Overview

overview

10

Static

static

10

6346a63f22...82.exe

windows7-x64

10

6346a63f22...82.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    63s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-11-2024 15:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe

  • Size

    6.1MB

  • MD5

    02bec9d86e4839199a60b334dd650e60

  • SHA1

    8f86b49725abfae4c201654f3aa43ec0041cea39

  • SHA256

    6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82

  • SHA512

    660d932f4b2fe56d175ba3c2823a0501d13e29876766a57bd4df5b345177887b48fb9eedcf0c3929cca509f49a2bb189395e82c2418fa6e8834e0a2f79425243

  • SSDEEP

    196608:iLmGZT4llVN1apVkFGT5KSPNOe7mBuyQzh:iyST4TlIGWK+N0BnQzh

Score
10/10
xredbackdoordefense_evasiondiscoveryevasionpersistenceprivilege_escalationupx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies security service 2 TTPs 53 IoCs
    evasion
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Disables RegEdit via registry modification 4 IoCs
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Server Software Component: Terminal Services DLL 1 TTPs 17 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 30 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 20 IoCs
    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 46 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Indicator Removal: Clear Persistence 1 TTPs 64 IoCs

    remove IFEO.

    defense_evasion
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 26 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Runs regedit.exe 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe
    "C:\Users\Admin\AppData\Local\Temp\6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3028
      • C:\32788R22FWJFW\ERUNT.3XE
        "C:\32788R22FWJFW\ERUNT.3XE" "C:\Windows\erdnt\Hiv-backup" SYSREG CURUSER OTHERUSERS /NOCONFIRMDELETE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:676
      • C:\32788R22FWJFW\PEV.3XE
        C:\32788R22FWJFW\PEV.3XE RIMPORT C:\32788R22FWJFW\EXE.reg
        3⤵
        • Disables RegEdit via registry modification
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Indicator Removal: Clear Persistence
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • System policy modification
        PID:2948
      • C:\32788R22FWJFW\EN-US\iexplore.exe
        C:\32788R22FWJFW\EN-US\iexplore.exe /w C:\32788R22FWJFW\PEV.3XE RIMPORT C:\32788R22FWJFW\EXE.reg
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:840
        • C:\32788R22FWJFW\PEV.3XE
          C:\32788R22FWJFW\PEV.3XE RIMPORT C:\32788R22FWJFW\EXE.reg
          4⤵
          • Disables RegEdit via registry modification
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Impair Defenses: Safe Mode Boot
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Indicator Removal: Clear Persistence
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • System policy modification
          PID:600
      • C:\32788R22FWJFW\iexplore.exe
        C:\32788R22FWJFW\iexplore.exe Script C:\32788R22FWJFW\Nirscript.dat
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2120
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -s450000-1400000 -t!k -t!o -t!g -k C:\*.exe and not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2692
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -k { "C:\ProgramData\*" or "C:\Users\Admin\*" } not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1636
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -k "C:\Users\Admin\AppData\Local\Temp\*" not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2396
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -rk { "C:\Program Files (x86)\*" OR "C:\Program Files (x86)\Common Files\*" } not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2100
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -loadline:C:\32788R22FWJFW\License\UnxUtilsDist.pif and not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:292
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -loadline:C:\32788R22FWJFW\License\UnxUtilsDist.com and not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1808
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /C C:\Windows\SysNative\cmd.exe /c C:\32788R22FWJFW\fl0.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2316
        • C:\Windows\system32\cmd.exe
          C:\Windows\SysNative\cmd.exe /c C:\32788R22FWJFW\fl0.bat
          4⤵
            PID:2956
            • C:\32788R22FWJFW\swxcacls.3XE
              SWXCACLS "C:\Windows\system32\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2392
            • C:\32788R22FWJFW\gsar.3XE
              GSAR -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "C:\Windows\system32\cmd.exe" cmd.3XE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1648
            • C:\32788R22FWJFW\swreg.3XE
              SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /DA:R /Q
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2156
            • C:\32788R22FWJFW\swreg.3XE
              SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /RESET /Q
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1792
            • C:\32788R22FWJFW\swreg.3XE
              SWREG ACL "HKLM\SOFTWARE\Microsoft\Command Processor" /RESET /Q
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1828
            • C:\32788R22FWJFW\swreg.3XE
              SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /RESET /Q
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1280
            • C:\32788R22FWJFW\swsc.3XE
              SWSC QUERY BFE
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1760
            • C:\32788R22FWJFW\grep.3XE
              GREP -Fsq "STATE : 4 RUNNING"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:884
            • C:\32788R22FWJFW\pev.3XE
              PEV -tx40000 -t!g -rtf -tpmz -c##y#b#z# \Services.exe
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2064
            • C:\32788R22FWJFW\sed.3XE
              SED -r "/(0x0.*)\t\1/d"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:824
            • C:\32788R22FWJFW\grep.3XE
              GREP .
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1948
            • C:\32788R22FWJFW\pev.3XE
              PEV -tf -tpmz -t!o C:\Windows\Installer\*000*.? -preg"C:\\Windows\\Installer\\\{[^\\]*\}\\U\\[^\\]*\..$"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1708
            • C:\32788R22FWJFW\setpath.3XE
              SETPATH
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:236
            • C:\32788R22FWJFW\grep.3XE
              GREP -sq . ZAFldr00.dat
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2608
        • C:\32788R22FWJFW\Hidec.3XE
          C:\32788R22FWJFW\Hidec.3XE C:\Windows\Sysnative\cmd.exe /c REGEDIT.EXE /S C:\32788R22FWJFW\W7Reg.dat
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2652
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /c REGEDIT.EXE /S C:\32788R22FWJFW\W7Reg.dat
            4⤵
              PID:1444
              • C:\Windows\regedit.exe
                REGEDIT.EXE /S C:\32788R22FWJFW\W7Reg.dat
                5⤵
                • Modifies security service
                • Event Triggered Execution: Image File Execution Options Injection
                • Server Software Component: Terminal Services DLL
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Indicator Removal: Clear Persistence
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Runs regedit.exe
                PID:1104
          • C:\32788R22FWJFW\Hidec.3XE
            C:\32788R22FWJFW\Hidec.3XE C:\32788R22FWJFW\cmd.3XE /C C:\32788R22FWJFW\p.cmd
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2616
            • C:\32788R22FWJFW\cmd.3XE
              C:\32788R22FWJFW\cmd.3XE /C C:\32788R22FWJFW\p.cmd
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2820
              • C:\32788R22FWJFW\pev.3XE
                PEV.3XE RIMPORT C:\32788R22FWJFW\EXE.reg
                5⤵
                • Disables RegEdit via registry modification
                • Event Triggered Execution: Image File Execution Options Injection
                • Executes dropped EXE
                • Impair Defenses: Safe Mode Boot
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Indicator Removal: Clear Persistence
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • System policy modification
                PID:676
              • C:\32788R22FWJFW\swreg.3XE
                SWREG.3XE QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_{79007602-0CDB-4405-9DBF-1257BB3226ED}\0000\Control" /v ActiveService
                5⤵
                • Executes dropped EXE
                PID:2932
              • C:\32788R22FWJFW\swreg.3XE
                SWREG.3XE QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root"
                5⤵
                • Executes dropped EXE
                PID:1748
              • C:\32788R22FWJFW\grep.3XE
                GREP.3XE -Eix "HKEY_.*\\root\\\*PNP[^\\]*" PNP296_00
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1744
              • C:\32788R22FWJFW\NirCmd.3XE
                NIRCMD.3XE WIN CLOSE CLASS "#32770"
                5⤵
                • Executes dropped EXE
                PID:1724
              • C:\32788R22FWJFW\swreg.3XE
                SWREG.3XE QUERY "HKLM\System\Currentcontrolset\Control\ProductOptions" /v ProductType
                5⤵
                • Executes dropped EXE
                PID:1640
              • C:\32788R22FWJFW\grep.3XE
                GREP.3XE -isq "ProductType.*WinNT" WinNT00
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1752
              • C:\32788R22FWJFW\pev.3XE
                PEV -c##g# "C:\Windows\system32\kernel32.dll"
                5⤵
                • Executes dropped EXE
                PID:576
              • C:\Windows\SysWOW64\findstr.exe
                FINDSTR -B "6.1.760" CurVer
                5⤵
                  PID:2152
                • C:\32788R22FWJFW\hidec.3XE
                  HIDEC SWSC START CryptSvc
                  5⤵
                  • Executes dropped EXE
                  PID:1356
                • C:\32788R22FWJFW\pev.3XE
                  PEV -rtd C:\Windows\Sysnative
                  5⤵
                  • Executes dropped EXE
                  PID:2772
                • C:\32788R22FWJFW\grep.3XE
                  GREP -isq "processorArchitecture=.amd64." "C:\Windows\SysNative\csrss.exe"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2840
                • C:\32788R22FWJFW\NirCmd.3XE
                  NIRCMD CMDWAIT 6000 EXEC HIDE PEV -k CSCRIPT.exe
                  5⤵
                  • Executes dropped EXE
                  PID:560
                • C:\Windows\SysWOW64\cscript.exe
                  CSCRIPT.exe //NOLOGO //E:VBSCRIPT //B //T:05 "C:\32788R22FWJFW\ksvchost.vbs"
                  5⤵
                    PID:2940
                  • C:\32788R22FWJFW\pev.3XE
                    PEV -k NIRCMD.3XE
                    5⤵
                    • Executes dropped EXE
                    PID:2084
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option
                    5⤵
                    • Executes dropped EXE
                    PID:1720
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys /D Driver
                    5⤵
                    • Executes dropped EXE
                    • Impair Defenses: Safe Mode Boot
                    PID:2140
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys /D Driver
                    5⤵
                    • Executes dropped EXE
                    PID:1780
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RESET /Q
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1536
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RO:F /RA:F /Q
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:392
                  • C:\32788R22FWJFW\swsc.3XE
                    SWSC QUERY BFE
                    5⤵
                    • Executes dropped EXE
                    PID:856
                  • C:\32788R22FWJFW\grep.3XE
                    GREP -Fsq "STATE : 4 RUNNING"
                    5⤵
                    • Executes dropped EXE
                    PID:2480
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /V "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" /T REG_DWORD /D 1
                    5⤵
                    • Executes dropped EXE
                    PID:292
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG QUERY "HKCU\Control Panel\Desktop\MuiCached" /v "MachinePreferredUILanguages"
                    5⤵
                    • Executes dropped EXE
                    PID:1984
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG QUERY "HKCU\Control Panel\International" /v LocaleName
                    5⤵
                    • Executes dropped EXE
                    PID:2400
                  • C:\32788R22FWJFW\sed.3XE
                    SED.3XE -r "/.* /!d; s///; s/(\\0)*$//; s/\\0/\n/g" MUI00
                    5⤵
                    • Executes dropped EXE
                    PID:916
                  • C:\32788R22FWJFW\sed.3XE
                    SED.3XE -r -n "G; s/\n/&&/; /^([ -~]*\n).*\n\1/d; s/\n//; h; P"
                    5⤵
                    • Executes dropped EXE
                    PID:2392
                  • C:\32788R22FWJFW\grep.3XE
                    GREP.3XE -Fsqix en-US MUI
                    5⤵
                    • Executes dropped EXE
                    PID:2692
                  • C:\32788R22FWJFW\pev.3XE
                    PEV -limit1 -rtf -sasize "C:\32788R22FWJFW\en-US\*.3XE.mui"
                    5⤵
                    • Executes dropped EXE
                    PID:2156
                  • C:\32788R22FWJFW\pev.3XE
                    PEV UZIP License\pv_5_2_2.zip .\
                    5⤵
                    • Executes dropped EXE
                    PID:1280
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG QUERY "HKLM\Software\Swearware" /V LastDir
                    5⤵
                    • Executes dropped EXE
                    PID:2556
                  • C:\32788R22FWJFW\sed.3XE
                    SED -r "/.* (.:\\[^\\]*)$/!d; s//\1/"
                    5⤵
                    • Executes dropped EXE
                    PID:868
                  • C:\32788R22FWJFW\pev.3XE
                    PEV -outputtemp00 -rtf -c:##5# .\* and { License.exe or 32788R22FWJFW.exe or WinNT.exe or N_.exe }
                    5⤵
                    • Executes dropped EXE
                    PID:1576
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG QUERY "HKCU\Console_combofixbackup"
                    5⤵
                    • Executes dropped EXE
                    PID:1124
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG COPY "HKCU\Console" "HKCU\Console_combofixbackup" /s
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2076
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG ADD "HKCU\Console" /v "QuickEdit" /T REG_DWORD /D 0
                    5⤵
                      PID:2996
                    • C:\32788R22FWJFW\swreg.3XE
                      SWREG ADD "HKCU\Console" /V "InsertMode" /T REG_DWORD /D 1
                      5⤵
                        PID:2700
                      • C:\32788R22FWJFW\swreg.3XE
                        SWREG QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\CodePage" /V ACP
                        5⤵
                          PID:2980
                        • C:\32788R22FWJFW\sed.3XE
                          SED "/.* /!d; s//@CHCP.com /" NlsCodePageACP00
                          5⤵
                            PID:2628
                          • C:\32788R22FWJFW\swreg.3XE
                            SWREG ADD HKCU\Console /V CodePage /T REG_DWORD /D "1252"
                            5⤵
                              PID:2648
                            • C:\32788R22FWJFW\swreg.3XE
                              SWREG ADD HKU\S-1-5-18\Console /V CodePage /T REG_DWORD /D "1252"
                              5⤵
                              • Modifies data under HKEY_USERS
                              PID:1260
                            • C:\Windows\SysWOW64\chcp.com
                              CHCP.com 1252
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:2340
                            • C:\32788R22FWJFW\swreg.3XE
                              SWREG QUERY HKLM\System\CurrentControlSet\Control\NLS\Language /V Default
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:2872
                            • C:\32788R22FWJFW\sed.3XE
                              SED "/.* /!d; s///" NlsLanguage00
                              5⤵
                                PID:2160
                              • C:\32788R22FWJFW\grep.3XE
                                GREP -isq "09$" NlsLanguageDefault
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:1104
                              • C:\32788R22FWJFW\swreg.3XE
                                SWREG QUERY hklm\system\currentcontrolset\enum\root\system
                                5⤵
                                  PID:1444
                                • C:\32788R22FWJFW\swsc.3XE
                                  SWSC DELETE MBR
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2720
                                • C:\32788R22FWJFW\rmbr.3XE
                                  RMBR -u
                                  5⤵
                                    PID:2624
                                  • C:\32788R22FWJFW\handle.3XE
                                    HANDLE -p System
                                    5⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    PID:2924
                                    • C:\32788R22FWJFW\handle64.exe
                                      HANDLE -p System
                                      6⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Suspicious behavior: LoadsDriver
                                      PID:2944
                                  • C:\32788R22FWJFW\grep.3XE
                                    GREP -Fic "C:\Windows\SysWow64\drivers\volsnap.sys" temp00
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2368
                                  • C:\32788R22FWJFW\grep.3XE
                                    GREP -E "^[5-9]$|.."
                                    5⤵
                                      PID:2928
                                    • C:\32788R22FWJFW\pev.3XE
                                      PEV -tx50000 -tf -files:files.pif -c:##5#b#f# -output:mdCheck00.dat
                                      5⤵
                                        PID:2952
                                      • C:\32788R22FWJFW\grep.3XE
                                        GREP -vs "^!" mdCheck00.dat
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1520
                                      • C:\32788R22FWJFW\grep.3XE
                                        GREP -Fvf md5sum.pif mdCheck0a.dat
                                        5⤵
                                          PID:1332
                                        • C:\32788R22FWJFW\grep.3XE
                                          GREP -sq . mdCheck01.dat
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2512
                                        • C:\32788R22FWJFW\swreg.3XE
                                          SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /RESET /Q
                                          5⤵
                                            PID:1928
                                          • C:\32788R22FWJFW\swreg.3XE
                                            SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /RESET /Q
                                            5⤵
                                              PID:264
                                            • C:\32788R22FWJFW\swreg.3XE
                                              SWREG QUERY "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve
                                              5⤵
                                                PID:2164
                                              • C:\32788R22FWJFW\swreg.3XE
                                                SWREG ADD "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
                                                5⤵
                                                  PID:2236
                                                • C:\32788R22FWJFW\swreg.3XE
                                                  SWREG QUERY "hklm\software\microsoft\windows nt\currentversion\winlogon" /v Userinit
                                                  5⤵
                                                    PID:568
                                                  • C:\32788R22FWJFW\grep.3XE
                                                    GREP -Fi "C:\Windows\system32\userinit.exe" Userinit00
                                                    5⤵
                                                      PID:644
                                                    • C:\32788R22FWJFW\swreg.3XE
                                                      SWREG ADD "hklm\software\microsoft\windows nt\currentversion\winlogon" /v Userinit /d "C:\Windows\system32\userinit.exe,"
                                                      5⤵
                                                      • Modifies WinLogon for persistence
                                                      PID:1544
                                                    • C:\32788R22FWJFW\sed.3XE
                                                      SED -r "/SfxCmd=/I!d; s///; s/\s*$//; s/^(\x22[^\x22]*\x22|[^\x22]\S*) *//; s/(\x22[^\x22]*\x22)/\n\1\n/g" SET00
                                                      5⤵
                                                        PID:712
                                                      • C:\32788R22FWJFW\sed.3XE
                                                        SED -r "/./!d; /^\x22/!{s/\x22(\S+)\x22/\1/; s_\s+(/\S+)\s+_ \x22\1\x22 _g; s_\s+(/\S+)\s+_ \x22\1\x22 _g; s_\x22\s+(/\S*)$_\x22 \x22\1\x22_; s_^(/\S+)\s+_\x22\1\x22 _; }" temp00
                                                        5⤵
                                                          PID:1156
                                                        • C:\32788R22FWJFW\sed.3XE
                                                          SED -r ":a; $!N;s/\n *\x22/ \x22/;ta; s/./@SET SfxCmd=&/; s/^(@SET SfxCmd=)([^\x22]\S*)$/\1\x22\2\x22/" temp01
                                                          5⤵
                                                            PID:1616
                                                          • C:\32788R22FWJFW\swxcacls.3XE
                                                            SWXCACLS C:\Windows\SysNative\ATTRIB.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
                                                            5⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3060
                                                          • C:\32788R22FWJFW\swxcacls.3XE
                                                            SWXCACLS C:\Windows\SysNative\CSCRIPT.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
                                                            5⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:880
                                                          • C:\32788R22FWJFW\swxcacls.3XE
                                                            SWXCACLS C:\Windows\SysNative\PING.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
                                                            5⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:2104
                                                          • C:\32788R22FWJFW\swxcacls.3XE
                                                            SWXCACLS C:\Windows\SysNative\ROUTE.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
                                                            5⤵
                                                              PID:2208
                                                            • C:\32788R22FWJFW\grep.3XE
                                                              GREP -Ei "\\(wscntfy|winlogon|wininit|nvsvc|lsm|lsass|iexplore|svchost|spoolsv|smss|slsvc|services|explorer|ctfmon|csrss|alg)\.....$" MSName00
                                                              5⤵
                                                                PID:1788
                                                              • C:\32788R22FWJFW\grep.3XE
                                                                GREP -Ei "\\uninstall\.....$" MSName00
                                                                5⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2988
                                                              • C:\32788R22FWJFW\grep.3XE
                                                                GREP -Ei "\\NoMbr\.....$" MSName00
                                                                5⤵
                                                                  PID:2940
                                                                • C:\32788R22FWJFW\grep.3XE
                                                                  GREP -Ei "\\iexplore\.exe.$" MSName00
                                                                  5⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:560
                                                                • C:\32788R22FWJFW\sed.3XE
                                                                  SED -r "/.*\\CF@C([1-9][0-9])M([1-9])\.....$/I!d; s//\1\t\2/" MSName00
                                                                  5⤵
                                                                    PID:2000
                                                                  • C:\32788R22FWJFW\grep.3XE
                                                                    GREP .
                                                                    5⤵
                                                                      PID:2084
                                                                    • C:\32788R22FWJFW\pev.3XE
                                                                      PEV -tf -tpmz -t!o C:\Windows\Installer\*000*.? -preg"C:\\Windows\\Installer\\\{[^\\]*\}\\U\\[^\\]*\..$"
                                                                      5⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1720
                                                                    • C:\32788R22FWJFW\swxcacls.3XE
                                                                      SWXCACLS C:\$RECYCLE.bin\* /GA:F /S /Q
                                                                      5⤵
                                                                        PID:2140
                                                                      • C:\32788R22FWJFW\pev.3XE
                                                                        PEV -tf -tpmz -t!o C:\$RECYCLE.bin\*000*.? -preg"\\U\\[^\\]*\..$"
                                                                        5⤵
                                                                          PID:764
                                                                        • C:\32788R22FWJFW\ATTRIB.3XE
                                                                          ATTRIB +R "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
                                                                          5⤵
                                                                            PID:1428
                                                                          • C:\32788R22FWJFW\grep.3XE
                                                                            GREP "=.*[a-z]" sfx.cmd
                                                                            5⤵
                                                                              PID:2588
                                                                            • C:\32788R22FWJFW\grep.3XE
                                                                              GREP -Eisq "=.\/NoMbr| .\/NoMbr. | .\/NoMbr.$" sfx.cmd
                                                                              5⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2424
                                                                            • C:\32788R22FWJFW\grep.3XE
                                                                              GREP -Eisq "\\CFScript[^:\/\\]*$" sfx.cmd
                                                                              5⤵
                                                                                PID:2320
                                                                              • C:\32788R22FWJFW\NirCmd.3XE
                                                                                NIRCMD CMDWAIT 9000 EXEC HIDE PEV -k CSCRIPT.3XE
                                                                                5⤵
                                                                                  PID:1932
                                                                                • C:\32788R22FWJFW\CSCRIPT.3XE
                                                                                  CSCRIPT //NOLOGO //E:VBSCRIPT //B //T:08 av.vbs
                                                                                  5⤵
                                                                                    PID:2520
                                                                                  • C:\32788R22FWJFW\pev.3XE
                                                                                    PEV -k NIRCMD.3XE
                                                                                    5⤵
                                                                                      PID:1644
                                                                                    • C:\32788R22FWJFW\swreg.3XE
                                                                                      SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RESET /Q
                                                                                      5⤵
                                                                                        PID:1792
                                                                                      • C:\32788R22FWJFW\swreg.3XE
                                                                                        SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RO:F /RA:F /Q
                                                                                        5⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2388
                                                                                      • C:\32788R22FWJFW\grep.3XE
                                                                                        GREP -Fsf AVBlack resident.txt
                                                                                        5⤵
                                                                                          PID:1828
                                                                                        • C:\32788R22FWJFW\grep.3XE
                                                                                          GREP -Fivf AVWhite resident.txt
                                                                                          5⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:324
                                                                                        • C:\32788R22FWJFW\grep.3XE
                                                                                          GREP -E "^(AV|SP): .*\*Enabled/"
                                                                                          5⤵
                                                                                            PID:888
                                                                                          • C:\32788R22FWJFW\pev.3XE
                                                                                            PEV -k * -preg"\\((ntvdm|teatimer[^\\]*|ad-watch[^\\]*|SZServer|StopZilla[^\\]*|userinit|procmon|txp1atform|SonndMan|ANDRE|TOLO|jalang|jalangkung|jantungan|DOSEN|C3W3K4MPUS)\.exe)$"
                                                                                            5⤵
                                                                                              PID:1280
                                                                                            • C:\32788R22FWJFW\grep.3XE
                                                                                              GREP -Fx "REGEDIT4" Fin.dat
                                                                                              5⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2556
                                                                                            • C:\32788R22FWJFW\grep.3XE
                                                                                              GREP -ix "FileName=[-[:alnum:]@_.]*" FileName
                                                                                              5⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:824
                                                                                            • C:\32788R22FWJFW\grep.3XE
                                                                                              GREP -ivx ComboFix DirName00
                                                                                              5⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1608
                                                                                            • C:\32788R22FWJFW\grep.3XE
                                                                                              GREP -Fisqx "._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82" DirName01
                                                                                              5⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2336
                                                                                            • C:\32788R22FWJFW\pev.3XE
                                                                                              PEV UZIP "License\streamtools.zip" License
                                                                                              5⤵
                                                                                                PID:2968
                                                                                              • C:\32788R22FWJFW\grep.3XE
                                                                                                GREP -Eisq "=.\/uninstall| .\/uninstall. | .\/uninstall.$" sfx.cmd
                                                                                                5⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1712
                                                                                              • C:\32788R22FWJFW\pev.3XE
                                                                                                PEV -rtf -s=0 "C:\Windows\erdnt\Hiv-backup\*"
                                                                                                5⤵
                                                                                                  PID:2700
                                                                                                • C:\32788R22FWJFW\pev.3XE
                                                                                                  PEV -k SWSC.3XE
                                                                                                  5⤵
                                                                                                    PID:2268
                                                                                                  • C:\32788R22FWJFW\swreg.3XE
                                                                                                    SWREG ADD "HKLM\Software\Swearware" /V LastDir /D "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82"
                                                                                                    5⤵
                                                                                                      PID:3032
                                                                                                    • C:\32788R22FWJFW\hidec.3XE
                                                                                                      HIDEC "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30165.3XE" /F:OFF /D /C C:\Start_.cmd
                                                                                                      5⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1692
                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30165.3XE
                                                                                                        "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30165.3XE" /F:OFF /D /C C:\Start_.cmd
                                                                                                        6⤵
                                                                                                          PID:1564
                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                            ATTRIB -H -S "C:\32788R22FWJFW\*"
                                                                                                            7⤵
                                                                                                            • Drops desktop.ini file(s)
                                                                                                            • Views/modifies file attributes
                                                                                                            PID:2872
                                                                                                          • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30165.3XE
                                                                                                            "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30165.3XE" /k c.bat
                                                                                                            7⤵
                                                                                                            • Drops desktop.ini file(s)
                                                                                                            • Drops file in Windows directory
                                                                                                            PID:2764
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              CHCP.com 1252
                                                                                                              8⤵
                                                                                                                PID:1104
                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\pev.3XE
                                                                                                                PEV RIMPORT EXE.reg
                                                                                                                8⤵
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                • Impair Defenses: Safe Mode Boot
                                                                                                                • Modifies system executable filetype association
                                                                                                                • Adds Run key to start application
                                                                                                                • Indicator Removal: Clear Persistence
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Modifies registry class
                                                                                                                • System policy modification
                                                                                                                PID:1488
                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                SWREG QUERY "hklm\system\select" /v "current"
                                                                                                                8⤵
                                                                                                                  PID:2672
                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\sed.3XE
                                                                                                                  SED -r "/.* /!d; s//00/; s/^[0-9]*(...) .*/@SET ControlSet=ControlSet\1\nSET CS000=HKEY_LOCAL_MACHINE\\system\\ControlSet\1\\Services/"
                                                                                                                  8⤵
                                                                                                                    PID:2636
                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\ATTRIB.3XE
                                                                                                                    ATTRIB +S "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82"
                                                                                                                    8⤵
                                                                                                                      PID:1612
                                                                                                                    • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                      GREP -sqx "REGEDIT4" Fin.dat
                                                                                                                      8⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2928
                                                                                                                    • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\ATTRIB.3XE
                                                                                                                      ATTRIB +R *.3XE
                                                                                                                      8⤵
                                                                                                                        PID:2432
                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\NirCmdC.3XE
                                                                                                                        NIRCMDC EXEC SHOW "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30165.3XE" /C " ECHO.&&ECHO.-------- ~%CurrDate.yyyy-MM-dd% - ~%CurrTime.HH:mm:ss% -------------&&ECHO."
                                                                                                                        8⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2952
                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30165.3XE
                                                                                                                          "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30165.3XE" /C " ECHO.&&ECHO.-------- 2024-11-19 - 15:30:07 -------------&&ECHO."
                                                                                                                          9⤵
                                                                                                                            PID:1716
                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                          SWREG QUERY "HKCU\Console_combofixbackup"
                                                                                                                          8⤵
                                                                                                                            PID:2040
                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                            CHCP.com 1252
                                                                                                                            8⤵
                                                                                                                              PID:1332
                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                              GREP -isq "09$" NlsLanguageDefault
                                                                                                                              8⤵
                                                                                                                                PID:2028
                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                GREP -Eisq "=.\/uninstall.| .\/uninstall. | .\/uninstall.$" sfx.cmd
                                                                                                                                8⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:440
                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swxcacls.3XE
                                                                                                                                SWXCACLS PV.3XE /P /GE:F /Q
                                                                                                                                8⤵
                                                                                                                                  PID:1084
                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\PV.3XE
                                                                                                                                  PV -m CF30165.3XE
                                                                                                                                  8⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:588
                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\sed.3XE
                                                                                                                                  SED -R "1,3d; /[4-9]\S{7}\s*\d* .:\\|\\detoured.dll$/Id; /.*(.:\\.*)/I!d; s//\1/" ForeignC00
                                                                                                                                  8⤵
                                                                                                                                    PID:568
                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                    GREP -Fixvf ForeignWht ForeignC01
                                                                                                                                    8⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2068
                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                    SWREG QUERY HKLM\Software\Swearware /V "CF_Update"
                                                                                                                                    8⤵
                                                                                                                                      PID:600
                                                                                                                                    • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                      SWREG DELETE HKLM\Software\Swearware /V "CF_Update"
                                                                                                                                      8⤵
                                                                                                                                        PID:936
                                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\hidec.3XE
                                                                                                                                        HIDEC PING -n 1 -w 250 127.0.0.1
                                                                                                                                        8⤵
                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                        PID:2136
                                                                                                                                        • C:\Windows\SysWOW64\PING.exe
                                                                                                                                          PING -n 1 -w 250 127.0.0.1
                                                                                                                                          9⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                          • Runs ping.exe
                                                                                                                                          PID:3008
                                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\PV.3XE
                                                                                                                                        PV -d2000 -xa PING.3XE
                                                                                                                                        8⤵
                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                        PID:1244
                                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\PV.3XE
                                                                                                                                        PV -m PING.3XE
                                                                                                                                        8⤵
                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                        PID:880
                                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\sed.3XE
                                                                                                                                        SED -R "1,3d; /((10|4)00000|[4-9]\S{7})\s*\d* .:\\/d; /C:\\Windows\\SysWow64\\(xpsp2res|Normaliz|urlmon|odbcint|imon)\.dll/Id; /\)|\\/I!d; s/.*(.:\\)/\1/" pingtest00
                                                                                                                                        8⤵
                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                        PID:2772
                                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                        GREP -Fixf ForeignWht pingtest01
                                                                                                                                        8⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                        PID:2744
                                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\pev.3XE
                                                                                                                                        PEV -k PING.3XE
                                                                                                                                        8⤵
                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                        PID:1272
                                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\PING.3XE
                                                                                                                                        PING -n 2 -w 500 google.com
                                                                                                                                        8⤵
                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                        PID:3000
                                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                        SWREG QUERY "HKLM\SOFTWARE\swearware\Backup\Winsock2"
                                                                                                                                        8⤵
                                                                                                                                          PID:680
                                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                          SWREG ACL "HKLM\SOFTWARE\swearware" /RESET
                                                                                                                                          8⤵
                                                                                                                                            PID:1780
                                                                                                                                          • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                            SWREG COPY "HKLM\SYSTEM\CurrentControlSet\Services\WinSock2" "HKLM\SOFTWARE\swearware\Backup\Winsock2" /s
                                                                                                                                            8⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2448
                                                                                                                                          • C:\Windows\system32\sort.exe
                                                                                                                                            SORT /M 65536 Mirrors00 /O Mirrors
                                                                                                                                            8⤵
                                                                                                                                              PID:1664
                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\ComboFix-Download.3XE
                                                                                                                                              ComboFix-Download -s --connect-timeout 5 -A "cfcurl/7.15.3 (i586-pc-mingw32msvc) libcurl/7.15.3 zlib/1.2.2" -H "Host: download.bleepingcomputer.com" http://208.43.120.24/sUBs/version.txt
                                                                                                                                              8⤵
                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                              PID:2444
                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                              GREP "^[0-9][0-9].* [0-9]"
                                                                                                                                              8⤵
                                                                                                                                                PID:856
                                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\ComboFix-Download.3XE
                                                                                                                                                ComboFix-Download -s --connect-timeout 5 -A "cfcurl/7.15.3 (i586-pc-mingw32msvc) libcurl/7.15.3 zlib/1.2.2" -H "Host: www.compendiate.net" http://69.6.236.82/sUBs/ComboFix.exe/version.txt
                                                                                                                                                8⤵
                                                                                                                                                  PID:836
                                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                                  GREP "^[0-9][0-9].* [0-9]"
                                                                                                                                                  8⤵
                                                                                                                                                    PID:620
                                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                    SWREG QUERY HKLM\Software\Swearware /v 44617465204572726F72
                                                                                                                                                    8⤵
                                                                                                                                                      PID:2296
                                                                                                                                                    • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\pev.3XE
                                                                                                                                                      PEV -rtf -dg15 .\md5sum.pif
                                                                                                                                                      8⤵
                                                                                                                                                        PID:1648
                                                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                        SWREG ADD "HKLM\Software\Swearware" /v 44617465204572726F72 /d "idk"
                                                                                                                                                        8⤵
                                                                                                                                                          PID:1740
                                                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\NircmdB.exe
                                                                                                                                                          NircmdB.exe QBOXCOMTOP "Current date is ~%CurrDate.yyyy-MM-dd%. ComboFix has expired~n~nClick 'Yes' to run in REDUCED FUNCTIONALITY mode~n~nClick 'No' to exit" "Version_18-08-08.01" "" FILLDELETE ABORTB
                                                                                                                                                          8⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1644
                                                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\pev.3XE
                                                                                                                                                          PEV -rtf -dl10 .\md5sum.pif
                                                                                                                                                          8⤵
                                                                                                                                                            PID:2464
                                                                                                                                                          • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                                            GREP -sq "FIXLSP.bat" "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
                                                                                                                                                            8⤵
                                                                                                                                                              PID:1768
                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\pev.3XE
                                                                                                                                                              PEV -k C:\Windows\* and { SWXCACLS.exe or SWSC.exe or PEV.exe or sed.exe or grep.exe or zip.exe or mbr.exe } or C:\Windows\system32\SWSC.exe
                                                                                                                                                              8⤵
                                                                                                                                                                PID:1360
                                                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                                                GREP -Esq "FIXLSP.bat|C.o.m.b.o.F.i.x" "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
                                                                                                                                                                8⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1280
                                                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\NirCmd.3XE
                                                                                                                                                                NIRCMD WIN HIDE TITLE .
                                                                                                                                                                8⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1804
                                                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\NirCmd.3XE
                                                                                                                                                                NIRCMD WIN HIDE ITITLE ": ."
                                                                                                                                                                8⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:2064
                                                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\PEV.exe
                                                                                                                                                                PEV.exe -k { *.3XE or NIRCMD.exe } and not C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30165.3XE
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:824
                                                                                                                                                                • C:\Windows\regedit.exe
                                                                                                                                                                  C:\Windows\regedit.exe /s "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\fin.dat"
                                                                                                                                                                  8⤵
                                                                                                                                                                  • Impair Defenses: Safe Mode Boot
                                                                                                                                                                  • Runs regedit.exe
                                                                                                                                                                  PID:1684
                                                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                  SWREG copy "hkcu\control panel\international_combofixbackup" "hkcu\control panel\international" /s
                                                                                                                                                                  8⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies Control Panel
                                                                                                                                                                  PID:2336
                                                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                  SWREG copy "hku\.default\control panel\international_combofixbackup" "hku\.default\control panel\international" /s
                                                                                                                                                                  8⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                  PID:236
                                                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                  SWREG COPY "hkcu\console_combofixbackup" "hkcu\console" /s
                                                                                                                                                                  8⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2592
                                                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                  SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /RESET /Q
                                                                                                                                                                  8⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1604
                                                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                  SWREG DELETE "hkcu\console_combofixbackup"
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:2716
                                                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\NircmdB.exe
                                                                                                                                                                    NircmdB.exe SYSREFRESH INTL
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:2144
                                                                                                                                                                    • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                      SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RESET /Q
                                                                                                                                                                      8⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:2864
                                                                                                                                                                    • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                      SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RO:F /RA:F /Q
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:3044
                                                                                                                                                                      • C:\Windows\NIRCMD.exe
                                                                                                                                                                        NIRCMD.exe CMDWAIT 5000 EXECMD DEL /A/F C:\Windows\NIRCMD.exe
                                                                                                                                                                        8⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2844
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          cmd.exe /c DEL /A/F C:\Windows\NIRCMD.exe
                                                                                                                                                                          9⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:3032
                                                                                                                                                                      • C:\Windows\NIRCMD.exe
                                                                                                                                                                        NIRCMD.exe EXECMD "RD /S/Q "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\"
                                                                                                                                                                        8⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2788
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          cmd.exe /c "RD /S/Q "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\"
                                                                                                                                                                          9⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:2700
                                                                                                                                                                      • C:\Windows\NIRCMD.exe
                                                                                                                                                                        NIRCMD.exe WIN CLOSE CLASS #32770
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:1036
                                                                                                                                                                  • C:\32788R22FWJFW\pev.3XE
                                                                                                                                                                    PEV WAIT 2000
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:1260
                                                                                                                                                              • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:2896
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  PID:2888
                                                                                                                                                            • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                              "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                                                                                                                                                              1⤵
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:2668

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                            Reconnaissance

                                                                                                                                                            Resource Development

                                                                                                                                                            Initial Access

                                                                                                                                                            Execution

                                                                                                                                                            Persistence

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            3
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            2
                                                                                                                                                            T1547.001

                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                            1
                                                                                                                                                            T1547.004

                                                                                                                                                            Create or Modify System Process

                                                                                                                                                            1
                                                                                                                                                            T1543

                                                                                                                                                            Windows Service

                                                                                                                                                            1
                                                                                                                                                            T1543.003

                                                                                                                                                            Event Triggered Execution

                                                                                                                                                            3
                                                                                                                                                            T1546

                                                                                                                                                            Change Default File Association

                                                                                                                                                            1
                                                                                                                                                            T1546.001

                                                                                                                                                            Component Object Model Hijacking

                                                                                                                                                            1
                                                                                                                                                            T1546.015

                                                                                                                                                            Image File Execution Options Injection

                                                                                                                                                            1
                                                                                                                                                            T1546.012

                                                                                                                                                            Server Software Component

                                                                                                                                                            1
                                                                                                                                                            T1505

                                                                                                                                                            Terminal Services DLL

                                                                                                                                                            1
                                                                                                                                                            T1505.005

                                                                                                                                                            Privilege Escalation

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            3
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            2
                                                                                                                                                            T1547.001

                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                            1
                                                                                                                                                            T1547.004

                                                                                                                                                            Create or Modify System Process

                                                                                                                                                            1
                                                                                                                                                            T1543

                                                                                                                                                            Windows Service

                                                                                                                                                            1
                                                                                                                                                            T1543.003

                                                                                                                                                            Event Triggered Execution

                                                                                                                                                            3
                                                                                                                                                            T1546

                                                                                                                                                            Change Default File Association

                                                                                                                                                            1
                                                                                                                                                            T1546.001

                                                                                                                                                            Component Object Model Hijacking

                                                                                                                                                            1
                                                                                                                                                            T1546.015

                                                                                                                                                            Image File Execution Options Injection

                                                                                                                                                            1
                                                                                                                                                            T1546.012

                                                                                                                                                            Defense Evasion

                                                                                                                                                            Hide Artifacts

                                                                                                                                                            1
                                                                                                                                                            T1564

                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                            1
                                                                                                                                                            T1564.001

                                                                                                                                                            Impair Defenses

                                                                                                                                                            1
                                                                                                                                                            T1562

                                                                                                                                                            Safe Mode Boot

                                                                                                                                                            1
                                                                                                                                                            T1562.009

                                                                                                                                                            Indicator Removal

                                                                                                                                                            2
                                                                                                                                                            T1070

                                                                                                                                                            Clear Persistence

                                                                                                                                                            1
                                                                                                                                                            T1070.009

                                                                                                                                                            File Deletion

                                                                                                                                                            1
                                                                                                                                                            T1070.004

                                                                                                                                                            Modify Registry

                                                                                                                                                            6
                                                                                                                                                            T1112

                                                                                                                                                            Credential Access

                                                                                                                                                            Discovery

                                                                                                                                                            Query Registry

                                                                                                                                                            1
                                                                                                                                                            T1012

                                                                                                                                                            Remote System Discovery

                                                                                                                                                            1
                                                                                                                                                            T1018

                                                                                                                                                            System Information Discovery

                                                                                                                                                            2
                                                                                                                                                            T1082

                                                                                                                                                            System Location Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614

                                                                                                                                                            System Language Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614.001

                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                            1
                                                                                                                                                            T1016

                                                                                                                                                            Internet Connection Discovery

                                                                                                                                                            1
                                                                                                                                                            T1016.001

                                                                                                                                                            Lateral Movement

                                                                                                                                                            Collection

                                                                                                                                                            Command and Control

                                                                                                                                                            Exfiltration

                                                                                                                                                            Impact

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CCS.bat
                                                                                                                                                              Filesize

                                                                                                                                                              94B

                                                                                                                                                              MD5

                                                                                                                                                              fddb66186804dc1a836ee7b288aec224

                                                                                                                                                              SHA1

                                                                                                                                                              1570fd4102cb3d5940e8527e2efaa23c7367cd8e

                                                                                                                                                              SHA256

                                                                                                                                                              64ae6e396d7c15f8101e74d99009e3301898105d4082392415a3afb824298c7c

                                                                                                                                                              SHA512

                                                                                                                                                              7edc20e77458f0ffe5a6ff4cb4a214ef3f64218de6c07a3ee0d6b6f9a66fff57598f6b35c66b4cdd8b71b4053c781e90ece626187dd6f6adf1da56756a3dfd31

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\N_\16690
                                                                                                                                                              Filesize

                                                                                                                                                              24B

                                                                                                                                                              MD5

                                                                                                                                                              79c644256de6427ed74aa9225299685e

                                                                                                                                                              SHA1

                                                                                                                                                              99bd5a2cec702cc8f0d38828bee63739ee4718dc

                                                                                                                                                              SHA256

                                                                                                                                                              d76c2daf80bc9550db8285aa715c787ee2238f2d96777fdf52f3dc96c07ef55c

                                                                                                                                                              SHA512

                                                                                                                                                              a13f8178160689ad18a1bdb1704dd5ea9cd173e2d2e52ea081d0063d95425e54f83f7f0018fb57e6e9a65aedbee6547670d4a4e3035469b31252a5e1c3c77e3e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\N_\pingtest
                                                                                                                                                              Filesize

                                                                                                                                                              66B

                                                                                                                                                              MD5

                                                                                                                                                              955de0e7ae154a12e0eb81dc30ed0905

                                                                                                                                                              SHA1

                                                                                                                                                              136138d125ccd2cf5529b40e207d673f78b159c3

                                                                                                                                                              SHA256

                                                                                                                                                              87eebb19c6607ebbe65b6b307c06ce4c8464ee0aa7f0e1bc7335e374a4a6b9c6

                                                                                                                                                              SHA512

                                                                                                                                                              4cd99739def158c2f30440e644961395cbf4b754d618d21df4d856682aee0fe2487d3ac35d7b699e57f6ca5debbdd5469535a358ab692bca53b936852cb341d1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\en-US\PING.3XE.mui
                                                                                                                                                              Filesize

                                                                                                                                                              9KB

                                                                                                                                                              MD5

                                                                                                                                                              5b5d34c87292116639cfa3451fb6e0d9

                                                                                                                                                              SHA1

                                                                                                                                                              a62b1a486f27fcabe7497f61772d68f75d4c5cc2

                                                                                                                                                              SHA256

                                                                                                                                                              468469b56310fc8bb26e9ec0b3ae7c0b30f7c25470f9948d46323cfc901907e3

                                                                                                                                                              SHA512

                                                                                                                                                              b9bdf0270aadf74fe667ab987f15ec72aa61f951a7dfca535c07f19f0e21e82097983b59a8e424364d7762b192e632390fd8d832cffa7eaad496aab7d3b7597a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\en-US\REGT.3XE.mui
                                                                                                                                                              Filesize

                                                                                                                                                              44KB

                                                                                                                                                              MD5

                                                                                                                                                              f3a500fb9c16ddf7af12cf3eff0716e2

                                                                                                                                                              SHA1

                                                                                                                                                              35dead0077a4fc25612d90f95776af81c3d96dc3

                                                                                                                                                              SHA256

                                                                                                                                                              12434c2df267a3e4d348c3e823d89c212de4d398447668bb3544f270f669864a

                                                                                                                                                              SHA512

                                                                                                                                                              c0438a60f8a5dc6df0cc1ed19262b3fd9869a661bec7e7aaf7befa04c2192476765be4bdc84ed8668ad04f8fceb20361afb070c68a1f6eacfc8ba9d83219f5a2

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\en-US\ROUTE.3XE.mui
                                                                                                                                                              Filesize

                                                                                                                                                              12KB

                                                                                                                                                              MD5

                                                                                                                                                              3274f791d4cc2cfe4dec805403ad10e3

                                                                                                                                                              SHA1

                                                                                                                                                              99dfdd6b292efd86b5810e6354182b2db0c78f41

                                                                                                                                                              SHA256

                                                                                                                                                              78d9c7e42a14f2c5b377394ceedf7f9a77d16df43434eaecc0ac5cfc01cbc121

                                                                                                                                                              SHA512

                                                                                                                                                              e6ed28767307160b43695276b4347a2c7064e838ca2038aad4dd6fe5d2bf3007489e514d73aa70a8a9012e2a851d183c72f753ff1c6e64e0cf30f915d3efcb0a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\CHCP.bat
                                                                                                                                                              Filesize

                                                                                                                                                              19B

                                                                                                                                                              MD5

                                                                                                                                                              d875037251b54bfeb674f591350d3b23

                                                                                                                                                              SHA1

                                                                                                                                                              973b66e72611b62f6d106c7f729605f0a30eb408

                                                                                                                                                              SHA256

                                                                                                                                                              14e50a7afb6646e7c82a3b3beae6d490be5adcaa7b9fda58779e2314da38d6d6

                                                                                                                                                              SHA512

                                                                                                                                                              a660e1e8ec7b9fc56f034541a58c7a873c12b40f7aa62d987f9d7030365f13a57b4420589eb7a0a56f4d23112b7003e9647866329d62516aad95e823560c9b1e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\CSCRIPT.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              152KB

                                                                                                                                                              MD5

                                                                                                                                                              791af7743252d0cd10a30d61e5bc1f8e

                                                                                                                                                              SHA1

                                                                                                                                                              70096a77e202cf9f30c064956f36d14bcbd8f7bb

                                                                                                                                                              SHA256

                                                                                                                                                              e34910c8c4f2051b1b87f80e9b389dfe3583bb3e4da909bb2544f22c2d92cf15

                                                                                                                                                              SHA512

                                                                                                                                                              d564f20748189de62525d2c0d4a199a272e3b273a38bd2ccd0bd7f9141f118eae08223b2a0739cd9bdf73234a0f0fb3566eaf88884462e494d44617bd9ac3ccb

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\EN-US\CF30165.3XE.mui
                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                              MD5

                                                                                                                                                              84fa403e67ccf1a031faeb39a091a7c0

                                                                                                                                                              SHA1

                                                                                                                                                              e22bd0cc50f20d0b1e4f0283f8cf9d54a8ca99a8

                                                                                                                                                              SHA256

                                                                                                                                                              6aaf47281e52b184d6e58cac0822dae59eb719f2af63360ecf645e1255e8644b

                                                                                                                                                              SHA512

                                                                                                                                                              d47ded5cb06b6bae3a83432f2353059a97b2c0c4b161c150bdb510c7744b55b0686738d4d37861aa4d0acce697ee5cabf521ce7f926399b046b42cc4e8494827

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\ERDNT.E_E
                                                                                                                                                              Filesize

                                                                                                                                                              159KB

                                                                                                                                                              MD5

                                                                                                                                                              89afdd29832aa923926bdd4b5f5243d5

                                                                                                                                                              SHA1

                                                                                                                                                              4ee93ef072559c5184236718fe07485bc5ddbe2d

                                                                                                                                                              SHA256

                                                                                                                                                              a559f249fc0e56bc925609773f6cc9cd1826bf70916be1d6370ce4707a6dfd84

                                                                                                                                                              SHA512

                                                                                                                                                              289e9be8566e7b1713c4ed0fa9be509b7d7dd6fe5bab6a7cee7a338f2aeab040419f1fbd032ba97b984691144b54ee8089a6e964ea8633bfa56539010e29a812

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\ERDNTDOS.LOC
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              f9650a5c954d2a9f8844de99e8577f93

                                                                                                                                                              SHA1

                                                                                                                                                              791a85bf67f5dc3734453808bd3013a866b970ba

                                                                                                                                                              SHA256

                                                                                                                                                              3c3ba112731c697b8700de546195c4a02f96f4fe28d39a75551f932985e0c15e

                                                                                                                                                              SHA512

                                                                                                                                                              0b68eb79b37504586da9c7776594c6ebb0251539b7172a2d631d9cacf54d00445693bcacc7f6f15c9902f79fd3bc22a2274575df9d4db129ee0d856b41ed8ba2

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\ERDNTWIN.LOC
                                                                                                                                                              Filesize

                                                                                                                                                              3KB

                                                                                                                                                              MD5

                                                                                                                                                              388d865d44ee8069df8bd12efedadb3e

                                                                                                                                                              SHA1

                                                                                                                                                              e59a20c9c5de1164a16b23014fc3b6a6cf385d14

                                                                                                                                                              SHA256

                                                                                                                                                              9bdfefd45997b94cfe323d4ce4209941a08061ea364bb969a9d3afb418b6fe61

                                                                                                                                                              SHA512

                                                                                                                                                              e3db6a26c55ce3f141565afc5831a2ee7a63741838b084dcf8cadf500b2b2fbeaccf0e417c996c7a10a4de78ae4d2f423d3043c37025049b8cf154cded4623cd

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\ERUNT.LOC
                                                                                                                                                              Filesize

                                                                                                                                                              3KB

                                                                                                                                                              MD5

                                                                                                                                                              02187b1b6f37b3d0030791c802a6174c

                                                                                                                                                              SHA1

                                                                                                                                                              b0f8330dcca6d6f4426dcce8fe8705d12f06df1d

                                                                                                                                                              SHA256

                                                                                                                                                              fb96fb9575fad8df03df5e48b7ec0bd9a151ebabc9dd949867b087ea925f33da

                                                                                                                                                              SHA512

                                                                                                                                                              b8da90647afa78c7649a198556529567f65d59206e686d64c98e13496295a75580e89dbc18c92eb9ef36ab2bcc414d35af9b2cfb35417f7f4afd622fc7f248d2

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\EXE.reg
                                                                                                                                                              Filesize

                                                                                                                                                              17KB

                                                                                                                                                              MD5

                                                                                                                                                              6029d80d8e934047f4680d425878f8df

                                                                                                                                                              SHA1

                                                                                                                                                              62cbc0902c2159f453776c634e8137bd9da756b5

                                                                                                                                                              SHA256

                                                                                                                                                              dac913a8c06902546d4ebb264b293dcf0fbeb566657b5fb769c9f22448d77847

                                                                                                                                                              SHA512

                                                                                                                                                              38450b14163805f2385fa9ed2a7aff49c81fdfa8c5a41b16862d7d498e1f8bbeeecc977dd2b94c8e4f621ad6d5619b49d7b9c0dd24fd8662b928df5128d0f822

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\License\NCMD.CFXXE
                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              MD5

                                                                                                                                                              43c7228b35d17db840f2254b92e00d8b

                                                                                                                                                              SHA1

                                                                                                                                                              888325a0429e5b7b8229daa058c7cdacf7db2c0d

                                                                                                                                                              SHA256

                                                                                                                                                              8ca7e8f9dc2906b78842c61a52b0a95fd744fa2e76de470588f821cb88e21e45

                                                                                                                                                              SHA512

                                                                                                                                                              f9fbc9a9cf73a226f08ff112c8959419bb1893300e5e81110b63d4926628aa4bbe88d1f6a2b1e6a3ee04e9b903d66c8664c98c9e46aa2ddb8117bfdc8eefdeeb

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\License\UnxUtilsDist.com
                                                                                                                                                              Filesize

                                                                                                                                                              144B

                                                                                                                                                              MD5

                                                                                                                                                              306c4a0f4ecea81cd27076b35b2b0ceb

                                                                                                                                                              SHA1

                                                                                                                                                              9f1f11b86d04f43ad0cc41b46795071efd579d40

                                                                                                                                                              SHA256

                                                                                                                                                              778eaf3129c871b4ff32eba227166711a47fca8b458f34f9198adbb70ee3404e

                                                                                                                                                              SHA512

                                                                                                                                                              223c53f24de764ad98de9b651a0eaeb01ebde1ebcc16c2c59bd803d751c5fa2acd1395e3cd259f9f215d8ce9a26159391e6dba356fde9360d7cf67aaa3262873

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\License\UnxUtilsDist.pif
                                                                                                                                                              Filesize

                                                                                                                                                              388B

                                                                                                                                                              MD5

                                                                                                                                                              128128e7a82b1cf02e92d2166a37e000

                                                                                                                                                              SHA1

                                                                                                                                                              8bddc1272c15f9f9560ed8cd13d91b9e2b040201

                                                                                                                                                              SHA256

                                                                                                                                                              18daa45bf4a05e023dcbb3e5c7c410be4750f7ff81d181ff59a080cd3af6e92f

                                                                                                                                                              SHA512

                                                                                                                                                              74df10f7593dbe0e86b21936c8ee47ee278672865d73ff33c529e4dc4e846a8b2a02ff51504ca5d4bdc65525542ee20406e98dcedb3ffa47f708531fd4ce2274

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\Nirscript.dat
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              ee0eede328eab3072e18d2836f0b5733

                                                                                                                                                              SHA1

                                                                                                                                                              f7f0d25e92e3d334ae709ec86fe3e038ec397647

                                                                                                                                                              SHA256

                                                                                                                                                              b8af13a08015ab1b267d6b6b6b0b317355c6288457b5d9ef7f9995937a666b17

                                                                                                                                                              SHA512

                                                                                                                                                              5a0317bb3c9d0d82c25aacbfe591e96d0d666879ce13ec6b55c016afa2573caf343da5108a62bcf1c2890f7f4f06966bac4ecbebb6eb03dd34ab39dc11bb3190

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\Start_dat
                                                                                                                                                              Filesize

                                                                                                                                                              2B

                                                                                                                                                              MD5

                                                                                                                                                              81051bcc2cf1bedf378224b0a93e2877

                                                                                                                                                              SHA1

                                                                                                                                                              ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                                                                                                              SHA256

                                                                                                                                                              7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                                                                                                              SHA512

                                                                                                                                                              1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\TempPath.bat
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              75b33a3d7d7eaba0dc6d13f8ba6f825e

                                                                                                                                                              SHA1

                                                                                                                                                              67644b09419b002ae121680689bbb2fe81aea2b8

                                                                                                                                                              SHA256

                                                                                                                                                              4d3d7317f2f032264dafa4f2a7a83cb7c6543fa2e2ed2c6d95e1a3ff6c1dd666

                                                                                                                                                              SHA512

                                                                                                                                                              16dc56acafc7bb6456a743979de309c5c0651edce0efc17fcdc814bc928a7f17760ce2fa664b4b49e1d9a30efb218eefa985d7ece2e68b843ef17dc1b1b59c7e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\Vista.krl
                                                                                                                                                              Filesize

                                                                                                                                                              6B

                                                                                                                                                              MD5

                                                                                                                                                              486da0e231191ae975f6d2b4d14f9d39

                                                                                                                                                              SHA1

                                                                                                                                                              93884c615df1514c050d52104a7dfd045f8b6760

                                                                                                                                                              SHA256

                                                                                                                                                              03db0edf70b6e6a3601107fa8f4fa1b1044fc83f65927c0b3b3374c041826b61

                                                                                                                                                              SHA512

                                                                                                                                                              6fea149031c39c9a2a17e05e6f6f21d20e8cf0e384e975448566295b81d95b7d5cc448cd9e56e809c85d3f709237f616e329e469c482559f4c606cd4b961651a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\fl0.bat
                                                                                                                                                              Filesize

                                                                                                                                                              10KB

                                                                                                                                                              MD5

                                                                                                                                                              7d1dc643c3f97f6e396331035b704ab6

                                                                                                                                                              SHA1

                                                                                                                                                              9adfe7d1c195ab984a9cefdeec49bd39c68d084c

                                                                                                                                                              SHA256

                                                                                                                                                              ddc809fba49b8ec969850027d265f6c5aa6d195385f8ed3fe38a66fe0bbbaad4

                                                                                                                                                              SHA512

                                                                                                                                                              56a85cbfaf4ef41854633853a0e7af4ed7a754c9ed36b94be92d41c690b9d8d73704a92e3becc083130d92aea0591c5eb67242c1348c19e14fd693b8584260d2

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\gsar.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              15KB

                                                                                                                                                              MD5

                                                                                                                                                              d6a005f8facff88e260688ddb7ae00c1

                                                                                                                                                              SHA1

                                                                                                                                                              4e22c7a9fc89587addc4d5ddab71199e08ea5b50

                                                                                                                                                              SHA256

                                                                                                                                                              0ff5348012225418d31ded6d2eb43f081ad8f7035b24e20d3e158ba320a42d49

                                                                                                                                                              SHA512

                                                                                                                                                              7e3ba326c7c6a03cebece8e28cfdc75f89a9a541b07623b77a5825982c2c612477a0adc64eb29afea2faf49a211361fff9009b3979805514fd99163e218b18e7

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\iexplore.exe
                                                                                                                                                              Filesize

                                                                                                                                                              59KB

                                                                                                                                                              MD5

                                                                                                                                                              753bc16326fee4a421acb636ccd602f4

                                                                                                                                                              SHA1

                                                                                                                                                              9cca347a4659301f89105a5433539e9cad150c69

                                                                                                                                                              SHA256

                                                                                                                                                              24ca5ceb560f68b37c7cd4e548303a3617bb230c3b7478fe61ae804b8f128e4a

                                                                                                                                                              SHA512

                                                                                                                                                              b7924b660dc5e786bcd5cc5df160c29aaf48c88365940a9fbb60c77aa559e60bd5a7033e5edce4577fbad02f52582d65afbdbd22223cbe13df13cfbd9e4241ee

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\setpath_N.cmd
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              5b4f9947085428bdafd5f5f13fc61e5b

                                                                                                                                                              SHA1

                                                                                                                                                              0a097d99dd988407be0b0b0776ec5c029a47a27c

                                                                                                                                                              SHA256

                                                                                                                                                              a6b85f67b1ff30eaf6893e757ffbba785de0e859afc4362eee9318b63c240cdf

                                                                                                                                                              SHA512

                                                                                                                                                              c61badeafddb9fe8411dc7130c905b615333de8ed576874300dafac9144771d099fe59e33e642987e1621d18f8a0dccd69e763451d33a609d0a8f325b5908c77

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\sfx.cmd
                                                                                                                                                              Filesize

                                                                                                                                                              14B

                                                                                                                                                              MD5

                                                                                                                                                              954a44456e60a31dba59ec10e0868f5c

                                                                                                                                                              SHA1

                                                                                                                                                              7a3101cf946e0d72c3c247547dcc4694d9717260

                                                                                                                                                              SHA256

                                                                                                                                                              a67745e34ed24fc8f769632758dc152c058a81ab7d171ac9c0d8f4a47dd569b9

                                                                                                                                                              SHA512

                                                                                                                                                              82799111dec1bee2bd526f743eda584d23691728dd474800e682938ddaa1765d3a016ca44864bb21ce1739ef17ceea7106e1a19607a10943e34301ac8ba9ce32

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\swreg.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              506KB

                                                                                                                                                              MD5

                                                                                                                                                              a46842c9b0c567a5a9584e83a163560c

                                                                                                                                                              SHA1

                                                                                                                                                              7c01e92196c1fa584f05b40e0ad7952525b00686

                                                                                                                                                              SHA256

                                                                                                                                                              715c24bf2bfdfb50c5b9bff41b7cc2728d6986af97edeeb1f1df0c35d673ad98

                                                                                                                                                              SHA512

                                                                                                                                                              b439d97731b364922a2816739389443cee9137dad99556498d68fe2b617f7070a2c9ab00ec59f388fc6b72faba489605688ea3a180899690b42c50b17952e956

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\swsc.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              397KB

                                                                                                                                                              MD5

                                                                                                                                                              0297c72529807322b152f517fdb0a9fc

                                                                                                                                                              SHA1

                                                                                                                                                              2e818e096dded6e01413ff10b5ba0ddb43920b77

                                                                                                                                                              SHA256

                                                                                                                                                              c4d17d7b6c42bca40a313212422add7581192283eb489af9af1b8b6d9cee67e0

                                                                                                                                                              SHA512

                                                                                                                                                              634b4a41bc71a5be39b6962198f19baa63c89887897c2ea47aaf150f27c375ec69d24e61e891442ca9b675ca4bdfd7f5ee0056d99ceb4b8ca6beaaa3f8f2acee

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\swxcacls.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              207KB

                                                                                                                                                              MD5

                                                                                                                                                              b1a9cf0b6f80611d31987c247ec630b4

                                                                                                                                                              SHA1

                                                                                                                                                              7299b3c370254e1e4bade26dc5fec818989d836a

                                                                                                                                                              SHA256

                                                                                                                                                              933756962d8a3530c50072e03af9e0eb0bede3c7af58feda3518240e851071ef

                                                                                                                                                              SHA512

                                                                                                                                                              152e24b5490c3e15ec7cf6db0e6573cd75846be6b1472165d055255a9b74a22d929bf8bef1c3f8e31333577d806d600239dde2dfbb463cc62987bac62706b9e1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.1MB

                                                                                                                                                              MD5

                                                                                                                                                              02bec9d86e4839199a60b334dd650e60

                                                                                                                                                              SHA1

                                                                                                                                                              8f86b49725abfae4c201654f3aa43ec0041cea39

                                                                                                                                                              SHA256

                                                                                                                                                              6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82

                                                                                                                                                              SHA512

                                                                                                                                                              660d932f4b2fe56d175ba3c2823a0501d13e29876766a57bd4df5b345177887b48fb9eedcf0c3929cca509f49a2bb189395e82c2418fa6e8834e0a2f79425243

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\UsysbPP2.xlsm
                                                                                                                                                              Filesize

                                                                                                                                                              17KB

                                                                                                                                                              MD5

                                                                                                                                                              af4d37aad8b34471da588360a43e768a

                                                                                                                                                              SHA1

                                                                                                                                                              83ed64667d4e68ea531b8bcf58aab3ed4a5ca998

                                                                                                                                                              SHA256

                                                                                                                                                              e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1

                                                                                                                                                              SHA512

                                                                                                                                                              74f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nst96D5.tmp\nsProcess.dll
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              MD5

                                                                                                                                                              faa7f034b38e729a983965c04cc70fc1

                                                                                                                                                              SHA1

                                                                                                                                                              df8bda55b498976ea47d25d8a77539b049dab55e

                                                                                                                                                              SHA256

                                                                                                                                                              579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

                                                                                                                                                              SHA512

                                                                                                                                                              7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

                                                                                                                                                              Download Submit

                                                                                                                                                            • \32788R22FWJFW\EN-US\iexplore.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              abc6379205de2618851c4fcbf72112eb

                                                                                                                                                              SHA1

                                                                                                                                                              1ed7b1e965eab56f55efda975f9f7ade95337267

                                                                                                                                                              SHA256

                                                                                                                                                              22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f

                                                                                                                                                              SHA512

                                                                                                                                                              180c7f400dd13092b470e3a91bf02e98ef6247c1193bf349e3710e8d1e9003f3bc9b792bb776eacb746e9c67b3041f2333cc07f28c5f046d59274742230fb7c1

                                                                                                                                                              Download Submit

                                                                                                                                                            • \32788R22FWJFW\ERUNT.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              385KB

                                                                                                                                                              MD5

                                                                                                                                                              5a43a009414d356a018de0f9d3637f3a

                                                                                                                                                              SHA1

                                                                                                                                                              1ab32ff6729c7aea5f3fe37c6f3ee8a1f3ef55f9

                                                                                                                                                              SHA256

                                                                                                                                                              a29dff95b99fb1fb997ebb9baeac450e69348e2fa9b0ebf3b3585fd2f44cd2f8

                                                                                                                                                              SHA512

                                                                                                                                                              97545c4d482a60cb278a24bb80a6f2a5f15716d507203c83beef66dab31554ec9264497609c12461fa77bc1a765062d513a417048027f064b5da9d95a9231a1b

                                                                                                                                                              Download Submit

                                                                                                                                                            • \32788R22FWJFW\pev.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              250KB

                                                                                                                                                              MD5

                                                                                                                                                              f042ee4c8d66248d9b86dcf52abae416

                                                                                                                                                              SHA1

                                                                                                                                                              4cd785c7c3e40c42e3d126086d986c4d4d940bb2

                                                                                                                                                              SHA256

                                                                                                                                                              ae0f5cc54e4b133df66a54572a7ce52faff11f8fd0caeab088aad3699d6ec924

                                                                                                                                                              SHA512

                                                                                                                                                              a8a5f1191dfa212e029c79f1e44866513c29b54a3ec25fd4badc65c80e65dafe7194a4ab597bd14d33bfd077dd8d58c07f29aeb2eed1ba8a065d3a4ad165340d

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe
                                                                                                                                                              Filesize

                                                                                                                                                              5.4MB

                                                                                                                                                              MD5

                                                                                                                                                              9c181b1351af9d8574df0aaeb0e278de

                                                                                                                                                              SHA1

                                                                                                                                                              16010baa64a7d21fe9c435abac13798ccfedd0cd

                                                                                                                                                              SHA256

                                                                                                                                                              3e4de6797fb83963bf660c2da8fd0fd523130e6b48b7834ba48d3f635d4e1ece

                                                                                                                                                              SHA512

                                                                                                                                                              a1b09027b8e5f1ddd2bc4952ed73b708791e10e7a80fe8d726d238cfbca3a539559776fdce26f0e454ebfa2826a0ef3897a27283341ce2ed2ca28a1d24d827f7

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nst96D5.tmp\ExecCmd.dll
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              MD5

                                                                                                                                                              b9380b0bea8854fd9f93cc1fda0dfeac

                                                                                                                                                              SHA1

                                                                                                                                                              edb8d58074e098f7b5f0d158abedc7fc53638618

                                                                                                                                                              SHA256

                                                                                                                                                              1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

                                                                                                                                                              SHA512

                                                                                                                                                              45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nst96D5.tmp\System.dll
                                                                                                                                                              Filesize

                                                                                                                                                              11KB

                                                                                                                                                              MD5

                                                                                                                                                              a436db0c473a087eb61ff5c53c34ba27

                                                                                                                                                              SHA1

                                                                                                                                                              65ea67e424e75f5065132b539c8b2eda88aa0506

                                                                                                                                                              SHA256

                                                                                                                                                              75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

                                                                                                                                                              SHA512

                                                                                                                                                              908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nst96D5.tmp\UserInfo.dll
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              MD5

                                                                                                                                                              031ec9b12afb1fafc9fc397f3b90f29c

                                                                                                                                                              SHA1

                                                                                                                                                              de26ddfe3ef452f8205bfbd5520a8eff6328619f

                                                                                                                                                              SHA256

                                                                                                                                                              2dc320488b636b9dce9581a95e5a833a07500622c1a64fc05023ba6482d2a6e1

                                                                                                                                                              SHA512

                                                                                                                                                              cbebded4e3a87234899e2b67121f898c9060671d25088b7de29bbcbda90a5410dd3afd110417caa6c46ba656e1a863da39127e15c2122fedaa5054f4d43b90a6

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nst96D5.tmp\nsExec.dll
                                                                                                                                                              Filesize

                                                                                                                                                              6KB

                                                                                                                                                              MD5

                                                                                                                                                              14f5984b926208de2aafb55dd9971d4a

                                                                                                                                                              SHA1

                                                                                                                                                              e5afe0b80568135d3e259c73f93947d758a7b980

                                                                                                                                                              SHA256

                                                                                                                                                              030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1

                                                                                                                                                              SHA512

                                                                                                                                                              e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nst96D5.tmp\nsisdl.dll
                                                                                                                                                              Filesize

                                                                                                                                                              14KB

                                                                                                                                                              MD5

                                                                                                                                                              86b723938b48dc670de8f1016c2fe603

                                                                                                                                                              SHA1

                                                                                                                                                              ff432e1f5d2b8423872719520e9df4da401755c3

                                                                                                                                                              SHA256

                                                                                                                                                              a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

                                                                                                                                                              SHA512

                                                                                                                                                              0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

                                                                                                                                                              Download Submit

                                                                                                                                                            • memory/292-567-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/292-400-0x0000000000360000-0x0000000000432000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/392-564-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/576-544-0x0000000001090000-0x0000000001162000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/576-546-0x0000000001090000-0x0000000001162000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/600-380-0x0000000001110000-0x00000000011E2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/676-315-0x0000000000400000-0x0000000000465000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              404KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/676-485-0x0000000000DF0000-0x0000000000EC2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/676-486-0x0000000000DF0000-0x0000000000EC2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/764-725-0x0000000000E60000-0x0000000000F32000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/824-901-0x0000000000B60000-0x0000000000C32000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/824-422-0x0000000000400000-0x0000000000421000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              132KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/824-903-0x0000000000B60000-0x0000000000C32000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/840-357-0x0000000000400000-0x0000000000402000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/856-566-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              436KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/868-610-0x00000000773C0000-0x00000000774BA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1000KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/868-609-0x00000000774C0000-0x00000000775DF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/868-608-0x0000000000400000-0x0000000000421000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              132KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/884-418-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/916-573-0x0000000000400000-0x0000000000421000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              132KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1124-614-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1260-810-0x0000000000380000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1260-868-0x0000000000380000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1272-861-0x0000000000380000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1272-864-0x0000000000380000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1280-753-0x0000000000140000-0x0000000000212000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1280-604-0x0000000000030000-0x0000000000102000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1280-600-0x0000000000030000-0x0000000000102000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1280-416-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1360-897-0x00000000000C0000-0x0000000000192000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1360-899-0x00000000000C0000-0x0000000000192000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1488-817-0x0000000000380000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1536-563-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1576-611-0x0000000000090000-0x0000000000162000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1576-613-0x0000000000090000-0x0000000000162000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1636-388-0x0000000000360000-0x0000000000432000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1640-492-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1644-744-0x0000000000E60000-0x0000000000F32000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1644-746-0x0000000000E60000-0x0000000000F32000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1648-886-0x00000000012C0000-0x0000000001392000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1648-888-0x00000000012C0000-0x0000000001392000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1708-428-0x0000000000140000-0x0000000000212000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1708-427-0x0000000000140000-0x0000000000212000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1720-722-0x0000000000E60000-0x0000000000F32000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1720-557-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1744-490-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1748-488-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1752-494-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1760-419-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              436KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1780-561-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1792-412-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1808-397-0x0000000000360000-0x0000000000432000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1828-414-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1860-6-0x0000000004410000-0x0000000004444000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1860-40-0x0000000000400000-0x0000000000A29000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1860-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1948-423-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1984-568-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2064-425-0x00000000012E0000-0x00000000013B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2064-421-0x00000000012E0000-0x00000000013B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2076-640-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2084-556-0x0000000001090000-0x0000000001162000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2100-390-0x0000000000360000-0x0000000000432000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2100-385-0x0000000000360000-0x0000000000432000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2140-560-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2156-590-0x00000000001F0000-0x00000000002C2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2156-410-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2156-588-0x00000000001F0000-0x00000000002C2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2268-807-0x0000000000E60000-0x0000000000F32000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2392-402-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              248KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2392-574-0x0000000000400000-0x0000000000421000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              132KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2396-393-0x0000000000360000-0x0000000000432000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2400-570-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2464-894-0x00000000012C0000-0x0000000001392000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2480-565-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2556-607-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2608-471-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2668-53-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2692-575-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2692-404-0x0000000000360000-0x0000000000432000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2700-804-0x0000000000C20000-0x0000000000CF2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2700-642-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2772-551-0x0000000001090000-0x0000000001162000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2820-548-0x0000000000130000-0x0000000000132000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2820-809-0x0000000000130000-0x0000000000132000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2840-553-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2888-52-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2888-65-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2896-291-0x0000000000400000-0x0000000000A29000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2896-386-0x0000000000400000-0x0000000000A29000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2896-51-0x0000000004650000-0x0000000004684000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2932-487-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2948-339-0x0000000001110000-0x00000000011E2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2948-342-0x0000000001110000-0x00000000011E2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2952-677-0x0000000000E60000-0x0000000000F32000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2952-680-0x0000000000E60000-0x0000000000F32000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2968-773-0x0000000000C20000-0x0000000000CF2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2968-763-0x0000000000C20000-0x0000000000CF2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2980-643-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2996-641-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3028-482-0x0000000002520000-0x0000000002522000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3028-289-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3028-290-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3028-338-0x00000000044F0000-0x00000000045C2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3028-344-0x0000000002520000-0x0000000002522000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3028-639-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3028-477-0x0000000002520000-0x0000000002522000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3028-18-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3028-472-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download