Overview

overview

10

Static

static

10

70636c3fd3...1e.exe

windows7-x64

10

70636c3fd3...1e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-12-2024 22:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe

  • Size

    3.9MB

  • MD5

    c52d4fb4a49b05a1f665d2b9a4bb42ad

  • SHA1

    4165fc93089a1b3517088db400963df219af05d3

  • SHA256

    70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e

  • SHA512

    a312ede14b3a771d75de0060a7bb8c97787d99114a828cb8b98d734463bc0ceb365b1677f3e1a3936c24439e5436451c11335f3f3f3d5f1138e4da28f6aed557

  • SSDEEP

    98304:vjmtk2aw3jmtk2aH3jmtk2az3KK3dyaXXNJDWjBKUoLIkPeB1LnPnqn9:v+h3++3+y3b3rXXNJDGiLIkGB1zfk9

Score
10/10
neshtaxredbackdoordiscoverypersistencespywarestealer

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Detect Neshta payload 64 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Executes dropped EXE 60 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe
    "C:\Users\Admin\AppData\Local\Temp\70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Users\Admin\AppData\Local\Temp\3582-490\70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Users\Admin\AppData\Local\Temp\._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2912
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2736
            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1724
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2352
                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1628
                  • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                    "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1708
                    • C:\Windows\svchost.com
                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE"
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3012
                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3060
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1980
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2416
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1324
            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1704
              • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
                "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2788
                • C:\Windows\svchost.com
                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2508
                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
                    C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    PID:1740
                    • C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE
                      "C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2612
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2652
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2932
                    • C:\ProgramData\Synaptics\Synaptics.exe
                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:2016
                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2736
                        • C:\Windows\svchost.com
                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:824
                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:2564
                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
                              14⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:1908
                              • C:\Windows\svchost.com
                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:2576
                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  PID:2864
                                  • C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE
                                    "C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:1740
                                    • C:\Windows\svchost.com
                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                                      18⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:2672
                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:680
                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                    17⤵
                                    • Executes dropped EXE
                                    PID:896
              • C:\ProgramData\Synaptics\Synaptics.exe
                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2828
                • C:\Windows\svchost.com
                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2880
                  • C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE
                    C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    PID:2812
                    • C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE
                      "C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:1220
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:3008
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • System Location Discovery: System Language Discovery
                          PID:2524
                          • C:\ProgramData\Synaptics\._cache__CACHE~2.EXE
                            "C:\ProgramData\Synaptics\._cache__CACHE~2.EXE" InjUpdate
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:2200
                            • C:\Windows\svchost.com
                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:2388
                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:1592
                          • C:\ProgramData\Synaptics\Synaptics.exe
                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                            13⤵
                            • Executes dropped EXE
                            PID:892
                          • C:\Windows\svchost.com
                            "C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE" InjUpdate
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:944
                            • C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE
                              C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE InjUpdate
                              14⤵
                              • Executes dropped EXE
                              PID:1356
                    • C:\ProgramData\Synaptics\Synaptics.exe
                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:2848
                      • C:\ProgramData\Synaptics\._cache_Synaptics.exe
                        "C:\ProgramData\Synaptics\._cache_Synaptics.exe" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2980
                        • C:\Windows\svchost.com
                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:2108
                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            PID:704
                            • C:\ProgramData\Synaptics\._cache__CACHE~4.EXE
                              "C:\ProgramData\Synaptics\._cache__CACHE~4.EXE" InjUpdate
                              14⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:2064
                              • C:\Windows\svchost.com
                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:544
                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  PID:560
                                  • C:\ProgramData\Synaptics\._cache__C578E~1.EXE
                                    "C:\ProgramData\Synaptics\._cache__C578E~1.EXE" InjUpdate
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:1784
                                    • C:\Windows\svchost.com
                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                                      18⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:1252
                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:2160
                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:2736
                                    • C:\ProgramData\Synaptics\._cache_Synaptics.exe
                                      "C:\ProgramData\Synaptics\._cache_Synaptics.exe" InjUpdate
                                      18⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:684
                                      • C:\Windows\svchost.com
                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:2608
                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:2860
                            • C:\ProgramData\Synaptics\Synaptics.exe
                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:2596
                              • C:\ProgramData\Synaptics\._cache_Synaptics.exe
                                "C:\ProgramData\Synaptics\._cache_Synaptics.exe" InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:2268
                                • C:\Windows\svchost.com
                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1928
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:304
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:2304
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
    Filesize

    547KB

    MD5

    cf6c595d3e5e9667667af096762fd9c4

    SHA1

    9bb44da8d7f6457099cb56e4f7d1026963dce7ce

    SHA256

    593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

    SHA512

    ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

    Download Submit

  • C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe
    Filesize

    1.1MB

    MD5

    566ed4f62fdc96f175afedd811fa0370

    SHA1

    d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

    SHA256

    e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

    SHA512

    cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE
    Filesize

    285KB

    MD5

    831270ac3db358cdbef5535b0b3a44e6

    SHA1

    c0423685c09bbe465f6bb7f8672c936e768f05a3

    SHA256

    a8f78ac26c738b13564252f1048ca784bf152ef048b829d3d22650b7f62078f0

    SHA512

    f64a00977d4b6f8c43f53cee7bb450f3c8cbef08525975055fde5d8c515db32d2bfad92e99313b3a10a72a50dd09b4ffe28e9af4c148c6480622ba486776e450

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE
    Filesize

    313KB

    MD5

    8c4f4eb73490ca2445d8577cf4bb3c81

    SHA1

    0f7d1914b7aeabdb1f1e4caedd344878f48be075

    SHA256

    85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5

    SHA512

    65453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE
    Filesize

    569KB

    MD5

    eef2f834c8d65585af63916d23b07c36

    SHA1

    8cb85449d2cdb21bd6def735e1833c8408b8a9c6

    SHA256

    3cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd

    SHA512

    2ee8766e56e5b1e71c86f7d1a1aa1882706d0bca8f84b2b2c54dd4c255e04f037a6eb265302449950e5f5937b0e57f17a6aa45e88a407ace4b3945e65043d9b7

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe
    Filesize

    381KB

    MD5

    3ec4922dbca2d07815cf28144193ded9

    SHA1

    75cda36469743fbc292da2684e76a26473f04a6d

    SHA256

    0587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801

    SHA512

    956c3a1f2689cb72600edd2e90d652b77592a8a81d319dce026e88f6c02231af06aebd57d68460eb406de00c113522173423cb1b339a41a3918f379c7dc311f7

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe
    Filesize

    137KB

    MD5

    e1833678885f02b5e3cf1b3953456557

    SHA1

    c197e763500002bc76a8d503933f1f6082a8507a

    SHA256

    bd9a16d8d7590a2ec827913db5173f8beb1d1ef44dab1920ef52a307f922bc14

    SHA512

    fe107e1c8631ec6ac94f772e6a7be1fdc2a533fe3cfcf36b1ff018c8d01bd7f1f818f0a2448f736838c953cd516ea7327c416dea20706ed2420327af8ef01abe

    Download Submit

  • C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe
    Filesize

    373KB

    MD5

    2f6f7891de512f6269c8e8276aa3ea3e

    SHA1

    53f648c482e2341b4718a60f9277198711605c80

    SHA256

    d1ee54eb64f31247f182fd62037e64cdb3876e1100bc24883192bf46bab42c86

    SHA512

    c677f4f7bfb2e02cd0babed896be00567aad08304cbff3a85fcc9816b10247fedd026fee769c9bd45277a4f2814eabe6534f0b04ea804d0095a47a1477188dd6

    Download Submit

  • C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE
    Filesize

    100KB

    MD5

    6a091285d13370abb4536604b5f2a043

    SHA1

    8bb4aad8cadbd3894c889de85e7d186369cf6ff1

    SHA256

    909205de592f50532f01b4ac7b573b891f7e6e596b44ff94187b1ba4bcc296bb

    SHA512

    9696e4f60a5b1166535ca8ca3fb495d718086463d1a12fa1facc08219ad5b918208ddd2a102f7955e29153b081e05985c4ae6e4302ab36d548bb62991a47db18

    Download Submit

  • C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE
    Filesize

    130KB

    MD5

    7ce8bcabb035b3de517229dbe7c5e67d

    SHA1

    8e43cd79a7539d240e7645f64fd7f6e9e0f90ab9

    SHA256

    81a3a1dc3104973a100bf8d114b6be35da03767a0cbbaf925f970ffcbe5f217c

    SHA512

    be7fcd50b4f71b458ca001b7c019bf1169ec089d7a1ce05355134b11cbe75a5a29811f9efec803877aeb1a1d576ea2628926e0131361db23214275af6e89e80c

    Download Submit

  • C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE
    Filesize

    2.4MB

    MD5

    a741183f8c4d83467c51abab1ff68d7b

    SHA1

    ddb4a6f3782c0f03f282c2bed765d7b065aadcc6

    SHA256

    78be3aeb507db7e4ee7468c6b9384ee0459deebd503e06bd4988c52247ecea24

    SHA512

    c15dbecc0754a662892ecaff4b9b6c1bad46f710d8e1b973f86eaee467444f8e5764b31ace8f5a9a5e936947cc4dcb97cb1b14a6930c1025f38a3544393b6b18

    Download Submit

  • C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
    Filesize

    859KB

    MD5

    02ee6a3424782531461fb2f10713d3c1

    SHA1

    b581a2c365d93ebb629e8363fd9f69afc673123f

    SHA256

    ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

    SHA512

    6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

    Download Submit

  • C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE
    Filesize

    571KB

    MD5

    d4fdbb8de6a219f981ffda11aa2b2cc4

    SHA1

    cca2cffd4cf39277cc56ebd050f313de15aabbf6

    SHA256

    ba3dc87fca4641e5f5486c4d50c09d087e65264e6c5c885fa6866f6ccb23167b

    SHA512

    7167e13dbcc8c96114fef5fc7ae19afa31173617db153dd283aa6d8256f6b8c09c8f906f5d418efe9f7f242cdfaef24b93c11c451701c4d56eb48d18de4e88bf

    Download Submit

  • C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE
    Filesize

    186KB

    MD5

    58b58875a50a0d8b5e7be7d6ac685164

    SHA1

    1e0b89c1b2585c76e758e9141b846ed4477b0662

    SHA256

    2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

    SHA512

    d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

    Download Submit

  • C:\ProgramData\Synaptics\RCXD691.tmp
    Filesize

    753KB

    MD5

    79af256ed72f13c213700baa5ae5e901

    SHA1

    35e059cd30bbdc6dbb28381d03c31d7ce5474fb6

    SHA256

    e0d8f2cda2766d782f6605c50083997fc838b602316c65cdcc3a8346d3d4f405

    SHA512

    6f9ec4575061c9ce6036dfd0b07ce68b962589f7b4f807739958912f57093316407729451bd7561f18f78468d4894096cf4db851a4accf2ccfff6609c4d5e359

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
    Filesize

    2.4MB

    MD5

    1f5d534955b45f48aa0aa00a71614152

    SHA1

    af3344554a6bd6f560c0cdc0c26692ba1a4cffe4

    SHA256

    c04a158836fe5ed13b9210b058b66540d85ff22bdffea349f7fb8adf56d98845

    SHA512

    c61707bb5afc4bfe47c11864f79cd74711e0bdc44685c25310d208288caac7867db80b9c0022174c80cb167b3ea6d19e492f502ef647d54745515d8c20b86653

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
    Filesize

    1.6MB

    MD5

    41916b644847e6cd9658a0b62676c9d9

    SHA1

    3a48d7a604a0e27570e6f2228fc312b7bad8c7df

    SHA256

    9d40467e1a06c381397fcd9839513c6ae88d2d4fb89d5a57fb411b01371c4bf9

    SHA512

    418419f7de0139068e049fff16a1417864e30daefc7ac747168b3178cadf795b40975a34b6a7394b71611b9ee149587d41d086cd2983635fddc2dc673eb76325

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
    Filesize

    3.1MB

    MD5

    8d32dd92ca9e5363d62a2d724078cd39

    SHA1

    dc36085d393fde2cc1fe6aa400f7ec795469c034

    SHA256

    296bdf7dd95f8c8e21470a00a310feccad92246b823b98de5fb65e864d8dbbf2

    SHA512

    f99ef0635c7b3624faa571f1aa8ca2cf94ab66e41d23e79f0e49dc96b35eb4425f77ea85d6ad0722e6a52434a607574af9634e3c0a816e12c1220a8577a118bc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
    Filesize

    2.3MB

    MD5

    8a4917a261e08ba0ab63328d9e38b55c

    SHA1

    16d5d00610120d79bea5157dc7cf9b880b0e1590

    SHA256

    b42d5a91db91ded062f9ae6e32efa664deb3aae57a1114602b4d78e2dd647b41

    SHA512

    8e81cc29329c455a1556025d766ededa593d545ea497d2f15fc7aaf3e924b4b483d56e897e606aaafabf73c723b0896f247d0953dc1037c3b64c34184d539933

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
    Filesize

    1.6MB

    MD5

    401e0a69a555f3a3f79cec7476e3815b

    SHA1

    8f6551d0d815d13e847d749b2e1347e8fb196385

    SHA256

    1273627534a449e47f6f1b286a5bc3a183f2e0b71362be089bf0588abeae4ea2

    SHA512

    dede1fe3c6b8865f1bcdc9816ff93993a2b2c81c5e17838691f9cf370c871fcde639b2e28c8fc53399050bd7432322e143f15a04a40ce9562af8111e07a0417c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3f9L7ChX.xlsm
    Filesize

    22KB

    MD5

    fcfec391d67e6f7338745aed0061e75b

    SHA1

    56b42a3bc742150f1f2e46306e6de67c79686853

    SHA256

    2c9d82f6a32497f4494837a425b2387072e95d1337d8d341246fbe812ddf2a35

    SHA512

    b13c74efa8f6be01788dea1792515742f4f97d800c32f7893252c717badc1d7bbcb6686e80f28ea214956fc06b520777811f0118f218d86a9bd7db64fc778ef6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3f9L7ChX.xlsm
    Filesize

    25KB

    MD5

    a766cb9dca35543102eb87177cb59f59

    SHA1

    ede5e843d33aec19530c3df5a259e3f797272319

    SHA256

    d55810c19d03e2f79b3f92118721100309839e7f5ed12cb396e17d21e44157c1

    SHA512

    245db9c9dec8f3ee320bc907be90d7953ad0de11249f9df8361d38babe59a381896be5214fedc02f84ceb17218a2f125892aad4f752d7dc1b68e24f165634ab3

    Download Submit

  • C:\Windows\directx.sys
    Filesize

    57B

    MD5

    6b3bfceb3942a9508a2148acbee89007

    SHA1

    3622ac7466cc40f50515eb6fcdc15d1f34ad3be3

    SHA256

    e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c

    SHA512

    fa222bfcade636824af32124b45450c92b1abec7a33e6e647a9248eef5371c127d22ccb7cc5a096b4d5d52e2457f3841293a1b34304e8e5523549856ac02f224

    Download Submit

  • C:\Windows\directx.sys
    Filesize

    57B

    MD5

    b42f2603883dadf133cee3ae5d767bb2

    SHA1

    dc4161551044405353e870b029afff27c8030e22

    SHA256

    998e1546bc98d29ffccb70e81ed00a01f3dbd3015e947d1aabca4cb01775ce28

    SHA512

    a4c33c9b87f84b4aba84ecf8b0b2d8a90703ef8523f1d057824196e584451072ab5bbc96e0c95a319baaffd16ba7a26f940fec2e28e9228e1275c87fb061c02d

    Download Submit

  • C:\Windows\directx.sys
    Filesize

    57B

    MD5

    8e4bd9619c227ef2bc20a2cb2aa55e7b

    SHA1

    a6214b7678b83c4db74b210625b4812300df3a74

    SHA256

    84ba3f2b07e112efaff6ee034b84db960521db9e504a4ac77a5e8e5e988d86d9

    SHA512

    12a6a559b89441983e9aab70f0ea17dc790bc48c7938dd573c888e33811db8fb210539ebebaa6c8f5c04971d72d037be6603de15ea3a1ffc0f5ea3dd5132b4bf

    Download Submit

  • C:\Windows\directx.sys
    Filesize

    57B

    MD5

    043c42847e0ef63834b6a11438ffbe47

    SHA1

    e9c3668f9f3120846d734ecc267eb1506c1bfad6

    SHA256

    b05c3f4f45330685414a7c36e192ff16060e4bdccdadf09ed1eccc3ab249a0b8

    SHA512

    e9e572a557eb3b97941c3090af8c093afa9ef89afb342454c64e675f8094278d8f0f9872504127e5cb6782567a8d63cd5ecbbc309e9e29574011d9c894d85fae

    Download Submit

  • C:\Windows\directx.sys
    Filesize

    57B

    MD5

    4e125c05c3c52106512082f82aac0717

    SHA1

    8505fb21e0058418415b73921e4d5d872c4485e1

    SHA256

    d450a68cb3fc838b7658dc7d0c0ebe239a29285410b1af7b76497779d23f27c2

    SHA512

    3d6caa724b358829dca51623e9cbf6cca72512e19d027b0f72296fa20ffa47f31f24d72b45cb5d5fb767756a5a5469bae66dbca94d97f1e33ca134d1f080323a

    Download Submit

  • C:\Windows\directx.sys
    Filesize

    57B

    MD5

    56abc40d1e45c091d8afddb90a4ce6b4

    SHA1

    08db549484467b32b79958700300cabefc659848

    SHA256

    a43fa861957415e3b0f25e2b54d931961cd309ff1d5354a9362852895b90b3e1

    SHA512

    51625c015a7c8fcf6fb51d3396aa08d2068772e3fcacaf32c409e82071af4ba1eb2ee94f36c06a98c32ba59d23bbaa6b540f7bd418a9472303cc225151daa698

    Download Submit

  • C:\Windows\directx.sys
    Filesize

    35B

    MD5

    10320b53df6530a542f13adf5f36d39a

    SHA1

    386dd879a3e1176b0c91328ce8254174e4220569

    SHA256

    9c4249eb6a5603fcc10a8c8c3c4d8f028a98ebcd9179c0836faacf1d03a48ce7

    SHA512

    c8007820db892b374dee1e6917c6caa4981d3f230ffc11d6753951ff46861ee4b0035544b3309b3008a2a769266639ce45ebc023b1748730cf0cf67844a065d6

    Download Submit

  • C:\Windows\directx.sys
    Filesize

    92B

    MD5

    50f9540e92cf29209f78b355a43d1b90

    SHA1

    8abcaab03e674ea2809493e7b877510c8d3a26cc

    SHA256

    a80262da854cfc312ba1ab8e9b563f50c7fff642aa3cb10f4c39f6007d57ba3f

    SHA512

    b76e8239ab638ab8ca81f4bb065a6113931a53bf0b441513482d3553cc64ba13f84233faa280be6b0212465b94c099feef19a4dd6e294542f7ea88d6c49f3b7f

    Download Submit

  • C:\Windows\svchost.com
    Filesize

    40KB

    MD5

    0a5d679189f7c9bfa34e51dcb2a41b5e

    SHA1

    e07b518a59a4956cf64e70240719b8d3d66467ca

    SHA256

    edfa93ed09ae3469001cde2d0211071b9cc3a553e80bcb5a60435c706c3f44ca

    SHA512

    3deb4eb906cee9b78466ed1175688332f09c1eba765778ae0f6e8d9056868dc858fa822f5a55dee3db40eddc948ce66937eca65afbb656f93add79ea0d7e324a

    Download Submit

  • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
    Filesize

    252KB

    MD5

    9e2b9928c89a9d0da1d3e8f4bd96afa7

    SHA1

    ec66cda99f44b62470c6930e5afda061579cde35

    SHA256

    8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

    SHA512

    2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

    Download Submit

  • \Users\Admin\AppData\Local\Temp\._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe
    Filesize

    3.1MB

    MD5

    7491474fd2d3a5ea107f659995722df8

    SHA1

    06f61ad2b50e5049f9f975c838dc45c6590a9d02

    SHA256

    5fcfff8be382cb1f67b6360169296b03d2e38e6d7e1e0ea4ee7e31440f48e889

    SHA512

    67b7ae694c07fc27fcef9504fb118ccb0677d1d97d1252dd6c4922e4853b4aab2403198b8a4ff0da540bb0748d4fed8d92cedfa016412a924df1cdbf94955e2e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\3582-490\70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe
    Filesize

    3.9MB

    MD5

    2e47c504c064aa1c9cd0fd67b8e007e8

    SHA1

    4ba8234c6bdf51f3561a51277aa9616ce386de94

    SHA256

    3509807ea0dd774ea26bc8c9c48d28c2eafda65a7ec953c0b2f6a52762726894

    SHA512

    858e5544a1818f33d66b0a63362e3fa34112004ddc8da02d6ec97953e26ceedff1eb93e0ae83848a5e6ee79fcf2c1aa49c98b81fcbe8b3f32f8d3187147a7832

    Download Submit

  • memory/304-178-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/544-434-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/560-487-0x0000000000400000-0x000000000065A000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/684-492-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/704-432-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/824-373-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/944-405-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1220-323-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1252-488-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1324-187-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1592-440-0x0000000005490000-0x000000000553A000-memory.dmp

    Filesize

    680KB

    Download

  • memory/1592-392-0x0000000004570000-0x0000000004606000-memory.dmp

    Filesize

    600KB

    Download

  • memory/1628-146-0x0000000000400000-0x000000000065A000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/1704-267-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/1708-159-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1724-106-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1740-308-0x0000000000400000-0x000000000065A000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/1740-441-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1784-486-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1908-407-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1928-470-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/1980-198-0x0000000000400000-0x00000000007E7000-memory.dmp

    Filesize

    3.9MB

    Download

  • memory/2016-354-0x0000000000400000-0x000000000065A000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2064-394-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2108-381-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2156-551-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2160-125-0x0000000000400000-0x00000000007E7000-memory.dmp

    Filesize

    3.9MB

    Download

  • memory/2160-14-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2200-372-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2268-451-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2352-117-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2388-423-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2396-499-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2396-558-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2396-552-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2416-177-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2508-260-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2524-391-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2564-417-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2576-435-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2596-438-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2608-501-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2612-299-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2652-433-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2672-471-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2736-93-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2736-339-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2736-559-0x0000000000400000-0x000000000065A000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2736-553-0x0000000000400000-0x000000000065A000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2740-502-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2740-556-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2740-554-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2788-213-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2812-318-0x0000000000400000-0x00000000007E7000-memory.dmp

    Filesize

    3.9MB

    Download

  • memory/2828-270-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2848-355-0x0000000000400000-0x000000000065A000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2860-498-0x0000000000F50000-0x00000000010E2000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2864-476-0x0000000000400000-0x000000000065A000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2880-279-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2912-80-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2932-370-0x0000000000B80000-0x0000000000BFC000-memory.dmp

    Filesize

    496KB

    Download

  • memory/2932-309-0x00000000013E0000-0x0000000001572000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2932-348-0x00000000002E0000-0x000000000030C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/2980-342-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/3008-340-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/3012-424-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/3060-265-0x0000000000A10000-0x0000000000BA2000-memory.dmp

    Filesize

    1.6MB

    Download