xred | 51a6baae536bc1f992b146be605ddb3b3fc0dcd81432d8a483088835d76ac0d8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AntiPubs Dork Searcher EZ/Update.exe
Size

893KB
MD5

f0f73959988dd4d41de1445fb9075b6f
SHA1

a39d5fe0e269c062c1b7c64be09db16508f6cc4b
SHA256

f7c2e8367293c26805ea8f0efed61aba293a970eeab7883b7c40619499e4fc85
SHA512

bff75fa90f703faf4682061bdd609844d98d64b07b0109091f7c2983e4e1459a702e30a4ee06aa036c0e6bc7a508f39a0c6b95a2c27d25df343b4137deb0520c
SSDEEP

12288:UMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V94vFUNDasQ:UnsJ39LyjbJkQFMhmC+6GD9AFOaP

Score

10^/10

xred backdoor discovery evasion persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Update.exe

Executes dropped EXE 12 IoCs

pid	Process
2044	._cache_Update.exe
2424	Synaptics.exe
4988	._cache_update.exe
4992	icsys.icn.exe
5052	explorer.exe
4104	spoolsv.exe
5080	svchost.exe
2788	spoolsv.exe
2252	._cache_Synaptics.exe
1600	._cache_synaptics.exe
2128	icsys.icn.exe
4820	explorer.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	._cache_Synaptics.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	._cache_Update.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4276	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
2044	._cache_Update.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
4992	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5052	explorer.exe
5080	svchost.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
2044	._cache_Update.exe
2044	._cache_Update.exe
4992	icsys.icn.exe
4992	icsys.icn.exe
5052	explorer.exe
5052	explorer.exe
4104	spoolsv.exe
4104	spoolsv.exe
5080	svchost.exe
5080	svchost.exe
2788	spoolsv.exe
2788	spoolsv.exe
2252	._cache_Synaptics.exe
2252	._cache_Synaptics.exe
2128	icsys.icn.exe
2128	icsys.icn.exe
4820	explorer.exe
4820	explorer.exe
4276	EXCEL.EXE
4276	EXCEL.EXE
4276	EXCEL.EXE
4276	EXCEL.EXE
4276	EXCEL.EXE
4276	EXCEL.EXE
4276	EXCEL.EXE
4276	EXCEL.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 2044	4976	Update.exe	82
PID 4976 wrote to memory of 2044	4976	Update.exe	82
PID 4976 wrote to memory of 2044	4976	Update.exe	82
PID 4976 wrote to memory of 2424	4976	Update.exe	83
PID 4976 wrote to memory of 2424	4976	Update.exe	83
PID 4976 wrote to memory of 2424	4976	Update.exe	83
PID 2044 wrote to memory of 4988	2044	._cache_Update.exe	84
PID 2044 wrote to memory of 4988	2044	._cache_Update.exe	84
PID 2044 wrote to memory of 4988	2044	._cache_Update.exe	84
PID 2044 wrote to memory of 4992	2044	._cache_Update.exe	86
PID 2044 wrote to memory of 4992	2044	._cache_Update.exe	86
PID 2044 wrote to memory of 4992	2044	._cache_Update.exe	86
PID 4992 wrote to memory of 5052	4992	icsys.icn.exe	87
PID 4992 wrote to memory of 5052	4992	icsys.icn.exe	87
PID 4992 wrote to memory of 5052	4992	icsys.icn.exe	87
PID 5052 wrote to memory of 4104	5052	explorer.exe	88
PID 5052 wrote to memory of 4104	5052	explorer.exe	88
PID 5052 wrote to memory of 4104	5052	explorer.exe	88
PID 4104 wrote to memory of 5080	4104	spoolsv.exe	89
PID 4104 wrote to memory of 5080	4104	spoolsv.exe	89
PID 4104 wrote to memory of 5080	4104	spoolsv.exe	89
PID 5080 wrote to memory of 2788	5080	svchost.exe	90
PID 5080 wrote to memory of 2788	5080	svchost.exe	90
PID 5080 wrote to memory of 2788	5080	svchost.exe	90
PID 2424 wrote to memory of 2252	2424	Synaptics.exe	91
PID 2424 wrote to memory of 2252	2424	Synaptics.exe	91
PID 2424 wrote to memory of 2252	2424	Synaptics.exe	91
PID 2252 wrote to memory of 1600	2252	._cache_Synaptics.exe	93
PID 2252 wrote to memory of 1600	2252	._cache_Synaptics.exe	93
PID 2252 wrote to memory of 1600	2252	._cache_Synaptics.exe	93
PID 2252 wrote to memory of 2128	2252	._cache_Synaptics.exe	95
PID 2252 wrote to memory of 2128	2252	._cache_Synaptics.exe	95
PID 2252 wrote to memory of 2128	2252	._cache_Synaptics.exe	95
PID 2128 wrote to memory of 4820	2128	icsys.icn.exe	96
PID 2128 wrote to memory of 4820	2128	icsys.icn.exe	96
PID 2128 wrote to memory of 4820	2128	icsys.icn.exe	96

C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\Update.exe
"C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\Update.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\._cache_Update.exe
  "C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\._cache_Update.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2044
- - \??\c:\users\admin\appdata\local\temp\antipubs dork searcher ez\._cache_update.exe
    "c:\users\admin\appdata\local\temp\antipubs dork searcher ez\._cache_update.exe "
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4988
- - C:\Windows\Resources\Themes\icsys.icn.exe
    C:\Windows\Resources\Themes\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5052
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4104
      - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        6⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2788
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - \??\c:\users\admin\appdata\local\temp\antipubs dork searcher ez\._cache_synaptics.exe
      "c:\users\admin\appdata\local\temp\antipubs dork searcher ez\._cache_synaptics.exe " InjUpdate
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1600
  - - C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2128
    - - \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4820

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
893KB

MD5
f0f73959988dd4d41de1445fb9075b6f

SHA1
a39d5fe0e269c062c1b7c64be09db16508f6cc4b

SHA256
f7c2e8367293c26805ea8f0efed61aba293a970eeab7883b7c40619499e4fc85

SHA512
bff75fa90f703faf4682061bdd609844d98d64b07b0109091f7c2983e4e1459a702e30a4ee06aa036c0e6bc7a508f39a0c6b95a2c27d25df343b4137deb0520c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3A975E00

Filesize
21KB

MD5
5a1f79939664d0b8f08f274f294017ac

SHA1
1ad03087f1eb02d7f8a6a82168f3f381547ab989

SHA256
cd71bb771b62592fd93f79e827bcbcbadf3b3ddf67eebac7af90c9a69965cac6

SHA512
029aeec056de496fb26bd57d33709b58981fbacd0853031fbf58e4168e9f85040787c1ca101e19a85faa2aabd6edf80fde1566e6a73178c4d4e403926c5ba8d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\._cache_Update.exe

Filesize
140KB

MD5
570ddad76b94dd6156587b6f98ce8f6d

SHA1
c4b4b2655cc181add7a1e90d840a6735ca4bbace

SHA256
324fd9c87d5311ad7ab72f6238afda44f7bd7532daaf2a3d639a4dea81d95c86

SHA512
be0be9826d2e6dcb0f3bcbe16ef624154f6357892d4c57d8d1f87508cb3d1b37966d1ceb679487305ea3236acdcd5871a6cda315a89510264850b0629e36aa0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AntiPubs Dork Searcher EZ\._cache_update.exe

Filesize
5KB

MD5
e2032456744fd06c43c2097f8fcd1a1f

SHA1
df474bbbd27166ef9a935457c44130fa20fbda5d

SHA256
bf9ba9e515c43c1c7d394cbc528e2fa500d98c423df89958485f61d2bd7bb874

SHA512
e3520f05508bcd44d989b7e92102586235a1187afbea8e9d903244e5487679190fc83aaf831ded2b9e0da0803b3298c93ff1be0396bbe54e57b5c3a428c6d7ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\y3QK6TPi.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
396d11a99266c10b4d6b984cfbfaff7e

SHA1
8f9c3aed2d92b3773d28f8b9f79f6a47197185aa

SHA256
5322aafa38db442e2c8911ce69c1fec5ab8a7dfab31114de275fa9c46f9d4e5b

SHA512
726bd4b84cb22a414821dd59fc553ba5c3208d26ccccba272767343d3a3c4473c27fc8e7e2a75f4c6298fcf49df64e60f81c437f6cfc4a085a4643b1ebf79659

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
fe07e43d610bef7a346eef8f8c5b9a95

SHA1
f782e9115af0f9cd8f5d88179476614fd84e1a10

SHA256
83caed8278b264c26235d659bf80924ba0969a6209d984cf6a38ac66635af4d3

SHA512
2e1539602e62dc13a303f71760a4ed6a155daae438804d5bde7f6ff9aa67818e66ada7eea2fa1eff76144513695e91783f481f5fe7ef1c56dfe15251033c2f65

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
852e686eaa7253515d3a680c0214e44b

SHA1
5fde61b0cd977d1fdf4db42425d343536f0233d7

SHA256
a686365c3d144b34f34f168b07de3f90f5a798fbc8cf644e087e81f7f88c9b65

SHA512
ea9e68d93eee963d435d174cef2fc524c42038f9e264fc9f1ef2c34f35691797155f47c0e79b6a2ae9570c2a7abb830b46463a219ce9914dda68ac416bcf2528

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
0be6864d625233f790876678facc74c7

SHA1
48e5039c02b4f416ca87c412125da993c6f548bc

SHA256
defaadae9a67418c60629828b47b051ad77902a170ec6c26f1fd7297b1139649

SHA512
bb88079187d3d35c675af5cd69d2fa0ccf79dc97b15848fc3cfd3f0d6e295b4143b9d02f4c2d770e30f2aed0e6451b6d125945b23e0e85adb1bda5597124739a

Download Submit
memory/2044-60-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2044-241-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2128-264-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2252-265-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2424-135-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/2424-345-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2424-314-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2424-310-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/2788-233-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4104-237-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4276-244-0x00007FF9BC990000-0x00007FF9BC9A0000-memory.dmp

Filesize
64KB

Download
memory/4276-249-0x00007FF9BC990000-0x00007FF9BC9A0000-memory.dmp

Filesize
64KB

Download
memory/4276-250-0x00007FF9BC990000-0x00007FF9BC9A0000-memory.dmp

Filesize
64KB

Download
memory/4276-245-0x00007FF9BC990000-0x00007FF9BC9A0000-memory.dmp

Filesize
64KB

Download
memory/4276-246-0x00007FF9BC990000-0x00007FF9BC9A0000-memory.dmp

Filesize
64KB

Download
memory/4276-262-0x00007FF9BA2D0000-0x00007FF9BA2E0000-memory.dmp

Filesize
64KB

Download
memory/4276-266-0x00007FF9BA2D0000-0x00007FF9BA2E0000-memory.dmp

Filesize
64KB

Download
memory/4820-263-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4976-132-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4976-0-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4988-211-0x0000000000100000-0x0000000000108000-memory.dmp

Filesize
32KB

Download
memory/4992-143-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4992-239-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5052-346-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5080-347-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download