\27O1T0VO\._cache_Synaptics\plugins\0\StdUI.dll
Size 147KB
SHA256 8d987a52990bf4ea755240b7a1ea7f73a16b1fd67f3e91fc21e87a4f7d443546
MD5 0ef0df3c28f135fa78eb9dfcf1b0499e
SHA1 ca21f49137267b3edc8f5aae86bec80f43cd4890
SHA512 26bd1e5b0996a6b653b5456e361fa373b0b0505536bb9b8095b1f1389b244810aa51513be2af1585408a0f151db2cadbb65abc02e64b8ca5e8b2e6c5d502746b
SSDEEP 3072:+7KCJqaGbwBfm9AFRhXUYVwW8lGXCaqW28X0eHnN1z0X:+TqY1fXUK8oC8IeHN1z
TLSH
T19CE35C26F2C0C476D1720DBCDE56D2C4A52AFA202E38181F76E91F4D5E3E2C26D692D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enu.lng

Path C:\Users\Admin\AppData\Local\Temp\27O1T0VO\._cache_Synaptics\plugins\0\lng\Enu.lng
Size 4KB
SHA256 94ed93684eca3c16b957e34e3937c3eae52d3275c8bfe3d2d845583c2bec152b
MD5 ac4c7d9da804065ce25541ccfe5c9296
SHA1 4fdd65221399ad4a3eba47be8bb7d3e9a37501bd
SHA512 6ad24a1049f04b7651c611a9d53205bc7a24ba70431870edf56b38240acf53872135bc8bbb61d897fed06fc0ea7666aafb3418ddfc3197549ee9c98bf889a9b9
SSDEEP 96:p+E//AWS9ANjAGvSPiPtVCRO5D7Eu0beMh7PaEhP74hgw:p1/Il9ANEMSPilKO5D7Eth7pMhJ
TLSH
T159A196C9C71A53797AD3132F455A5AC7B169CCAC1563268694CBC04E2306E30C3BFADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

presetup.bmp

Path C:\Users\Admin\AppData\Local\Temp\27O1T0VO\._cache_Synaptics\presetup.bmp
Size 13KB
SHA256 4600e337e68cdcf786b193e3d28ea5934576f8b7b3bee6241177eca56c6cea4d
MD5 65668961b4585f1564eb5bbf3b40dcde
SHA1 8966cd3903c4ba85dc3855f3c26ff720e3bbb369
SHA512 a4829c7ba8e4ed17c9b590bcfc96320b6b69e4189f4b928d0a694a82a7a0c9a9436f7bf588ab17e6b451c7b7572505f18e837787a1cbebd8f45fa3b9f4306de1
SSDEEP 192:NCzldtfPXhwp/pjWMa6Zw+K1cCLcy3sg+8nff6nXsv7K1efI/OSAFXsPV:NCzlTPOpBap+DycgxnX6nXsvLePV
TLSH
T131523D11383BFC7244657B9BA925C352AA31C94A8526DDFCD1C703ADBECAF485F84463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

presetup.rgn

Path C:\Users\Admin\AppData\Local\Temp\27O1T0VO\._cache_Synaptics\presetup.rgn
Size 1KB
SHA256 cc0b0c69fb12cba8230c363bf63809ac1b8c8695a533446c87c86d9f8643c8c7
MD5 172eeccf4687e172e12a1b4ad3023e9f
SHA1 2b74254b4426b38932748aae109ddd1635ee7261
SHA512 ffb640adc81bcdcb45a6cd9e95a96c45e49fbf75ff7c785dc79623adf2c9a54930e3437c1f48b537d271b3b63ce5c1cc7e3f90709afb334d2acab3751cc69815
TLSH
T1E811FE82F100B6B5C9AE0D306218AD0C0484C55E0BF0432FDE6D9CDEBB9E21A1F1BA46
MD5 SHA1 SHA512 TLSH

Submit Download

license.txt

Path C:\Users\Admin\AppData\Local\Temp\27O1T0VO\._cache_Synaptics\presetup\license.txt
Size 1KB
SHA256 4d50e52e2a23d990c784aacb2711ff2a32b3d37bac41ce2517baba65660d5a87
MD5 3ec0cb60ee5c909909e1f5ad2b5daf5d
SHA1 f59c49d53243a3bf75e239f813b7f61bc26ff113
SHA512 e7139d99fa6aebd19d57928f59657d97e4b9d3c37c699c248e9593e69d25734718f7d82218d829c6d1d626ba01a663e4c455741e97e8d72a6295a3ad97b48164
TLSH
T14D31924711880BB21AE2A7446A676EC0B18C902E3E272E012C7DF38C636B42EC5BB149
MD5 SHA1 SHA512 TLSH

Submit Download

readme.txt

Path C:\Users\Admin\AppData\Local\Temp\27O1T0VO\._cache_Synaptics\presetup\readme.txt
Size 243B
SHA256 1cb901948589399f3f1abd017640e32479b799f99865b49936f5990d5ad4c040
MD5 f8d14b853290c277b304f2a5bb96eb5b
SHA1 d019aff6ef439d295ba0c69c2db71378c1903986
SHA512 16a73aecd2b877f8e31554752332d8ea352f2bd264f78690cfbac51b674dc0cb8629f4fbad05df1fc75280521c65b238d41e402d249785e234a0ad036b6d76f1
TLSH
T107D05B4D91585332145063519A4835C67BA4F45112D6465550D9E8605702A3C93366E8
MD5 SHA1 SHA512 TLSH

Submit Download

._cache_WinPcap_3_1_beta4.exe

Path C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\._cache_WinPcap_3_1_beta4.exe
Size 473KB
SHA256 c1b8500601117ad58e24a3a18b93d8f0a42edbdc6c04d69aa629e94a10950d70
MD5 5de823defbc70e2b1f1989f96bacb583
SHA1 6a383005ccc1811666a32b51dd9211153b00c772
SHA512 beba71c60567a2a47aab61152ae58a73328a6add5adae913bc76e6ec3b9719e881aa5bab1e371a4703fbb28478301b950efb0e10812190f40962baacc9a49f3e
SSDEEP 6144:gKh8PMS8SQ7N+7NmdxggioDfv2IaAuRLyMBUD55MQaj4466MADf4zgrfe2Z4sL/y:gaS8/3dCWD2IVMGD5z466MADAzCmod8B
TLSH
T1DEA42336EB5AF821D210DA76C0D7CFF216DCEA0754B647EA7480AD3C1851C36AA8947F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o8pFy6at.xlsm

Path C:\Users\Admin\AppData\Local\Temp\o8pFy6at.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-266-0x00007FFA53B70000-0x00007FFA53B80000-memory.dmp

Download

memory/556-241-0x00007FFA53B70000-0x00007FFA53B80000-memory.dmp

Download

memory/556-187-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/556-403-0x000002A9B9820000-0x000002A9B98C3000-memory.dmp

Download

memory/556-412-0x000002A9B9820000-0x000002A9B98C3000-memory.dmp

Download

memory/556-442-0x000002A9B9820000-0x000002A9B98C3000-memory.dmp

Download

memory/556-343-0x000002A9B9820000-0x000002A9B98C3000-memory.dmp

Download

memory/556-182-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/556-455-0x000002A9B9820000-0x000002A9B98C3000-memory.dmp

Download

memory/556-186-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/556-183-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/556-184-0x00007FFA56710000-0x00007FFA56720000-memory.dmp

Download

memory/556-464-0x000002A9B9820000-0x000002A9B98C3000-memory.dmp

Download

memory/704-279-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/704-352-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/704-348-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1260-397-0x0000000000F20000-0x0000000000F71000-memory.dmp

Download

memory/2176-235-0x0000000002C70000-0x0000000002C99000-memory.dmp

Download

memory/2176-406-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2176-341-0x0000000002C70000-0x0000000002C99000-memory.dmp

Download

memory/2176-34-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2176-45-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2176-340-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2176-333-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2176-400-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2176-401-0x0000000002C70000-0x0000000002C99000-memory.dmp

Download

memory/2176-108-0x0000000002AC0000-0x0000000002AE7000-memory.dmp

Download

memory/3368-105-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/3368-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/3368-0-0x0000000002390000-0x0000000002391000-memory.dmp

Download

memory/4528-190-0x0000000002C10000-0x0000000002C37000-memory.dmp

Download

memory/4528-338-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4920-280-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/4972-437-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/4972-438-0x00000000008A0000-0x00000000008F1000-memory.dmp

Download

memory/4972-147-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/4972-339-0x0000000000400000-0x0000000000539000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads