xred | ed1c78f20c2999f71ab4294127bea7adb58d3dda79c652fdfeb8678c53fde290

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PDF.exe
Size

1.6MB
MD5

f464d4d7c3a16d42be2501b9b069f592
SHA1

d746cb858983edb93ecdb9b44d65d18c83d5257d
SHA256

4ea3fd5832635ca12ad822ba1b441fe5e38ea5599d08822057d35248a029cefb
SHA512

4685c52657f2a30f1ed973fa5f0a6c575a93d184980b4e539f41a9d38d481fe0aa0bd2a99140b9c72fb04982f6ad2b7d522045369c752df856856ccd3749899d
SSDEEP

24576:MnsJ39LyjbJkQFMhmC+6GD99hloDX0XOf4mSAz+53SDjpLSZi:MnsHyjtk2MYC5GDrhloJfOAz+OpSs

Score

10^/10

xred backdoor discovery persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PLKQRZ.lnk	._cache_PDF.exe

Executes dropped EXE 5 IoCs

pid	Process
3016	._cache_PDF.exe
2184	Synaptics.exe
2780	._cache_Synaptics.exe
2060	JEUEVI.exe
1356	JEUEVI.exe

Loads dropped DLL 6 IoCs

pid	Process
1600	PDF.exe
1600	PDF.exe
1600	PDF.exe
2184	Synaptics.exe
2184	Synaptics.exe
3016	._cache_PDF.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	PDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\PLKQRZ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\JEUEVI.exe\""	._cache_PDF.exe

AutoIT Executable 19 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2780-77-0x0000000000CF0000-0x0000000000EEE000-memory.dmp	autoit_exe
behavioral1/memory/3016-129-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-130-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-133-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-135-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-137-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/2060-141-0x0000000001290000-0x000000000148E000-memory.dmp	autoit_exe
behavioral1/memory/2060-142-0x0000000001290000-0x000000000148E000-memory.dmp	autoit_exe
behavioral1/memory/3016-143-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-147-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-175-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-177-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-179-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-181-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/1356-186-0x0000000001290000-0x000000000148E000-memory.dmp	autoit_exe
behavioral1/memory/3016-187-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-189-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-191-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe
behavioral1/memory/3016-193-0x0000000000F70000-0x000000000116E000-memory.dmp	autoit_exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a00000001202c-4.dat	upx
behavioral1/memory/3016-18-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/2780-42-0x0000000000CF0000-0x0000000000EEE000-memory.dmp	upx
behavioral1/memory/2780-77-0x0000000000CF0000-0x0000000000EEE000-memory.dmp	upx
behavioral1/memory/3016-129-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-130-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-133-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-135-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-137-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/2060-141-0x0000000001290000-0x000000000148E000-memory.dmp	upx
behavioral1/memory/2060-142-0x0000000001290000-0x000000000148E000-memory.dmp	upx
behavioral1/memory/3016-143-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-147-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-175-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-177-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-179-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-181-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/1356-184-0x0000000001290000-0x000000000148E000-memory.dmp	upx
behavioral1/memory/1356-186-0x0000000001290000-0x000000000148E000-memory.dmp	upx
behavioral1/memory/3016-187-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-189-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-191-0x0000000000F70000-0x000000000116E000-memory.dmp	upx
behavioral1/memory/3016-193-0x0000000000F70000-0x000000000116E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JEUEVI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_PDF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JEUEVI.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2	._cache_PDF.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2576	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2980	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe
3016	._cache_PDF.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3016	._cache_PDF.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2980	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3016	1600	PDF.exe	30
PID 1600 wrote to memory of 3016	1600	PDF.exe	30
PID 1600 wrote to memory of 3016	1600	PDF.exe	30
PID 1600 wrote to memory of 3016	1600	PDF.exe	30
PID 1600 wrote to memory of 2184	1600	PDF.exe	31
PID 1600 wrote to memory of 2184	1600	PDF.exe	31
PID 1600 wrote to memory of 2184	1600	PDF.exe	31
PID 1600 wrote to memory of 2184	1600	PDF.exe	31
PID 2184 wrote to memory of 2780	2184	Synaptics.exe	32
PID 2184 wrote to memory of 2780	2184	Synaptics.exe	32
PID 2184 wrote to memory of 2780	2184	Synaptics.exe	32
PID 2184 wrote to memory of 2780	2184	Synaptics.exe	32
PID 3016 wrote to memory of 2964	3016	._cache_PDF.exe	34
PID 3016 wrote to memory of 2964	3016	._cache_PDF.exe	34
PID 3016 wrote to memory of 2964	3016	._cache_PDF.exe	34
PID 3016 wrote to memory of 2964	3016	._cache_PDF.exe	34
PID 3016 wrote to memory of 2692	3016	._cache_PDF.exe	36
PID 3016 wrote to memory of 2692	3016	._cache_PDF.exe	36
PID 3016 wrote to memory of 2692	3016	._cache_PDF.exe	36
PID 3016 wrote to memory of 2692	3016	._cache_PDF.exe	36
PID 2964 wrote to memory of 2576	2964	cmd.exe	37
PID 2964 wrote to memory of 2576	2964	cmd.exe	37
PID 2964 wrote to memory of 2576	2964	cmd.exe	37
PID 2964 wrote to memory of 2576	2964	cmd.exe	37
PID 2356 wrote to memory of 2060	2356	taskeng.exe	43
PID 2356 wrote to memory of 2060	2356	taskeng.exe	43
PID 2356 wrote to memory of 2060	2356	taskeng.exe	43
PID 2356 wrote to memory of 2060	2356	taskeng.exe	43
PID 2356 wrote to memory of 1356	2356	taskeng.exe	44
PID 2356 wrote to memory of 1356	2356	taskeng.exe	44
PID 2356 wrote to memory of 1356	2356	taskeng.exe	44
PID 2356 wrote to memory of 1356	2356	taskeng.exe	44

C:\Users\Admin\AppData\Local\Temp\PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PDF.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\._cache_PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_PDF.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn PLKQRZ.exe /tr C:\Users\Admin\AppData\Roaming\Windata\JEUEVI.exe /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn PLKQRZ.exe /tr C:\Users\Admin\AppData\Roaming\Windata\JEUEVI.exe /sc minute /mo 1
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2576
- - C:\Windows\SysWOW64\WSCript.exe
    WSCript C:\Users\Admin\AppData\Local\Temp\PLKQRZ.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2692
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2780

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2980

C:\Windows\system32\taskeng.exe
taskeng.exe {BD121DC4-5B53-4A76-8CA8-C747EB17E801} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Roaming\Windata\JEUEVI.exe
  C:\Users\Admin\AppData\Roaming\Windata\JEUEVI.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2060
- C:\Users\Admin\AppData\Roaming\Windata\JEUEVI.exe
  C:\Users\Admin\AppData\Roaming\Windata\JEUEVI.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.6MB

MD5
f464d4d7c3a16d42be2501b9b069f592

SHA1
d746cb858983edb93ecdb9b44d65d18c83d5257d

SHA256
4ea3fd5832635ca12ad822ba1b441fe5e38ea5599d08822057d35248a029cefb

SHA512
4685c52657f2a30f1ed973fa5f0a6c575a93d184980b4e539f41a9d38d481fe0aa0bd2a99140b9c72fb04982f6ad2b7d522045369c752df856856ccd3749899d

Download Submit
C:\Users\Admin\AppData\Local\Temp\PLKQRZ.vbs

Filesize
842B

MD5
706b2a1027185f7c686601dd89fad82f

SHA1
bb7d730e0f6f789454cd3bdc7c45b3463af3159d

SHA256
e24ccdc4aa9414c2f2c95662317c0ebf39e4d844ef47c46d5f2b40f810d07dc6

SHA512
414a0ef71523138cd55b5aa172b86eb46f9dd1fcdff6496b057191f40930146cdf5dda513e6234eb7e3e63b2dc38882468e60a892a3002139a4f69b4fb3405ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZyiE2btY.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZyiE2btY.xlsm

Filesize
20KB

MD5
5298da449b8979301f5615e579c9e565

SHA1
8f5f9d589ea1721ea4f6f7502d62f5405b2eb354

SHA256
be95ff84d53defab5fc6973f8d8dfcd45aa9880c9912dee876aa6ce51566404b

SHA512
97a078176a736200af5e7e9b709940eea4b84408d11118d78d2b50629f1dae1d3a61126125aa481598446061db837cb8c543e0bde02fd5c6efba85dbcfa8714d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZyiE2btY.xlsm

Filesize
22KB

MD5
1ff4cdd3b5505aeac70b4b94eb86fa51

SHA1
cb798c6c236af0dd8ada0892c148b794199aff41

SHA256
f623154735e7a18dcd0900497e48bc3fc7c35cc49d2e338c4294cb54802735d5

SHA512
4bbcd956e77c81d2eeb091e7fbea97685e2f4e1e3f2b28a193b8c7d8b3ca59880f1d242c8d836e17db5e2e919cd8135e2975bfb37934cebde99fefe7997c3257

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZyiE2btY.xlsm

Filesize
26KB

MD5
84507fb80c2b07eb49d789901f793184

SHA1
c0b376c516eafdd0eb6bb096d038c73964929edc

SHA256
80ebb49ed7e545cd8fba00a8a1278164e00ef63a5f56b49c2464bd5192dd6361

SHA512
f89a3ef706819728cb6de0d017ffb40bd522b6f883718d28120cc98b86746d74ade108349f3da64397f2760d51a118af9a9309be527b1fdddf20e367c20f3984

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZyiE2btY.xlsm

Filesize
25KB

MD5
a3856ee82e3970e704176334e6f93022

SHA1
60a21a7b777e3e61b245e5557839d30be337b41d

SHA256
4ce463c3932f1a140b34a015700747e5fff11a7c86081d72f647d004936b4606

SHA512
cabb1b7f789ca95dce14e8e34423577a645d4acb44fbf1800249ad10687cf79748b30c658b6bc8b79cb48f2ee33c8960ee86a9abba68e4b33b0c349a9414a960

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$ZyiE2btY.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_PDF.exe

Filesize
924KB

MD5
a5a8036e79f55c90cfe42b55df9db6bc

SHA1
a2239f8990e86d77673c54f4548a04da10dbc2a8

SHA256
15a513aa7ef12e73fc81b81b2b5455423bbef03524efef33047c1d48c5db624d

SHA512
89f13d58094ce99fe229edd4f02210cddc590ba0aabc502034f04e3643d5bfc7ed7a1675a0db63be4a94f4bf447efbb2b5cfaffe35fa0b213e816c13828193be

Download Submit
memory/1356-184-0x0000000001290000-0x000000000148E000-memory.dmp

Filesize
2.0MB

Download
memory/1356-186-0x0000000001290000-0x000000000148E000-memory.dmp

Filesize
2.0MB

Download
memory/1600-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1600-28-0x0000000000400000-0x00000000005A9000-memory.dmp

Filesize
1.7MB

Download
memory/1600-16-0x0000000005760000-0x000000000595E000-memory.dmp

Filesize
2.0MB

Download
memory/2060-141-0x0000000001290000-0x000000000148E000-memory.dmp

Filesize
2.0MB

Download
memory/2060-142-0x0000000001290000-0x000000000148E000-memory.dmp

Filesize
2.0MB

Download
memory/2184-176-0x0000000000400000-0x00000000005A9000-memory.dmp

Filesize
1.7MB

Download
memory/2184-40-0x00000000057C0000-0x00000000059BE000-memory.dmp

Filesize
2.0MB

Download
memory/2184-131-0x0000000000400000-0x00000000005A9000-memory.dmp

Filesize
1.7MB

Download
memory/2184-128-0x00000000057C0000-0x00000000059BE000-memory.dmp

Filesize
2.0MB

Download
memory/2184-134-0x0000000000400000-0x00000000005A9000-memory.dmp

Filesize
1.7MB

Download
memory/2780-77-0x0000000000CF0000-0x0000000000EEE000-memory.dmp

Filesize
2.0MB

Download
memory/2780-42-0x0000000000CF0000-0x0000000000EEE000-memory.dmp

Filesize
2.0MB

Download
memory/2980-127-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2980-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3016-129-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-135-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-137-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-133-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-130-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-143-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-147-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-132-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/3016-175-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-177-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-179-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-181-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-46-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/3016-18-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-187-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-189-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-191-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download
memory/3016-193-0x0000000000F70000-0x000000000116E000-memory.dmp

Filesize
2.0MB

Download