Analysis
- max time kernel
6s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - submitted
16/06/2024, 00:48
General
- Target 9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe
- Size 4.2MB
- Sample240616-a58rbssbqe
- SHA256 9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Detect Neshta payload 64 IoCs
- Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Neshta family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 2 IoCs
- Modifies system executable filetype association 2 TTPs 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 8 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe"C:\Users\Admin\AppData\Local\Temp\9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe"C:\Users\Admin\AppData\Local\Temp\._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate6⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate7⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate8⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate9⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate10⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate11⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate12⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate13⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate14⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate15⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate16⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate17⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate18⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate19⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate20⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate21⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate22⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate23⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate24⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate25⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate26⤵
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate20⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate21⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate22⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate23⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate24⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate25⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate26⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate27⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate28⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate29⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate30⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate31⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate32⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate33⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate34⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate35⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate36⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate17⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate18⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate19⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate20⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate21⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate22⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate23⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate24⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate25⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate26⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate27⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate28⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate29⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate30⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate31⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate32⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate33⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate14⤵
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate11⤵
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate8⤵
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate6⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate7⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate8⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate9⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate10⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate11⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate12⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate13⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate14⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate15⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate16⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate15⤵
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate12⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate12⤵
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate9⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Synaptics.exe" InjUpdate11⤵
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate6⤵
-
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
ACROBR~1.EXE
ACROTE~1.EXE
ADOBEC~1.EXE
ADelRCP.exe
RdrCEF.exe
AcroRd32.exe
WCCHRO~1.EXE
Eula.exe
FULLTR~1.EXE
LOGTRA~1.EXE
READER~1.EXE
WOW_HE~1.EXE
arh.exe
32BITM~1.EXE
64BITM~1.EXE
ADOBEA~1.EXE
AdobeARM.exe
jaureg.exe
jucheck.exe
jusched.exe
VSTOIN~1.EXE
java.exe
javaw.exe
javaws.exe
GO664E~1.EXE
GOBD5D~1.EXE
GOF5E2~1.EXE
GOOGLE~2.EXE
GOOGLE~3.EXE
GOOGLE~4.EXE
DISABL~1.EXE
IE_TO_~1.EXE
COOKIE~1.EXE
ELEVAT~1.EXE
IDENTI~1.EXE
setup.exe
MSEDGE~1.EXE
MSEDGE~2.EXE
MSEDGE~3.EXE
msedge.exe
RCX4C8A.tmp
Synaptics.exe
._cache_._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe
._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe
._cache__C578E~1.EXE
._cache_._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe
._cache_9f9218ee03f24124ffc6174f3254c87829d01822566a875f5ae0bbd3a763861d.exe
._cache__CACHE~2.EXE
._cache__CACHE~3.EXE
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
svchost.com
memory/228-761-0x0000000000400000-0x000000000041B000-memory.dmp
memory/464-740-0x0000000000400000-0x000000000041B000-memory.dmp
memory/528-588-0x0000000000400000-0x000000000041B000-memory.dmp
memory/552-474-0x0000000000400000-0x000000000041B000-memory.dmp
memory/736-825-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/924-520-0x0000000000400000-0x000000000076C000-memory.dmp
memory/980-100-0x0000000000400000-0x0000000000832000-memory.dmp
memory/980-404-0x0000000000400000-0x000000000041B000-memory.dmp
memory/980-739-0x0000000000400000-0x000000000041B000-memory.dmp
memory/980-0-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/1200-596-0x0000000000400000-0x000000000076C000-memory.dmp
memory/1204-699-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1352-530-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1560-587-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1580-201-0x0000000000400000-0x000000000076C000-memory.dmp
memory/1764-698-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2176-271-0x00007FFF8CBD0000-0x00007FFF8CBE0000-memory.dmp
memory/2176-269-0x00007FFF8CBD0000-0x00007FFF8CBE0000-memory.dmp
memory/2176-259-0x00007FFF8CBD0000-0x00007FFF8CBE0000-memory.dmp
memory/2176-307-0x00007FFF8AB70000-0x00007FFF8AB80000-memory.dmp
memory/2176-332-0x00007FFF8AB70000-0x00007FFF8AB80000-memory.dmp
memory/2176-279-0x00007FFF8CBD0000-0x00007FFF8CBE0000-memory.dmp
memory/2176-270-0x00007FFF8CBD0000-0x00007FFF8CBE0000-memory.dmp
memory/2268-748-0x0000000000400000-0x00000000006A5000-memory.dmp
memory/2276-782-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2328-394-0x0000000000400000-0x0000000000832000-memory.dmp
memory/2368-724-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2584-552-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2612-272-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2664-595-0x0000000000400000-0x000000000076C000-memory.dmp
memory/2792-618-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3016-824-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/3032-827-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3076-610-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3148-487-0x0000000000400000-0x000000000076C000-memory.dmp
memory/3164-322-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3252-393-0x0000000000400000-0x0000000000832000-memory.dmp
memory/3256-705-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/3536-268-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4024-589-0x0000000000400000-0x00000000006A5000-memory.dmp
memory/4044-777-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4048-784-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4264-621-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4300-720-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4304-553-0x0000000000400000-0x00000000006A5000-memory.dmp
memory/4344-631-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4344-478-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4504-725-0x0000000000400000-0x0000000000518000-memory.dmp
memory/4512-704-0x0000000000400000-0x0000000000518000-memory.dmp
memory/4616-549-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4680-612-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/4728-529-0x0000000000400000-0x000000000076C000-memory.dmp
memory/4760-528-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4844-460-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4924-697-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/4948-619-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4956-817-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4972-685-0x0000000000400000-0x000000000041B000-memory.dmp