Overview

overview

10

Static

static

10

6346a63f22...82.exe

windows7-x64

10

6346a63f22...82.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-11-2024 15:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe

  • Size

    6.1MB

  • MD5

    02bec9d86e4839199a60b334dd650e60

  • SHA1

    8f86b49725abfae4c201654f3aa43ec0041cea39

  • SHA256

    6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82

  • SHA512

    660d932f4b2fe56d175ba3c2823a0501d13e29876766a57bd4df5b345177887b48fb9eedcf0c3929cca509f49a2bb189395e82c2418fa6e8834e0a2f79425243

  • SSDEEP

    196608:iLmGZT4llVN1apVkFGT5KSPNOe7mBuyQzh:iyST4TlIGWK+N0BnQzh

Score
10/10
xredbackdoordefense_evasiondiscoveryevasionpersistenceprivilege_escalationupx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies security service 2 TTPs 53 IoCs
    evasion
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Disables RegEdit via registry modification 4 IoCs
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Server Software Component: Terminal Services DLL 1 TTPs 17 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 30 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 20 IoCs
    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 46 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Indicator Removal: Clear Persistence 1 TTPs 64 IoCs

    remove IFEO.

    defense_evasion
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 26 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Runs regedit.exe 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe
    "C:\Users\Admin\AppData\Local\Temp\6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Drops desktop.ini file(s)
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\32788R22FWJFW\ERUNT.3XE
        "C:\32788R22FWJFW\ERUNT.3XE" "C:\Windows\erdnt\Hiv-backup" SYSREG CURUSER OTHERUSERS /NOCONFIRMDELETE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2180
      • C:\32788R22FWJFW\PEV.3XE
        C:\32788R22FWJFW\PEV.3XE RIMPORT C:\32788R22FWJFW\EXE.reg
        3⤵
        • Disables RegEdit via registry modification
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Indicator Removal: Clear Persistence
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • System policy modification
        PID:2344
      • C:\32788R22FWJFW\EN-US\iexplore.exe
        C:\32788R22FWJFW\EN-US\iexplore.exe /w C:\32788R22FWJFW\PEV.3XE RIMPORT C:\32788R22FWJFW\EXE.reg
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\32788R22FWJFW\PEV.3XE
          C:\32788R22FWJFW\PEV.3XE RIMPORT C:\32788R22FWJFW\EXE.reg
          4⤵
          • Disables RegEdit via registry modification
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Impair Defenses: Safe Mode Boot
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Indicator Removal: Clear Persistence
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • System policy modification
          PID:1288
      • C:\32788R22FWJFW\iexplore.exe
        C:\32788R22FWJFW\iexplore.exe Script C:\32788R22FWJFW\Nirscript.dat
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -s450000-1400000 -t!k -t!o -t!g -k C:\*.exe and not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2156
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -k { "C:\ProgramData\*" or "C:\Users\Admin\*" } not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:436
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -k "C:\Users\Admin\AppData\Local\Temp\*" not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2960
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -rk { "C:\Program Files (x86)\*" OR "C:\Program Files (x86)\Common Files\*" } not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2064
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -loadline:C:\32788R22FWJFW\License\UnxUtilsDist.pif and not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1488
        • C:\32788R22FWJFW\License\iexplore.exe
          C:\32788R22FWJFW\License\iexplore.exe -loadline:C:\32788R22FWJFW\License\UnxUtilsDist.com and not { "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" or C:\32788R22FWJFW\* }
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2464
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /C C:\Windows\SysNative\cmd.exe /c C:\32788R22FWJFW\fl0.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1620
        • C:\Windows\system32\cmd.exe
          C:\Windows\SysNative\cmd.exe /c C:\32788R22FWJFW\fl0.bat
          4⤵
            PID:1700
            • C:\32788R22FWJFW\swxcacls.3XE
              SWXCACLS "C:\Windows\system32\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2032
            • C:\32788R22FWJFW\gsar.3XE
              GSAR -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "C:\Windows\system32\cmd.exe" cmd.3XE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2164
            • C:\32788R22FWJFW\swreg.3XE
              SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /DA:R /Q
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2520
            • C:\32788R22FWJFW\swreg.3XE
              SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /RESET /Q
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2408
            • C:\32788R22FWJFW\swreg.3XE
              SWREG ACL "HKLM\SOFTWARE\Microsoft\Command Processor" /RESET /Q
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2368
            • C:\32788R22FWJFW\swreg.3XE
              SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /RESET /Q
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2892
            • C:\32788R22FWJFW\swsc.3XE
              SWSC QUERY BFE
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1720
            • C:\32788R22FWJFW\grep.3XE
              GREP -Fsq "STATE : 4 RUNNING"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:556
            • C:\32788R22FWJFW\pev.3XE
              PEV -tx40000 -t!g -rtf -tpmz -c##y#b#z# \Services.exe
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1000
            • C:\32788R22FWJFW\sed.3XE
              SED -r "/(0x0.*)\t\1/d"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1732
            • C:\32788R22FWJFW\grep.3XE
              GREP .
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2240
            • C:\32788R22FWJFW\pev.3XE
              PEV -tf -tpmz -t!o C:\Windows\Installer\*000*.? -preg"C:\\Windows\\Installer\\\{[^\\]*\}\\U\\[^\\]*\..$"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1048
            • C:\32788R22FWJFW\setpath.3XE
              SETPATH
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1300
            • C:\32788R22FWJFW\grep.3XE
              GREP -sq . ZAFldr00.dat
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2080
        • C:\32788R22FWJFW\Hidec.3XE
          C:\32788R22FWJFW\Hidec.3XE C:\Windows\Sysnative\cmd.exe /c REGEDIT.EXE /S C:\32788R22FWJFW\W7Reg.dat
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1576
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /c REGEDIT.EXE /S C:\32788R22FWJFW\W7Reg.dat
            4⤵
              PID:1624
              • C:\Windows\regedit.exe
                REGEDIT.EXE /S C:\32788R22FWJFW\W7Reg.dat
                5⤵
                • Modifies security service
                • Event Triggered Execution: Image File Execution Options Injection
                • Server Software Component: Terminal Services DLL
                • Sets service image path in registry
                • Modifies system executable filetype association
                • Indicator Removal: Clear Persistence
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Runs regedit.exe
                PID:2200
          • C:\32788R22FWJFW\Hidec.3XE
            C:\32788R22FWJFW\Hidec.3XE C:\32788R22FWJFW\cmd.3XE /C C:\32788R22FWJFW\p.cmd
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1456
            • C:\32788R22FWJFW\cmd.3XE
              C:\32788R22FWJFW\cmd.3XE /C C:\32788R22FWJFW\p.cmd
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2456
              • C:\32788R22FWJFW\pev.3XE
                PEV.3XE RIMPORT C:\32788R22FWJFW\EXE.reg
                5⤵
                • Disables RegEdit via registry modification
                • Event Triggered Execution: Image File Execution Options Injection
                • Executes dropped EXE
                • Impair Defenses: Safe Mode Boot
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Indicator Removal: Clear Persistence
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • System policy modification
                PID:2676
              • C:\32788R22FWJFW\swreg.3XE
                SWREG.3XE QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_{79007602-0CDB-4405-9DBF-1257BB3226ED}\0000\Control" /v ActiveService
                5⤵
                • Executes dropped EXE
                PID:2160
              • C:\32788R22FWJFW\swreg.3XE
                SWREG.3XE QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root"
                5⤵
                • Executes dropped EXE
                PID:2120
              • C:\32788R22FWJFW\grep.3XE
                GREP.3XE -Eix "HKEY_.*\\root\\\*PNP[^\\]*" PNP296_00
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1248
              • C:\32788R22FWJFW\NirCmd.3XE
                NIRCMD.3XE WIN CLOSE CLASS "#32770"
                5⤵
                • Executes dropped EXE
                PID:1480
              • C:\32788R22FWJFW\swreg.3XE
                SWREG.3XE QUERY "HKLM\System\Currentcontrolset\Control\ProductOptions" /v ProductType
                5⤵
                • Executes dropped EXE
                PID:2616
              • C:\32788R22FWJFW\grep.3XE
                GREP.3XE -isq "ProductType.*WinNT" WinNT00
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2784
              • C:\32788R22FWJFW\pev.3XE
                PEV -c##g# "C:\Windows\system32\kernel32.dll"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2528
              • C:\Windows\SysWOW64\findstr.exe
                FINDSTR -B "6.1.760" CurVer
                5⤵
                  PID:1988
                • C:\32788R22FWJFW\hidec.3XE
                  HIDEC SWSC START CryptSvc
                  5⤵
                  • Executes dropped EXE
                  PID:3020
                • C:\32788R22FWJFW\pev.3XE
                  PEV -rtd C:\Windows\Sysnative
                  5⤵
                  • Executes dropped EXE
                  PID:3060
                • C:\32788R22FWJFW\grep.3XE
                  GREP -isq "processorArchitecture=.amd64." "C:\Windows\SysNative\csrss.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1852
                • C:\32788R22FWJFW\NirCmd.3XE
                  NIRCMD CMDWAIT 6000 EXEC HIDE PEV -k CSCRIPT.exe
                  5⤵
                  • Executes dropped EXE
                  PID:880
                • C:\Windows\SysWOW64\cscript.exe
                  CSCRIPT.exe //NOLOGO //E:VBSCRIPT //B //T:05 "C:\32788R22FWJFW\ksvchost.vbs"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2976
                • C:\32788R22FWJFW\pev.3XE
                  PEV -k NIRCMD.3XE
                  5⤵
                  • Executes dropped EXE
                  PID:2572
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option
                  5⤵
                  • Executes dropped EXE
                  PID:2968
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys /D Driver
                  5⤵
                  • Executes dropped EXE
                  • Impair Defenses: Safe Mode Boot
                  PID:2064
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys /D Driver
                  5⤵
                  • Executes dropped EXE
                  PID:2492
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RESET /Q
                  5⤵
                  • Executes dropped EXE
                  PID:1980
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RO:F /RA:F /Q
                  5⤵
                  • Executes dropped EXE
                  PID:1600
                • C:\32788R22FWJFW\swsc.3XE
                  SWSC QUERY BFE
                  5⤵
                  • Executes dropped EXE
                  PID:3000
                • C:\32788R22FWJFW\grep.3XE
                  GREP -Fsq "STATE : 4 RUNNING"
                  5⤵
                  • Executes dropped EXE
                  PID:2084
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /V "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe" /T REG_DWORD /D 1
                  5⤵
                  • Executes dropped EXE
                  PID:1968
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG QUERY "HKCU\Control Panel\Desktop\MuiCached" /v "MachinePreferredUILanguages"
                  5⤵
                  • Executes dropped EXE
                  PID:2964
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG QUERY "HKCU\Control Panel\International" /v LocaleName
                  5⤵
                  • Executes dropped EXE
                  PID:2960
                • C:\32788R22FWJFW\sed.3XE
                  SED.3XE -r "/.* /!d; s///; s/(\\0)*$//; s/\\0/\n/g" MUI00
                  5⤵
                  • Executes dropped EXE
                  PID:2352
                • C:\32788R22FWJFW\sed.3XE
                  SED.3XE -r -n "G; s/\n/&&/; /^([ -~]*\n).*\n\1/d; s/\n//; h; P"
                  5⤵
                  • Executes dropped EXE
                  PID:2884
                • C:\32788R22FWJFW\grep.3XE
                  GREP.3XE -Fsqix en-US MUI
                  5⤵
                  • Executes dropped EXE
                  PID:2164
                • C:\32788R22FWJFW\pev.3XE
                  PEV -limit1 -rtf -sasize "C:\32788R22FWJFW\en-US\*.3XE.mui"
                  5⤵
                  • Executes dropped EXE
                  PID:2448
                • C:\32788R22FWJFW\pev.3XE
                  PEV UZIP License\pv_5_2_2.zip .\
                  5⤵
                  • Executes dropped EXE
                  PID:1872
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG QUERY "HKLM\Software\Swearware" /V LastDir
                  5⤵
                  • Executes dropped EXE
                  PID:2416
                • C:\32788R22FWJFW\sed.3XE
                  SED -r "/.* (.:\\[^\\]*)$/!d; s//\1/"
                  5⤵
                  • Executes dropped EXE
                  PID:2504
                • C:\32788R22FWJFW\pev.3XE
                  PEV -outputtemp00 -rtf -c:##5# .\* and { License.exe or 32788R22FWJFW.exe or WinNT.exe or N_.exe }
                  5⤵
                  • Executes dropped EXE
                  PID:2360
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG QUERY "HKCU\Console_combofixbackup"
                  5⤵
                  • Executes dropped EXE
                  PID:2128
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG COPY "HKCU\Console" "HKCU\Console_combofixbackup" /s
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:556
                • C:\32788R22FWJFW\swreg.3XE
                  SWREG ADD "HKCU\Console" /v "QuickEdit" /T REG_DWORD /D 0
                  5⤵
                    PID:2768
                  • C:\32788R22FWJFW\swreg.3XE
                    SWREG ADD "HKCU\Console" /V "InsertMode" /T REG_DWORD /D 1
                    5⤵
                      PID:2688
                    • C:\32788R22FWJFW\swreg.3XE
                      SWREG QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\CodePage" /V ACP
                      5⤵
                        PID:2672
                      • C:\32788R22FWJFW\sed.3XE
                        SED "/.* /!d; s//@CHCP.com /" NlsCodePageACP00
                        5⤵
                          PID:2808
                        • C:\32788R22FWJFW\swreg.3XE
                          SWREG ADD HKCU\Console /V CodePage /T REG_DWORD /D "1252"
                          5⤵
                            PID:2668
                          • C:\32788R22FWJFW\swreg.3XE
                            SWREG ADD HKU\S-1-5-18\Console /V CodePage /T REG_DWORD /D "1252"
                            5⤵
                            • Modifies data under HKEY_USERS
                            PID:2728
                          • C:\Windows\SysWOW64\chcp.com
                            CHCP.com 1252
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:2720
                          • C:\32788R22FWJFW\swreg.3XE
                            SWREG QUERY HKLM\System\CurrentControlSet\Control\NLS\Language /V Default
                            5⤵
                              PID:2632
                            • C:\32788R22FWJFW\sed.3XE
                              SED "/.* /!d; s///" NlsLanguage00
                              5⤵
                                PID:2704
                              • C:\32788R22FWJFW\grep.3XE
                                GREP -isq "09$" NlsLanguageDefault
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:2212
                              • C:\32788R22FWJFW\swreg.3XE
                                SWREG QUERY hklm\system\currentcontrolset\enum\root\system
                                5⤵
                                  PID:1680
                                • C:\32788R22FWJFW\swsc.3XE
                                  SWSC DELETE MBR
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2284
                                • C:\32788R22FWJFW\rmbr.3XE
                                  RMBR -u
                                  5⤵
                                    PID:2004
                                  • C:\32788R22FWJFW\handle.3XE
                                    HANDLE -p System
                                    5⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    PID:2056
                                    • C:\32788R22FWJFW\handle64.exe
                                      HANDLE -p System
                                      6⤵
                                      • Drops file in Drivers directory
                                      • Sets service image path in registry
                                      • Suspicious behavior: LoadsDriver
                                      PID:3004
                                  • C:\32788R22FWJFW\grep.3XE
                                    GREP -Fic "C:\Windows\SysWow64\drivers\volsnap.sys" temp00
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2060
                                  • C:\32788R22FWJFW\grep.3XE
                                    GREP -E "^[5-9]$|.."
                                    5⤵
                                      PID:2192
                                    • C:\32788R22FWJFW\pev.3XE
                                      PEV -tx50000 -tf -files:files.pif -c:##5#b#f# -output:mdCheck00.dat
                                      5⤵
                                        PID:2788
                                      • C:\32788R22FWJFW\grep.3XE
                                        GREP -vs "^!" mdCheck00.dat
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2676
                                      • C:\32788R22FWJFW\grep.3XE
                                        GREP -Fvf md5sum.pif mdCheck0a.dat
                                        5⤵
                                          PID:2160
                                        • C:\32788R22FWJFW\grep.3XE
                                          GREP -sq . mdCheck01.dat
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2984
                                        • C:\32788R22FWJFW\swreg.3XE
                                          SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /RESET /Q
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1248
                                        • C:\32788R22FWJFW\swreg.3XE
                                          SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /RESET /Q
                                          5⤵
                                            PID:2260
                                          • C:\32788R22FWJFW\swreg.3XE
                                            SWREG QUERY "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve
                                            5⤵
                                              PID:2840
                                            • C:\32788R22FWJFW\swreg.3XE
                                              SWREG ADD "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
                                              5⤵
                                                PID:1164
                                              • C:\32788R22FWJFW\swreg.3XE
                                                SWREG QUERY "hklm\software\microsoft\windows nt\currentversion\winlogon" /v Userinit
                                                5⤵
                                                  PID:1504
                                                • C:\32788R22FWJFW\grep.3XE
                                                  GREP -Fi "C:\Windows\system32\userinit.exe" Userinit00
                                                  5⤵
                                                    PID:1924
                                                  • C:\32788R22FWJFW\swreg.3XE
                                                    SWREG ADD "hklm\software\microsoft\windows nt\currentversion\winlogon" /v Userinit /d "C:\Windows\system32\userinit.exe,"
                                                    5⤵
                                                    • Modifies WinLogon for persistence
                                                    PID:1132
                                                  • C:\32788R22FWJFW\sed.3XE
                                                    SED -r "/SfxCmd=/I!d; s///; s/\s*$//; s/^(\x22[^\x22]*\x22|[^\x22]\S*) *//; s/(\x22[^\x22]*\x22)/\n\1\n/g" SET00
                                                    5⤵
                                                      PID:380
                                                    • C:\32788R22FWJFW\sed.3XE
                                                      SED -r "/./!d; /^\x22/!{s/\x22(\S+)\x22/\1/; s_\s+(/\S+)\s+_ \x22\1\x22 _g; s_\s+(/\S+)\s+_ \x22\1\x22 _g; s_\x22\s+(/\S*)$_\x22 \x22\1\x22_; s_^(/\S+)\s+_\x22\1\x22 _; }" temp00
                                                      5⤵
                                                        PID:2124
                                                      • C:\32788R22FWJFW\sed.3XE
                                                        SED -r ":a; $!N;s/\n *\x22/ \x22/;ta; s/./@SET SfxCmd=&/; s/^(@SET SfxCmd=)([^\x22]\S*)$/\1\x22\2\x22/" temp01
                                                        5⤵
                                                          PID:2052
                                                        • C:\32788R22FWJFW\swxcacls.3XE
                                                          SWXCACLS C:\Windows\SysNative\ATTRIB.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
                                                          5⤵
                                                            PID:2188
                                                          • C:\32788R22FWJFW\swxcacls.3XE
                                                            SWXCACLS C:\Windows\SysNative\CSCRIPT.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
                                                            5⤵
                                                              PID:768
                                                            • C:\32788R22FWJFW\swxcacls.3XE
                                                              SWXCACLS C:\Windows\SysNative\PING.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              PID:1784
                                                            • C:\32788R22FWJFW\swxcacls.3XE
                                                              SWXCACLS C:\Windows\SysNative\ROUTE.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
                                                              5⤵
                                                                PID:2300
                                                              • C:\32788R22FWJFW\grep.3XE
                                                                GREP -Ei "\\(wscntfy|winlogon|wininit|nvsvc|lsm|lsass|iexplore|svchost|spoolsv|smss|slsvc|services|explorer|ctfmon|csrss|alg)\.....$" MSName00
                                                                5⤵
                                                                  PID:2952
                                                                • C:\32788R22FWJFW\grep.3XE
                                                                  GREP -Ei "\\uninstall\.....$" MSName00
                                                                  5⤵
                                                                    PID:2528
                                                                  • C:\32788R22FWJFW\grep.3XE
                                                                    GREP -Ei "\\NoMbr\.....$" MSName00
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1988
                                                                  • C:\32788R22FWJFW\grep.3XE
                                                                    GREP -Ei "\\iexplore\.exe.$" MSName00
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3020
                                                                  • C:\32788R22FWJFW\sed.3XE
                                                                    SED -r "/.*\\CF@C([1-9][0-9])M([1-9])\.....$/I!d; s//\1\t\2/" MSName00
                                                                    5⤵
                                                                      PID:1288
                                                                    • C:\32788R22FWJFW\grep.3XE
                                                                      GREP .
                                                                      5⤵
                                                                        PID:3060
                                                                      • C:\32788R22FWJFW\pev.3XE
                                                                        PEV -tf -tpmz -t!o C:\Windows\Installer\*000*.? -preg"C:\\Windows\\Installer\\\{[^\\]*\}\\U\\[^\\]*\..$"
                                                                        5⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1852
                                                                      • C:\32788R22FWJFW\swxcacls.3XE
                                                                        SWXCACLS C:\$RECYCLE.bin\* /GA:F /S /Q
                                                                        5⤵
                                                                          PID:1752
                                                                        • C:\32788R22FWJFW\pev.3XE
                                                                          PEV -tf -tpmz -t!o C:\$RECYCLE.bin\*000*.? -preg"\\U\\[^\\]*\..$"
                                                                          5⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2440
                                                                        • C:\32788R22FWJFW\ATTRIB.3XE
                                                                          ATTRIB +R "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
                                                                          5⤵
                                                                            PID:696
                                                                          • C:\32788R22FWJFW\grep.3XE
                                                                            GREP "=.*[a-z]" sfx.cmd
                                                                            5⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2000
                                                                          • C:\32788R22FWJFW\grep.3XE
                                                                            GREP -Eisq "=.\/NoMbr| .\/NoMbr. | .\/NoMbr.$" sfx.cmd
                                                                            5⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2064
                                                                          • C:\32788R22FWJFW\grep.3XE
                                                                            GREP -Eisq "\\CFScript[^:\/\\]*$" sfx.cmd
                                                                            5⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:356
                                                                          • C:\32788R22FWJFW\NirCmd.3XE
                                                                            NIRCMD CMDWAIT 9000 EXEC HIDE PEV -k CSCRIPT.3XE
                                                                            5⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1488
                                                                          • C:\32788R22FWJFW\CSCRIPT.3XE
                                                                            CSCRIPT //NOLOGO //E:VBSCRIPT //B //T:08 av.vbs
                                                                            5⤵
                                                                              PID:1600
                                                                            • C:\32788R22FWJFW\pev.3XE
                                                                              PEV -k NIRCMD.3XE
                                                                              5⤵
                                                                                PID:848
                                                                              • C:\32788R22FWJFW\swreg.3XE
                                                                                SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RESET /Q
                                                                                5⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2352
                                                                              • C:\32788R22FWJFW\swreg.3XE
                                                                                SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RO:F /RA:F /Q
                                                                                5⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2016
                                                                              • C:\32788R22FWJFW\grep.3XE
                                                                                GREP -Fsf AVBlack resident.txt
                                                                                5⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:604
                                                                              • C:\32788R22FWJFW\grep.3XE
                                                                                GREP -Fivf AVWhite resident.txt
                                                                                5⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1264
                                                                              • C:\32788R22FWJFW\grep.3XE
                                                                                GREP -E "^(AV|SP): .*\*Enabled/"
                                                                                5⤵
                                                                                  PID:2940
                                                                                • C:\32788R22FWJFW\pev.3XE
                                                                                  PEV -k * -preg"\\((ntvdm|teatimer[^\\]*|ad-watch[^\\]*|SZServer|StopZilla[^\\]*|userinit|procmon|txp1atform|SonndMan|ANDRE|TOLO|jalang|jalangkung|jantungan|DOSEN|C3W3K4MPUS)\.exe)$"
                                                                                  5⤵
                                                                                    PID:396
                                                                                  • C:\32788R22FWJFW\grep.3XE
                                                                                    GREP -Fx "REGEDIT4" Fin.dat
                                                                                    5⤵
                                                                                      PID:840
                                                                                    • C:\32788R22FWJFW\grep.3XE
                                                                                      GREP -ix "FileName=[-[:alnum:]@_.]*" FileName
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2032
                                                                                    • C:\32788R22FWJFW\grep.3XE
                                                                                      GREP -ivx ComboFix DirName00
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2356
                                                                                    • C:\32788R22FWJFW\grep.3XE
                                                                                      GREP -Fisqx "._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82" DirName01
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2220
                                                                                    • C:\32788R22FWJFW\pev.3XE
                                                                                      PEV UZIP "License\streamtools.zip" License
                                                                                      5⤵
                                                                                        PID:2368
                                                                                      • C:\32788R22FWJFW\grep.3XE
                                                                                        GREP -Eisq "=.\/uninstall| .\/uninstall. | .\/uninstall.$" sfx.cmd
                                                                                        5⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1720
                                                                                      • C:\32788R22FWJFW\pev.3XE
                                                                                        PEV -rtf -s=0 "C:\Windows\erdnt\Hiv-backup\*"
                                                                                        5⤵
                                                                                          PID:2088
                                                                                        • C:\32788R22FWJFW\pev.3XE
                                                                                          PEV -k SWSC.3XE
                                                                                          5⤵
                                                                                            PID:908
                                                                                          • C:\32788R22FWJFW\swreg.3XE
                                                                                            SWREG ADD "HKLM\Software\Swearware" /V LastDir /D "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82"
                                                                                            5⤵
                                                                                              PID:2560
                                                                                            • C:\32788R22FWJFW\hidec.3XE
                                                                                              HIDEC "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30854.3XE" /F:OFF /D /C C:\Start_.cmd
                                                                                              5⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2236
                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30854.3XE
                                                                                                "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30854.3XE" /F:OFF /D /C C:\Start_.cmd
                                                                                                6⤵
                                                                                                  PID:2108
                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                    ATTRIB -H -S "C:\32788R22FWJFW\*"
                                                                                                    7⤵
                                                                                                    • Drops desktop.ini file(s)
                                                                                                    • Views/modifies file attributes
                                                                                                    PID:2668
                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30854.3XE
                                                                                                    "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30854.3XE" /k c.bat
                                                                                                    7⤵
                                                                                                    • Drops desktop.ini file(s)
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:2608
                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                      CHCP.com 1252
                                                                                                      8⤵
                                                                                                        PID:2620
                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\pev.3XE
                                                                                                        PEV RIMPORT EXE.reg
                                                                                                        8⤵
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                        • Impair Defenses: Safe Mode Boot
                                                                                                        • Modifies system executable filetype association
                                                                                                        • Adds Run key to start application
                                                                                                        • Indicator Removal: Clear Persistence
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        • Modifies registry class
                                                                                                        • System policy modification
                                                                                                        PID:1056
                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                        SWREG QUERY "hklm\system\select" /v "current"
                                                                                                        8⤵
                                                                                                          PID:2748
                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\sed.3XE
                                                                                                          SED -r "/.* /!d; s//00/; s/^[0-9]*(...) .*/@SET ControlSet=ControlSet\1\nSET CS000=HKEY_LOCAL_MACHINE\\system\\ControlSet\1\\Services/"
                                                                                                          8⤵
                                                                                                            PID:2724
                                                                                                          • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\ATTRIB.3XE
                                                                                                            ATTRIB +S "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82"
                                                                                                            8⤵
                                                                                                              PID:2332
                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                              GREP -sqx "REGEDIT4" Fin.dat
                                                                                                              8⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:1556
                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\ATTRIB.3XE
                                                                                                              ATTRIB +R *.3XE
                                                                                                              8⤵
                                                                                                                PID:2836
                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\NirCmdC.3XE
                                                                                                                NIRCMDC EXEC SHOW "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30854.3XE" /C " ECHO.&&ECHO.-------- ~%CurrDate.yyyy-MM-dd% - ~%CurrTime.HH:mm:ss% -------------&&ECHO."
                                                                                                                8⤵
                                                                                                                  PID:2764
                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30854.3XE
                                                                                                                    "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30854.3XE" /C " ECHO.&&ECHO.-------- 2024-11-19 - 15:33:38 -------------&&ECHO."
                                                                                                                    9⤵
                                                                                                                      PID:3008
                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                    SWREG QUERY "HKCU\Console_combofixbackup"
                                                                                                                    8⤵
                                                                                                                      PID:2644
                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                      CHCP.com 1252
                                                                                                                      8⤵
                                                                                                                        PID:2192
                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                        GREP -isq "09$" NlsLanguageDefault
                                                                                                                        8⤵
                                                                                                                          PID:1268
                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                          GREP -Eisq "=.\/uninstall.| .\/uninstall. | .\/uninstall.$" sfx.cmd
                                                                                                                          8⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1484
                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swxcacls.3XE
                                                                                                                          SWXCACLS PV.3XE /P /GE:F /Q
                                                                                                                          8⤵
                                                                                                                            PID:1928
                                                                                                                          • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\PV.3XE
                                                                                                                            PV -m CF30854.3XE
                                                                                                                            8⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2160
                                                                                                                          • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\sed.3XE
                                                                                                                            SED -R "1,3d; /[4-9]\S{7}\s*\d* .:\\|\\detoured.dll$/Id; /.*(.:\\.*)/I!d; s//\1/" ForeignC00
                                                                                                                            8⤵
                                                                                                                              PID:2812
                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                              GREP -Fixvf ForeignWht ForeignC01
                                                                                                                              8⤵
                                                                                                                                PID:2624
                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                SWREG QUERY HKLM\Software\Swearware /V "CF_Update"
                                                                                                                                8⤵
                                                                                                                                  PID:2616
                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                  SWREG DELETE HKLM\Software\Swearware /V "CF_Update"
                                                                                                                                  8⤵
                                                                                                                                    PID:2856
                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\hidec.3XE
                                                                                                                                    HIDEC PING -n 1 -w 250 127.0.0.1
                                                                                                                                    8⤵
                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                    PID:1164
                                                                                                                                    • C:\Windows\SysWOW64\PING.exe
                                                                                                                                      PING -n 1 -w 250 127.0.0.1
                                                                                                                                      9⤵
                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                      • Runs ping.exe
                                                                                                                                      PID:1504
                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\PV.3XE
                                                                                                                                    PV -d2000 -xa PING.3XE
                                                                                                                                    8⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                    PID:1460
                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\PV.3XE
                                                                                                                                    PV -m PING.3XE
                                                                                                                                    8⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                    PID:1144
                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\sed.3XE
                                                                                                                                    SED -R "1,3d; /((10|4)00000|[4-9]\S{7})\s*\d* .:\\/d; /C:\\Windows\\SysWow64\\(xpsp2res|Normaliz|urlmon|odbcint|imon)\.dll/Id; /\)|\\/I!d; s/.*(.:\\)/\1/" pingtest00
                                                                                                                                    8⤵
                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                    PID:1944
                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                    GREP -Fixf ForeignWht pingtest01
                                                                                                                                    8⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                    PID:2320
                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\pev.3XE
                                                                                                                                    PEV -k PING.3XE
                                                                                                                                    8⤵
                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                    PID:1748
                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\PING.3XE
                                                                                                                                    PING -n 2 -w 500 google.com
                                                                                                                                    8⤵
                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                    PID:2860
                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                    SWREG QUERY "HKLM\SOFTWARE\swearware\Backup\Winsock2"
                                                                                                                                    8⤵
                                                                                                                                      PID:2988
                                                                                                                                    • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                      SWREG ACL "HKLM\SOFTWARE\swearware" /RESET
                                                                                                                                      8⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:824
                                                                                                                                    • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                      SWREG COPY "HKLM\SYSTEM\CurrentControlSet\Services\WinSock2" "HKLM\SOFTWARE\swearware\Backup\Winsock2" /s
                                                                                                                                      8⤵
                                                                                                                                        PID:3060
                                                                                                                                      • C:\Windows\system32\sort.exe
                                                                                                                                        SORT /M 65536 Mirrors00 /O Mirrors
                                                                                                                                        8⤵
                                                                                                                                          PID:2224
                                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\ComboFix-Download.3XE
                                                                                                                                          ComboFix-Download -s --connect-timeout 5 -A "cfcurl/7.15.3 (i586-pc-mingw32msvc) libcurl/7.15.3 zlib/1.2.2" -H "Host: download.bleepingcomputer.com" http://208.43.120.24/sUBs/version.txt
                                                                                                                                          8⤵
                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                          PID:868
                                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                          GREP "^[0-9][0-9].* [0-9]"
                                                                                                                                          8⤵
                                                                                                                                            PID:1532
                                                                                                                                          • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\ComboFix-Download.3XE
                                                                                                                                            ComboFix-Download -s --connect-timeout 5 -A "cfcurl/7.15.3 (i586-pc-mingw32msvc) libcurl/7.15.3 zlib/1.2.2" -H "Host: www.compendiate.net" http://69.6.236.82/sUBs/ComboFix.exe/version.txt
                                                                                                                                            8⤵
                                                                                                                                              PID:696
                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                              GREP "^[0-9][0-9].* [0-9]"
                                                                                                                                              8⤵
                                                                                                                                                PID:444
                                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                SWREG QUERY HKLM\Software\Swearware /v 44617465204572726F72
                                                                                                                                                8⤵
                                                                                                                                                  PID:2464
                                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\pev.3XE
                                                                                                                                                  PEV -rtf -dg15 .\md5sum.pif
                                                                                                                                                  8⤵
                                                                                                                                                    PID:624
                                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                    SWREG ADD "HKLM\Software\Swearware" /v 44617465204572726F72 /d "idk"
                                                                                                                                                    8⤵
                                                                                                                                                      PID:1980
                                                                                                                                                    • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\NircmdB.exe
                                                                                                                                                      NircmdB.exe QBOXCOMTOP "Current date is ~%CurrDate.yyyy-MM-dd%. ComboFix has expired~n~nClick 'Yes' to run in REDUCED FUNCTIONALITY mode~n~nClick 'No' to exit" "Version_18-08-08.01" "" FILLDELETE ABORTB
                                                                                                                                                      8⤵
                                                                                                                                                        PID:1140
                                                                                                                                                      • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\pev.3XE
                                                                                                                                                        PEV -rtf -dl10 .\md5sum.pif
                                                                                                                                                        8⤵
                                                                                                                                                          PID:1968
                                                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                                          GREP -sq "FIXLSP.bat" "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
                                                                                                                                                          8⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3056
                                                                                                                                                        • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\pev.3XE
                                                                                                                                                          PEV -k C:\Windows\* and { SWXCACLS.exe or SWSC.exe or PEV.exe or sed.exe or grep.exe or zip.exe or mbr.exe } or C:\Windows\system32\SWSC.exe
                                                                                                                                                          8⤵
                                                                                                                                                            PID:1520
                                                                                                                                                          • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\grep.3XE
                                                                                                                                                            GREP -Esq "FIXLSP.bat|C.o.m.b.o.F.i.x" "C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"
                                                                                                                                                            8⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1948
                                                                                                                                                          • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\NirCmd.3XE
                                                                                                                                                            NIRCMD WIN HIDE TITLE .
                                                                                                                                                            8⤵
                                                                                                                                                              PID:2016
                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\NirCmd.3XE
                                                                                                                                                              NIRCMD WIN HIDE ITITLE ": ."
                                                                                                                                                              8⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1708
                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\PEV.exe
                                                                                                                                                              PEV.exe -k { *.3XE or NIRCMD.exe } and not C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CF30854.3XE
                                                                                                                                                              8⤵
                                                                                                                                                                PID:604
                                                                                                                                                              • C:\Windows\regedit.exe
                                                                                                                                                                C:\Windows\regedit.exe /s "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\fin.dat"
                                                                                                                                                                8⤵
                                                                                                                                                                • Impair Defenses: Safe Mode Boot
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                • Runs regedit.exe
                                                                                                                                                                PID:2520
                                                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                SWREG copy "hkcu\control panel\international_combofixbackup" "hkcu\control panel\international" /s
                                                                                                                                                                8⤵
                                                                                                                                                                • Modifies Control Panel
                                                                                                                                                                PID:2412
                                                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                SWREG copy "hku\.default\control panel\international_combofixbackup" "hku\.default\control panel\international" /s
                                                                                                                                                                8⤵
                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                PID:396
                                                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                SWREG COPY "hkcu\console_combofixbackup" "hkcu\console" /s
                                                                                                                                                                8⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:840
                                                                                                                                                              • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                SWREG ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /RESET /Q
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:2156
                                                                                                                                                                • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                  SWREG DELETE "hkcu\console_combofixbackup"
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:2356
                                                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\NircmdB.exe
                                                                                                                                                                    NircmdB.exe SYSREFRESH INTL
                                                                                                                                                                    8⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:2220
                                                                                                                                                                  • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                    SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RESET /Q
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:2416
                                                                                                                                                                    • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\swreg.3XE
                                                                                                                                                                      SWREG ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RO:F /RA:F /Q
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:2892
                                                                                                                                                                      • C:\Windows\NIRCMD.exe
                                                                                                                                                                        NIRCMD.exe CMDWAIT 5000 EXECMD DEL /A/F C:\Windows\NIRCMD.exe
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:1984
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            cmd.exe /c DEL /A/F C:\Windows\NIRCMD.exe
                                                                                                                                                                            9⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:876
                                                                                                                                                                        • C:\Windows\NIRCMD.exe
                                                                                                                                                                          NIRCMD.exe EXECMD "RD /S/Q "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\"
                                                                                                                                                                          8⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:864
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            cmd.exe /c "RD /S/Q "C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\"
                                                                                                                                                                            9⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:872
                                                                                                                                                                        • C:\Windows\NIRCMD.exe
                                                                                                                                                                          NIRCMD.exe WIN CLOSE CLASS #32770
                                                                                                                                                                          8⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:2216
                                                                                                                                                                  • C:\32788R22FWJFW\pev.3XE
                                                                                                                                                                    PEV WAIT 2000
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:2672
                                                                                                                                                              • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:2568
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1028
                                                                                                                                                            • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                              "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                                                                                                                                                              1⤵
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:564

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                            Reconnaissance

                                                                                                                                                            Resource Development

                                                                                                                                                            Initial Access

                                                                                                                                                            Execution

                                                                                                                                                            Persistence

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            3
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            2
                                                                                                                                                            T1547.001

                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                            1
                                                                                                                                                            T1547.004

                                                                                                                                                            Create or Modify System Process

                                                                                                                                                            1
                                                                                                                                                            T1543

                                                                                                                                                            Windows Service

                                                                                                                                                            1
                                                                                                                                                            T1543.003

                                                                                                                                                            Event Triggered Execution

                                                                                                                                                            3
                                                                                                                                                            T1546

                                                                                                                                                            Change Default File Association

                                                                                                                                                            1
                                                                                                                                                            T1546.001

                                                                                                                                                            Component Object Model Hijacking

                                                                                                                                                            1
                                                                                                                                                            T1546.015

                                                                                                                                                            Image File Execution Options Injection

                                                                                                                                                            1
                                                                                                                                                            T1546.012

                                                                                                                                                            Server Software Component

                                                                                                                                                            1
                                                                                                                                                            T1505

                                                                                                                                                            Terminal Services DLL

                                                                                                                                                            1
                                                                                                                                                            T1505.005

                                                                                                                                                            Privilege Escalation

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            3
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            2
                                                                                                                                                            T1547.001

                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                            1
                                                                                                                                                            T1547.004

                                                                                                                                                            Create or Modify System Process

                                                                                                                                                            1
                                                                                                                                                            T1543

                                                                                                                                                            Windows Service

                                                                                                                                                            1
                                                                                                                                                            T1543.003

                                                                                                                                                            Event Triggered Execution

                                                                                                                                                            3
                                                                                                                                                            T1546

                                                                                                                                                            Change Default File Association

                                                                                                                                                            1
                                                                                                                                                            T1546.001

                                                                                                                                                            Component Object Model Hijacking

                                                                                                                                                            1
                                                                                                                                                            T1546.015

                                                                                                                                                            Image File Execution Options Injection

                                                                                                                                                            1
                                                                                                                                                            T1546.012

                                                                                                                                                            Defense Evasion

                                                                                                                                                            Hide Artifacts

                                                                                                                                                            1
                                                                                                                                                            T1564

                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                            1
                                                                                                                                                            T1564.001

                                                                                                                                                            Impair Defenses

                                                                                                                                                            1
                                                                                                                                                            T1562

                                                                                                                                                            Safe Mode Boot

                                                                                                                                                            1
                                                                                                                                                            T1562.009

                                                                                                                                                            Indicator Removal

                                                                                                                                                            2
                                                                                                                                                            T1070

                                                                                                                                                            Clear Persistence

                                                                                                                                                            1
                                                                                                                                                            T1070.009

                                                                                                                                                            File Deletion

                                                                                                                                                            1
                                                                                                                                                            T1070.004

                                                                                                                                                            Modify Registry

                                                                                                                                                            6
                                                                                                                                                            T1112

                                                                                                                                                            Credential Access

                                                                                                                                                            Discovery

                                                                                                                                                            Query Registry

                                                                                                                                                            1
                                                                                                                                                            T1012

                                                                                                                                                            Remote System Discovery

                                                                                                                                                            1
                                                                                                                                                            T1018

                                                                                                                                                            System Information Discovery

                                                                                                                                                            2
                                                                                                                                                            T1082

                                                                                                                                                            System Location Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614

                                                                                                                                                            System Language Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614.001

                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                            1
                                                                                                                                                            T1016

                                                                                                                                                            Internet Connection Discovery

                                                                                                                                                            1
                                                                                                                                                            T1016.001

                                                                                                                                                            Lateral Movement

                                                                                                                                                            Collection

                                                                                                                                                            Command and Control

                                                                                                                                                            Exfiltration

                                                                                                                                                            Impact

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\CCS.bat
                                                                                                                                                              Filesize

                                                                                                                                                              94B

                                                                                                                                                              MD5

                                                                                                                                                              fddb66186804dc1a836ee7b288aec224

                                                                                                                                                              SHA1

                                                                                                                                                              1570fd4102cb3d5940e8527e2efaa23c7367cd8e

                                                                                                                                                              SHA256

                                                                                                                                                              64ae6e396d7c15f8101e74d99009e3301898105d4082392415a3afb824298c7c

                                                                                                                                                              SHA512

                                                                                                                                                              7edc20e77458f0ffe5a6ff4cb4a214ef3f64218de6c07a3ee0d6b6f9a66fff57598f6b35c66b4cdd8b71b4053c781e90ece626187dd6f6adf1da56756a3dfd31

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\N_\13412
                                                                                                                                                              Filesize

                                                                                                                                                              24B

                                                                                                                                                              MD5

                                                                                                                                                              79c644256de6427ed74aa9225299685e

                                                                                                                                                              SHA1

                                                                                                                                                              99bd5a2cec702cc8f0d38828bee63739ee4718dc

                                                                                                                                                              SHA256

                                                                                                                                                              d76c2daf80bc9550db8285aa715c787ee2238f2d96777fdf52f3dc96c07ef55c

                                                                                                                                                              SHA512

                                                                                                                                                              a13f8178160689ad18a1bdb1704dd5ea9cd173e2d2e52ea081d0063d95425e54f83f7f0018fb57e6e9a65aedbee6547670d4a4e3035469b31252a5e1c3c77e3e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\N_\pingtest
                                                                                                                                                              Filesize

                                                                                                                                                              66B

                                                                                                                                                              MD5

                                                                                                                                                              955de0e7ae154a12e0eb81dc30ed0905

                                                                                                                                                              SHA1

                                                                                                                                                              136138d125ccd2cf5529b40e207d673f78b159c3

                                                                                                                                                              SHA256

                                                                                                                                                              87eebb19c6607ebbe65b6b307c06ce4c8464ee0aa7f0e1bc7335e374a4a6b9c6

                                                                                                                                                              SHA512

                                                                                                                                                              4cd99739def158c2f30440e644961395cbf4b754d618d21df4d856682aee0fe2487d3ac35d7b699e57f6ca5debbdd5469535a358ab692bca53b936852cb341d1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\en-US\PING.3XE.mui
                                                                                                                                                              Filesize

                                                                                                                                                              9KB

                                                                                                                                                              MD5

                                                                                                                                                              5b5d34c87292116639cfa3451fb6e0d9

                                                                                                                                                              SHA1

                                                                                                                                                              a62b1a486f27fcabe7497f61772d68f75d4c5cc2

                                                                                                                                                              SHA256

                                                                                                                                                              468469b56310fc8bb26e9ec0b3ae7c0b30f7c25470f9948d46323cfc901907e3

                                                                                                                                                              SHA512

                                                                                                                                                              b9bdf0270aadf74fe667ab987f15ec72aa61f951a7dfca535c07f19f0e21e82097983b59a8e424364d7762b192e632390fd8d832cffa7eaad496aab7d3b7597a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\en-US\REGT.3XE.mui
                                                                                                                                                              Filesize

                                                                                                                                                              44KB

                                                                                                                                                              MD5

                                                                                                                                                              f3a500fb9c16ddf7af12cf3eff0716e2

                                                                                                                                                              SHA1

                                                                                                                                                              35dead0077a4fc25612d90f95776af81c3d96dc3

                                                                                                                                                              SHA256

                                                                                                                                                              12434c2df267a3e4d348c3e823d89c212de4d398447668bb3544f270f669864a

                                                                                                                                                              SHA512

                                                                                                                                                              c0438a60f8a5dc6df0cc1ed19262b3fd9869a661bec7e7aaf7befa04c2192476765be4bdc84ed8668ad04f8fceb20361afb070c68a1f6eacfc8ba9d83219f5a2

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82\en-US\ROUTE.3XE.mui
                                                                                                                                                              Filesize

                                                                                                                                                              12KB

                                                                                                                                                              MD5

                                                                                                                                                              3274f791d4cc2cfe4dec805403ad10e3

                                                                                                                                                              SHA1

                                                                                                                                                              99dfdd6b292efd86b5810e6354182b2db0c78f41

                                                                                                                                                              SHA256

                                                                                                                                                              78d9c7e42a14f2c5b377394ceedf7f9a77d16df43434eaecc0ac5cfc01cbc121

                                                                                                                                                              SHA512

                                                                                                                                                              e6ed28767307160b43695276b4347a2c7064e838ca2038aad4dd6fe5d2bf3007489e514d73aa70a8a9012e2a851d183c72f753ff1c6e64e0cf30f915d3efcb0a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\CHCP.bat
                                                                                                                                                              Filesize

                                                                                                                                                              19B

                                                                                                                                                              MD5

                                                                                                                                                              d875037251b54bfeb674f591350d3b23

                                                                                                                                                              SHA1

                                                                                                                                                              973b66e72611b62f6d106c7f729605f0a30eb408

                                                                                                                                                              SHA256

                                                                                                                                                              14e50a7afb6646e7c82a3b3beae6d490be5adcaa7b9fda58779e2314da38d6d6

                                                                                                                                                              SHA512

                                                                                                                                                              a660e1e8ec7b9fc56f034541a58c7a873c12b40f7aa62d987f9d7030365f13a57b4420589eb7a0a56f4d23112b7003e9647866329d62516aad95e823560c9b1e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\CSCRIPT.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              152KB

                                                                                                                                                              MD5

                                                                                                                                                              791af7743252d0cd10a30d61e5bc1f8e

                                                                                                                                                              SHA1

                                                                                                                                                              70096a77e202cf9f30c064956f36d14bcbd8f7bb

                                                                                                                                                              SHA256

                                                                                                                                                              e34910c8c4f2051b1b87f80e9b389dfe3583bb3e4da909bb2544f22c2d92cf15

                                                                                                                                                              SHA512

                                                                                                                                                              d564f20748189de62525d2c0d4a199a272e3b273a38bd2ccd0bd7f9141f118eae08223b2a0739cd9bdf73234a0f0fb3566eaf88884462e494d44617bd9ac3ccb

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\EN-US\CF30854.3XE.mui
                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                              MD5

                                                                                                                                                              84fa403e67ccf1a031faeb39a091a7c0

                                                                                                                                                              SHA1

                                                                                                                                                              e22bd0cc50f20d0b1e4f0283f8cf9d54a8ca99a8

                                                                                                                                                              SHA256

                                                                                                                                                              6aaf47281e52b184d6e58cac0822dae59eb719f2af63360ecf645e1255e8644b

                                                                                                                                                              SHA512

                                                                                                                                                              d47ded5cb06b6bae3a83432f2353059a97b2c0c4b161c150bdb510c7744b55b0686738d4d37861aa4d0acce697ee5cabf521ce7f926399b046b42cc4e8494827

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\EN-US\iexplore.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              abc6379205de2618851c4fcbf72112eb

                                                                                                                                                              SHA1

                                                                                                                                                              1ed7b1e965eab56f55efda975f9f7ade95337267

                                                                                                                                                              SHA256

                                                                                                                                                              22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f

                                                                                                                                                              SHA512

                                                                                                                                                              180c7f400dd13092b470e3a91bf02e98ef6247c1193bf349e3710e8d1e9003f3bc9b792bb776eacb746e9c67b3041f2333cc07f28c5f046d59274742230fb7c1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\ERDNT.E_E
                                                                                                                                                              Filesize

                                                                                                                                                              159KB

                                                                                                                                                              MD5

                                                                                                                                                              89afdd29832aa923926bdd4b5f5243d5

                                                                                                                                                              SHA1

                                                                                                                                                              4ee93ef072559c5184236718fe07485bc5ddbe2d

                                                                                                                                                              SHA256

                                                                                                                                                              a559f249fc0e56bc925609773f6cc9cd1826bf70916be1d6370ce4707a6dfd84

                                                                                                                                                              SHA512

                                                                                                                                                              289e9be8566e7b1713c4ed0fa9be509b7d7dd6fe5bab6a7cee7a338f2aeab040419f1fbd032ba97b984691144b54ee8089a6e964ea8633bfa56539010e29a812

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\ERDNTDOS.LOC
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              f9650a5c954d2a9f8844de99e8577f93

                                                                                                                                                              SHA1

                                                                                                                                                              791a85bf67f5dc3734453808bd3013a866b970ba

                                                                                                                                                              SHA256

                                                                                                                                                              3c3ba112731c697b8700de546195c4a02f96f4fe28d39a75551f932985e0c15e

                                                                                                                                                              SHA512

                                                                                                                                                              0b68eb79b37504586da9c7776594c6ebb0251539b7172a2d631d9cacf54d00445693bcacc7f6f15c9902f79fd3bc22a2274575df9d4db129ee0d856b41ed8ba2

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\ERDNTWIN.LOC
                                                                                                                                                              Filesize

                                                                                                                                                              3KB

                                                                                                                                                              MD5

                                                                                                                                                              388d865d44ee8069df8bd12efedadb3e

                                                                                                                                                              SHA1

                                                                                                                                                              e59a20c9c5de1164a16b23014fc3b6a6cf385d14

                                                                                                                                                              SHA256

                                                                                                                                                              9bdfefd45997b94cfe323d4ce4209941a08061ea364bb969a9d3afb418b6fe61

                                                                                                                                                              SHA512

                                                                                                                                                              e3db6a26c55ce3f141565afc5831a2ee7a63741838b084dcf8cadf500b2b2fbeaccf0e417c996c7a10a4de78ae4d2f423d3043c37025049b8cf154cded4623cd

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\ERUNT.LOC
                                                                                                                                                              Filesize

                                                                                                                                                              3KB

                                                                                                                                                              MD5

                                                                                                                                                              02187b1b6f37b3d0030791c802a6174c

                                                                                                                                                              SHA1

                                                                                                                                                              b0f8330dcca6d6f4426dcce8fe8705d12f06df1d

                                                                                                                                                              SHA256

                                                                                                                                                              fb96fb9575fad8df03df5e48b7ec0bd9a151ebabc9dd949867b087ea925f33da

                                                                                                                                                              SHA512

                                                                                                                                                              b8da90647afa78c7649a198556529567f65d59206e686d64c98e13496295a75580e89dbc18c92eb9ef36ab2bcc414d35af9b2cfb35417f7f4afd622fc7f248d2

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\EXE.reg
                                                                                                                                                              Filesize

                                                                                                                                                              17KB

                                                                                                                                                              MD5

                                                                                                                                                              6029d80d8e934047f4680d425878f8df

                                                                                                                                                              SHA1

                                                                                                                                                              62cbc0902c2159f453776c634e8137bd9da756b5

                                                                                                                                                              SHA256

                                                                                                                                                              dac913a8c06902546d4ebb264b293dcf0fbeb566657b5fb769c9f22448d77847

                                                                                                                                                              SHA512

                                                                                                                                                              38450b14163805f2385fa9ed2a7aff49c81fdfa8c5a41b16862d7d498e1f8bbeeecc977dd2b94c8e4f621ad6d5619b49d7b9c0dd24fd8662b928df5128d0f822

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\License\NCMD.CFXXE
                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              MD5

                                                                                                                                                              43c7228b35d17db840f2254b92e00d8b

                                                                                                                                                              SHA1

                                                                                                                                                              888325a0429e5b7b8229daa058c7cdacf7db2c0d

                                                                                                                                                              SHA256

                                                                                                                                                              8ca7e8f9dc2906b78842c61a52b0a95fd744fa2e76de470588f821cb88e21e45

                                                                                                                                                              SHA512

                                                                                                                                                              f9fbc9a9cf73a226f08ff112c8959419bb1893300e5e81110b63d4926628aa4bbe88d1f6a2b1e6a3ee04e9b903d66c8664c98c9e46aa2ddb8117bfdc8eefdeeb

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\License\UnxUtilsDist.com
                                                                                                                                                              Filesize

                                                                                                                                                              144B

                                                                                                                                                              MD5

                                                                                                                                                              306c4a0f4ecea81cd27076b35b2b0ceb

                                                                                                                                                              SHA1

                                                                                                                                                              9f1f11b86d04f43ad0cc41b46795071efd579d40

                                                                                                                                                              SHA256

                                                                                                                                                              778eaf3129c871b4ff32eba227166711a47fca8b458f34f9198adbb70ee3404e

                                                                                                                                                              SHA512

                                                                                                                                                              223c53f24de764ad98de9b651a0eaeb01ebde1ebcc16c2c59bd803d751c5fa2acd1395e3cd259f9f215d8ce9a26159391e6dba356fde9360d7cf67aaa3262873

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\License\UnxUtilsDist.pif
                                                                                                                                                              Filesize

                                                                                                                                                              388B

                                                                                                                                                              MD5

                                                                                                                                                              128128e7a82b1cf02e92d2166a37e000

                                                                                                                                                              SHA1

                                                                                                                                                              8bddc1272c15f9f9560ed8cd13d91b9e2b040201

                                                                                                                                                              SHA256

                                                                                                                                                              18daa45bf4a05e023dcbb3e5c7c410be4750f7ff81d181ff59a080cd3af6e92f

                                                                                                                                                              SHA512

                                                                                                                                                              74df10f7593dbe0e86b21936c8ee47ee278672865d73ff33c529e4dc4e846a8b2a02ff51504ca5d4bdc65525542ee20406e98dcedb3ffa47f708531fd4ce2274

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\Nirscript.dat
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              ee0eede328eab3072e18d2836f0b5733

                                                                                                                                                              SHA1

                                                                                                                                                              f7f0d25e92e3d334ae709ec86fe3e038ec397647

                                                                                                                                                              SHA256

                                                                                                                                                              b8af13a08015ab1b267d6b6b6b0b317355c6288457b5d9ef7f9995937a666b17

                                                                                                                                                              SHA512

                                                                                                                                                              5a0317bb3c9d0d82c25aacbfe591e96d0d666879ce13ec6b55c016afa2573caf343da5108a62bcf1c2890f7f4f06966bac4ecbebb6eb03dd34ab39dc11bb3190

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\Start_dat
                                                                                                                                                              Filesize

                                                                                                                                                              2B

                                                                                                                                                              MD5

                                                                                                                                                              81051bcc2cf1bedf378224b0a93e2877

                                                                                                                                                              SHA1

                                                                                                                                                              ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                                                                                                              SHA256

                                                                                                                                                              7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                                                                                                              SHA512

                                                                                                                                                              1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\TempPath.bat
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              75b33a3d7d7eaba0dc6d13f8ba6f825e

                                                                                                                                                              SHA1

                                                                                                                                                              67644b09419b002ae121680689bbb2fe81aea2b8

                                                                                                                                                              SHA256

                                                                                                                                                              4d3d7317f2f032264dafa4f2a7a83cb7c6543fa2e2ed2c6d95e1a3ff6c1dd666

                                                                                                                                                              SHA512

                                                                                                                                                              16dc56acafc7bb6456a743979de309c5c0651edce0efc17fcdc814bc928a7f17760ce2fa664b4b49e1d9a30efb218eefa985d7ece2e68b843ef17dc1b1b59c7e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\Vista.krl
                                                                                                                                                              Filesize

                                                                                                                                                              6B

                                                                                                                                                              MD5

                                                                                                                                                              486da0e231191ae975f6d2b4d14f9d39

                                                                                                                                                              SHA1

                                                                                                                                                              93884c615df1514c050d52104a7dfd045f8b6760

                                                                                                                                                              SHA256

                                                                                                                                                              03db0edf70b6e6a3601107fa8f4fa1b1044fc83f65927c0b3b3374c041826b61

                                                                                                                                                              SHA512

                                                                                                                                                              6fea149031c39c9a2a17e05e6f6f21d20e8cf0e384e975448566295b81d95b7d5cc448cd9e56e809c85d3f709237f616e329e469c482559f4c606cd4b961651a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\fl0.bat
                                                                                                                                                              Filesize

                                                                                                                                                              10KB

                                                                                                                                                              MD5

                                                                                                                                                              7d1dc643c3f97f6e396331035b704ab6

                                                                                                                                                              SHA1

                                                                                                                                                              9adfe7d1c195ab984a9cefdeec49bd39c68d084c

                                                                                                                                                              SHA256

                                                                                                                                                              ddc809fba49b8ec969850027d265f6c5aa6d195385f8ed3fe38a66fe0bbbaad4

                                                                                                                                                              SHA512

                                                                                                                                                              56a85cbfaf4ef41854633853a0e7af4ed7a754c9ed36b94be92d41c690b9d8d73704a92e3becc083130d92aea0591c5eb67242c1348c19e14fd693b8584260d2

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\grep.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              78KB

                                                                                                                                                              MD5

                                                                                                                                                              9e05a9c264c8a908a8e79450fcbff047

                                                                                                                                                              SHA1

                                                                                                                                                              363b2ee171de15aeea793bd7fdffd68d0feb8ba4

                                                                                                                                                              SHA256

                                                                                                                                                              c2ef6fc419630d566154f8372e94859df8141d02805bc7bce39c726a1ffef7c1

                                                                                                                                                              SHA512

                                                                                                                                                              712892e9b08a22b795f9627f6d13412cb2a4610404de33c6f83a37178b920e7bb9d3042c3a2191e49d661a34a05202e18224c67811d8b52fa0fc2c757ef0f6fa

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\gsar.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              15KB

                                                                                                                                                              MD5

                                                                                                                                                              d6a005f8facff88e260688ddb7ae00c1

                                                                                                                                                              SHA1

                                                                                                                                                              4e22c7a9fc89587addc4d5ddab71199e08ea5b50

                                                                                                                                                              SHA256

                                                                                                                                                              0ff5348012225418d31ded6d2eb43f081ad8f7035b24e20d3e158ba320a42d49

                                                                                                                                                              SHA512

                                                                                                                                                              7e3ba326c7c6a03cebece8e28cfdc75f89a9a541b07623b77a5825982c2c612477a0adc64eb29afea2faf49a211361fff9009b3979805514fd99163e218b18e7

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\setpath_N.cmd
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              5b4f9947085428bdafd5f5f13fc61e5b

                                                                                                                                                              SHA1

                                                                                                                                                              0a097d99dd988407be0b0b0776ec5c029a47a27c

                                                                                                                                                              SHA256

                                                                                                                                                              a6b85f67b1ff30eaf6893e757ffbba785de0e859afc4362eee9318b63c240cdf

                                                                                                                                                              SHA512

                                                                                                                                                              c61badeafddb9fe8411dc7130c905b615333de8ed576874300dafac9144771d099fe59e33e642987e1621d18f8a0dccd69e763451d33a609d0a8f325b5908c77

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\sfx.cmd
                                                                                                                                                              Filesize

                                                                                                                                                              14B

                                                                                                                                                              MD5

                                                                                                                                                              954a44456e60a31dba59ec10e0868f5c

                                                                                                                                                              SHA1

                                                                                                                                                              7a3101cf946e0d72c3c247547dcc4694d9717260

                                                                                                                                                              SHA256

                                                                                                                                                              a67745e34ed24fc8f769632758dc152c058a81ab7d171ac9c0d8f4a47dd569b9

                                                                                                                                                              SHA512

                                                                                                                                                              82799111dec1bee2bd526f743eda584d23691728dd474800e682938ddaa1765d3a016ca44864bb21ce1739ef17ceea7106e1a19607a10943e34301ac8ba9ce32

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\swreg.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              506KB

                                                                                                                                                              MD5

                                                                                                                                                              a46842c9b0c567a5a9584e83a163560c

                                                                                                                                                              SHA1

                                                                                                                                                              7c01e92196c1fa584f05b40e0ad7952525b00686

                                                                                                                                                              SHA256

                                                                                                                                                              715c24bf2bfdfb50c5b9bff41b7cc2728d6986af97edeeb1f1df0c35d673ad98

                                                                                                                                                              SHA512

                                                                                                                                                              b439d97731b364922a2816739389443cee9137dad99556498d68fe2b617f7070a2c9ab00ec59f388fc6b72faba489605688ea3a180899690b42c50b17952e956

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\swsc.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              397KB

                                                                                                                                                              MD5

                                                                                                                                                              0297c72529807322b152f517fdb0a9fc

                                                                                                                                                              SHA1

                                                                                                                                                              2e818e096dded6e01413ff10b5ba0ddb43920b77

                                                                                                                                                              SHA256

                                                                                                                                                              c4d17d7b6c42bca40a313212422add7581192283eb489af9af1b8b6d9cee67e0

                                                                                                                                                              SHA512

                                                                                                                                                              634b4a41bc71a5be39b6962198f19baa63c89887897c2ea47aaf150f27c375ec69d24e61e891442ca9b675ca4bdfd7f5ee0056d99ceb4b8ca6beaaa3f8f2acee

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\32788R22FWJFW\swxcacls.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              207KB

                                                                                                                                                              MD5

                                                                                                                                                              b1a9cf0b6f80611d31987c247ec630b4

                                                                                                                                                              SHA1

                                                                                                                                                              7299b3c370254e1e4bade26dc5fec818989d836a

                                                                                                                                                              SHA256

                                                                                                                                                              933756962d8a3530c50072e03af9e0eb0bede3c7af58feda3518240e851071ef

                                                                                                                                                              SHA512

                                                                                                                                                              152e24b5490c3e15ec7cf6db0e6573cd75846be6b1472165d055255a9b74a22d929bf8bef1c3f8e31333577d806d600239dde2dfbb463cc62987bac62706b9e1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.1MB

                                                                                                                                                              MD5

                                                                                                                                                              02bec9d86e4839199a60b334dd650e60

                                                                                                                                                              SHA1

                                                                                                                                                              8f86b49725abfae4c201654f3aa43ec0041cea39

                                                                                                                                                              SHA256

                                                                                                                                                              6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82

                                                                                                                                                              SHA512

                                                                                                                                                              660d932f4b2fe56d175ba3c2823a0501d13e29876766a57bd4df5b345177887b48fb9eedcf0c3929cca509f49a2bb189395e82c2418fa6e8834e0a2f79425243

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\GioOn3t3.xlsm
                                                                                                                                                              Filesize

                                                                                                                                                              17KB

                                                                                                                                                              MD5

                                                                                                                                                              af4d37aad8b34471da588360a43e768a

                                                                                                                                                              SHA1

                                                                                                                                                              83ed64667d4e68ea531b8bcf58aab3ed4a5ca998

                                                                                                                                                              SHA256

                                                                                                                                                              e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1

                                                                                                                                                              SHA512

                                                                                                                                                              74f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nse1F46.tmp\nsProcess.dll
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              MD5

                                                                                                                                                              faa7f034b38e729a983965c04cc70fc1

                                                                                                                                                              SHA1

                                                                                                                                                              df8bda55b498976ea47d25d8a77539b049dab55e

                                                                                                                                                              SHA256

                                                                                                                                                              579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

                                                                                                                                                              SHA512

                                                                                                                                                              7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

                                                                                                                                                              Download Submit

                                                                                                                                                            • \32788R22FWJFW\ERUNT.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              385KB

                                                                                                                                                              MD5

                                                                                                                                                              5a43a009414d356a018de0f9d3637f3a

                                                                                                                                                              SHA1

                                                                                                                                                              1ab32ff6729c7aea5f3fe37c6f3ee8a1f3ef55f9

                                                                                                                                                              SHA256

                                                                                                                                                              a29dff95b99fb1fb997ebb9baeac450e69348e2fa9b0ebf3b3585fd2f44cd2f8

                                                                                                                                                              SHA512

                                                                                                                                                              97545c4d482a60cb278a24bb80a6f2a5f15716d507203c83beef66dab31554ec9264497609c12461fa77bc1a765062d513a417048027f064b5da9d95a9231a1b

                                                                                                                                                              Download Submit

                                                                                                                                                            • \32788R22FWJFW\iexplore.exe
                                                                                                                                                              Filesize

                                                                                                                                                              59KB

                                                                                                                                                              MD5

                                                                                                                                                              753bc16326fee4a421acb636ccd602f4

                                                                                                                                                              SHA1

                                                                                                                                                              9cca347a4659301f89105a5433539e9cad150c69

                                                                                                                                                              SHA256

                                                                                                                                                              24ca5ceb560f68b37c7cd4e548303a3617bb230c3b7478fe61ae804b8f128e4a

                                                                                                                                                              SHA512

                                                                                                                                                              b7924b660dc5e786bcd5cc5df160c29aaf48c88365940a9fbb60c77aa559e60bd5a7033e5edce4577fbad02f52582d65afbdbd22223cbe13df13cfbd9e4241ee

                                                                                                                                                              Download Submit

                                                                                                                                                            • \32788R22FWJFW\pev.3XE
                                                                                                                                                              Filesize

                                                                                                                                                              250KB

                                                                                                                                                              MD5

                                                                                                                                                              f042ee4c8d66248d9b86dcf52abae416

                                                                                                                                                              SHA1

                                                                                                                                                              4cd785c7c3e40c42e3d126086d986c4d4d940bb2

                                                                                                                                                              SHA256

                                                                                                                                                              ae0f5cc54e4b133df66a54572a7ce52faff11f8fd0caeab088aad3699d6ec924

                                                                                                                                                              SHA512

                                                                                                                                                              a8a5f1191dfa212e029c79f1e44866513c29b54a3ec25fd4badc65c80e65dafe7194a4ab597bd14d33bfd077dd8d58c07f29aeb2eed1ba8a065d3a4ad165340d

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe
                                                                                                                                                              Filesize

                                                                                                                                                              5.4MB

                                                                                                                                                              MD5

                                                                                                                                                              9c181b1351af9d8574df0aaeb0e278de

                                                                                                                                                              SHA1

                                                                                                                                                              16010baa64a7d21fe9c435abac13798ccfedd0cd

                                                                                                                                                              SHA256

                                                                                                                                                              3e4de6797fb83963bf660c2da8fd0fd523130e6b48b7834ba48d3f635d4e1ece

                                                                                                                                                              SHA512

                                                                                                                                                              a1b09027b8e5f1ddd2bc4952ed73b708791e10e7a80fe8d726d238cfbca3a539559776fdce26f0e454ebfa2826a0ef3897a27283341ce2ed2ca28a1d24d827f7

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nse1F46.tmp\ExecCmd.dll
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              MD5

                                                                                                                                                              b9380b0bea8854fd9f93cc1fda0dfeac

                                                                                                                                                              SHA1

                                                                                                                                                              edb8d58074e098f7b5f0d158abedc7fc53638618

                                                                                                                                                              SHA256

                                                                                                                                                              1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

                                                                                                                                                              SHA512

                                                                                                                                                              45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nse1F46.tmp\System.dll
                                                                                                                                                              Filesize

                                                                                                                                                              11KB

                                                                                                                                                              MD5

                                                                                                                                                              a436db0c473a087eb61ff5c53c34ba27

                                                                                                                                                              SHA1

                                                                                                                                                              65ea67e424e75f5065132b539c8b2eda88aa0506

                                                                                                                                                              SHA256

                                                                                                                                                              75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

                                                                                                                                                              SHA512

                                                                                                                                                              908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nse1F46.tmp\UserInfo.dll
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              MD5

                                                                                                                                                              031ec9b12afb1fafc9fc397f3b90f29c

                                                                                                                                                              SHA1

                                                                                                                                                              de26ddfe3ef452f8205bfbd5520a8eff6328619f

                                                                                                                                                              SHA256

                                                                                                                                                              2dc320488b636b9dce9581a95e5a833a07500622c1a64fc05023ba6482d2a6e1

                                                                                                                                                              SHA512

                                                                                                                                                              cbebded4e3a87234899e2b67121f898c9060671d25088b7de29bbcbda90a5410dd3afd110417caa6c46ba656e1a863da39127e15c2122fedaa5054f4d43b90a6

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nse1F46.tmp\nsExec.dll
                                                                                                                                                              Filesize

                                                                                                                                                              6KB

                                                                                                                                                              MD5

                                                                                                                                                              14f5984b926208de2aafb55dd9971d4a

                                                                                                                                                              SHA1

                                                                                                                                                              e5afe0b80568135d3e259c73f93947d758a7b980

                                                                                                                                                              SHA256

                                                                                                                                                              030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1

                                                                                                                                                              SHA512

                                                                                                                                                              e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nse1F46.tmp\nsisdl.dll
                                                                                                                                                              Filesize

                                                                                                                                                              14KB

                                                                                                                                                              MD5

                                                                                                                                                              86b723938b48dc670de8f1016c2fe603

                                                                                                                                                              SHA1

                                                                                                                                                              ff432e1f5d2b8423872719520e9df4da401755c3

                                                                                                                                                              SHA256

                                                                                                                                                              a238cb788e8077442358626fee022d0eb72fc228a5b11c101ab568662db27798

                                                                                                                                                              SHA512

                                                                                                                                                              0a291d76fd950b6f4c725ba377aef42dd2ecfa2a2e7837cf6c98dfba8f4e6f30985a0d0028900d0528501b38f92ccca6353ab20acda2d3349db30021e78a2a5d

                                                                                                                                                              Download Submit

                                                                                                                                                            • memory/396-752-0x00000000012D0000-0x00000000013A2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/436-382-0x00000000002E0000-0x00000000003B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/436-394-0x00000000002E0000-0x00000000003B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/556-640-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/556-422-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/564-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/604-900-0x00000000013B0000-0x0000000001482000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/604-902-0x00000000013B0000-0x0000000001482000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/624-888-0x00000000010B0000-0x0000000001182000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/848-745-0x00000000012D0000-0x00000000013A2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/908-807-0x0000000000350000-0x0000000000422000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1000-428-0x0000000000D10000-0x0000000000DE2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1000-425-0x0000000000D10000-0x0000000000DE2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1028-61-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1048-433-0x00000000001E0000-0x00000000002B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1048-431-0x00000000001E0000-0x00000000002B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1056-817-0x00000000010B0000-0x0000000001182000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1164-852-0x0000000000400000-0x0000000000402000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1248-497-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1288-360-0x0000000000D10000-0x0000000000DE2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1288-384-0x0000000000D10000-0x0000000000DE2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1456-488-0x0000000000400000-0x0000000000402000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1488-399-0x00000000002E0000-0x00000000003B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1520-898-0x00000000010B0000-0x0000000001182000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1600-571-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1720-423-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              436KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1732-429-0x0000000000400000-0x0000000000421000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              132KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1748-375-0x00000000002C0000-0x0000000000392000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1748-865-0x00000000010B0000-0x0000000001182000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1748-862-0x00000000010B0000-0x0000000001182000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1748-365-0x00000000002C0000-0x0000000000392000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1852-722-0x00000000012D0000-0x00000000013A2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1852-560-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1872-608-0x00000000012D0000-0x00000000013A2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1968-894-0x00000000010B0000-0x0000000001182000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1968-574-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1980-570-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2032-403-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              248KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2064-396-0x00000000002E0000-0x00000000003B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2064-388-0x00000000002E0000-0x00000000003B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2064-567-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2080-476-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2084-572-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2088-804-0x0000000001060000-0x0000000001132000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2088-802-0x0000000001060000-0x0000000001132000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2120-495-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2128-614-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2156-412-0x00000000002E0000-0x00000000003B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2160-494-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2160-6-0x0000000004540000-0x0000000004574000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2160-41-0x0000000004540000-0x0000000004574000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2160-40-0x0000000000400000-0x0000000000A29000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2160-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2164-582-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2180-315-0x0000000000400000-0x0000000000465000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              404KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2240-426-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2344-341-0x0000000000CE0000-0x0000000000DB2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2352-579-0x0000000000400000-0x0000000000421000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              132KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2360-613-0x00000000012D0000-0x00000000013A2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2368-762-0x0000000000350000-0x0000000000422000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2368-415-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2368-772-0x0000000000350000-0x0000000000422000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2408-413-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2416-611-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2440-725-0x00000000012D0000-0x00000000013A2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2448-596-0x00000000012D0000-0x00000000013A2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2456-809-0x00000000000C0000-0x00000000000C2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2456-555-0x00000000000C0000-0x00000000000C2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2464-387-0x00000000002E0000-0x00000000003B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2492-568-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2504-612-0x0000000000400000-0x0000000000421000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              132KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2520-409-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2528-551-0x0000000001030000-0x0000000001102000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2528-553-0x0000000001030000-0x0000000001102000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2568-49-0x0000000004510000-0x0000000004544000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2568-291-0x0000000000400000-0x0000000000A29000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2572-562-0x00000000012D0000-0x00000000013A2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2572-563-0x00000000012D0000-0x00000000013A2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2616-499-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2668-650-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2672-869-0x00000000010B0000-0x0000000001182000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2672-810-0x00000000010B0000-0x0000000001182000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2672-643-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2676-493-0x0000000001030000-0x0000000001102000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2676-491-0x0000000001030000-0x0000000001102000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2688-642-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2768-641-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2776-289-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2776-347-0x0000000000540000-0x0000000000542000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2776-481-0x0000000000540000-0x0000000000542000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2776-487-0x0000000000540000-0x0000000000542000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2776-9-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2776-486-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2776-337-0x00000000042F0000-0x00000000043C2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2776-639-0x0000000000400000-0x0000000000434000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              208KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2776-345-0x0000000000540000-0x0000000000542000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2784-501-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              92KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2788-680-0x00000000012D0000-0x00000000013A2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2808-646-0x0000000000400000-0x0000000000421000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              132KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2884-581-0x0000000000400000-0x0000000000421000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              132KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2892-417-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2960-577-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2960-386-0x00000000002E0000-0x00000000003B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2964-575-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2968-564-0x0000000000400000-0x0000000000488000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3000-573-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              436KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3060-557-0x00000000003C0000-0x0000000000492000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3060-558-0x00000000003C0000-0x0000000000492000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              840KB

                                                                                                                                                              Download