Overview

overview

10

Static

static

10

7b3d84cf9e...4N.exe

windows7-x64

10

7b3d84cf9e...4N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-01-2025 05:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4N.exe

  • Size

    2.9MB

  • MD5

    7a1a9085e0f549ec511d7d2663099c70

  • SHA1

    3b21d3dbc01758bd15fdaab3e3c51513436b6a46

  • SHA256

    7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4

  • SHA512

    3f0561bcc0583d5b8d68f0666f5de1676e8dbaa817720519a25fa014cc46715ed6c3f2928b976c0e6ab0558939945e6478292a0936f5695d344f4ca58dd6c245

  • SSDEEP

    49152:RnsHyjtk2MYC5GDiYBnsHyjtk2MYC5GDTYdnsHyjtk2MYC5GD6Yx:Rnsmtk2a0Bnsmtk2andnsmtk2aox

Score
10/10
xredbackdoordiscoveryevasionpersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 35 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 22 IoCs
    persistence
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 35 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4N.exe
    "C:\Users\Admin\AppData\Local\Temp\7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Users\Admin\AppData\Local\Temp\._cache_7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4N.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4N.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1456
      • \??\c:\users\admin\appdata\local\temp\._cache_7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4n.exe 
        c:\users\admin\appdata\local\temp\._cache_7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4n.exe 
        3⤵
        • Executes dropped EXE
        PID:4532
      • C:\Users\Admin\AppData\Local\icsys.icn.exe
        C:\Users\Admin\AppData\Local\icsys.icn.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3856
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3760
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4496
            • \??\c:\windows\system\svchost.exe
              c:\windows\system\svchost.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visiblity of hidden/system files in Explorer
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4660
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe PR
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2104
              • C:\Windows\SysWOW64\at.exe
                at 05:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1832
              • C:\Windows\SysWOW64\at.exe
                at 05:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                7⤵
                  PID:5032
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1240
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4436
          • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
            c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:448
            • C:\ProgramData\Synaptics\Synaptics.exe
              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:1836
              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3436
                • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                  c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4392
                  • C:\ProgramData\Synaptics\Synaptics.exe
                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                    8⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:5064
                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2876
                      • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                        c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                        10⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        PID:844
                        • C:\ProgramData\Synaptics\Synaptics.exe
                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                          11⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Modifies registry class
                          PID:2024
                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                            12⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:2956
                            • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                              c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                              13⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1264
                              • C:\ProgramData\Synaptics\Synaptics.exe
                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                14⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                PID:2028
                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                  15⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1116
                                  • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                    c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                    16⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3880
                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                      17⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      PID:2412
                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                        18⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4880
                                        • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                          c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                          19⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3252
                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                            20⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            PID:1964
                                            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                              21⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4624
                                              • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                22⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Adds Run key to start application
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                PID:996
                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                  23⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  PID:2852
                                                  • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                    24⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4824
                                                    • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                      c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                      25⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      PID:3080
                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                        26⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        PID:1484
                                                        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:904
                                                          • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                            c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                            28⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Adds Run key to start application
                                                            • Modifies registry class
                                                            PID:5088
                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                              29⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              PID:4352
                                                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                30⤵
                                                                • Executes dropped EXE
                                                                PID:3220
                                                                • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                  c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                  31⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Adds Run key to start application
                                                                  • Modifies registry class
                                                                  PID:1860
                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                    32⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    PID:2672
                                                                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      PID:1232
                                                                      • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                        c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                        34⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Adds Run key to start application
                                                                        • Modifies registry class
                                                                        PID:1828
                                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                          35⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry class
                                                                          PID:2860
                                                                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                            36⤵
                                                                            • Executes dropped EXE
                                                                            PID:4744
                                                                            • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                              c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                              37⤵
                                                                              • Checks computer location settings
                                                                              • Loads dropped DLL
                                                                              • Adds Run key to start application
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              PID:2164
                                                                              • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                38⤵
                                                                                • Checks computer location settings
                                                                                • Loads dropped DLL
                                                                                • Modifies registry class
                                                                                PID:3972
                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                  39⤵
                                                                                    PID:2836
                                                                                    • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                                      c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                                      40⤵
                                                                                      • Checks computer location settings
                                                                                      • Loads dropped DLL
                                                                                      • Adds Run key to start application
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry class
                                                                                      PID:3612
                                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                        41⤵
                                                                                        • Checks computer location settings
                                                                                        • Loads dropped DLL
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry class
                                                                                        PID:3756
                                                                                        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                          42⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:3184
                                                                                          • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                                            c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                                            43⤵
                                                                                            • Checks computer location settings
                                                                                            • Loads dropped DLL
                                                                                            • Adds Run key to start application
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Modifies registry class
                                                                                            PID:4908
                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                              44⤵
                                                                                              • Checks computer location settings
                                                                                              • Loads dropped DLL
                                                                                              • Modifies registry class
                                                                                              PID:3140
                                                                                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                45⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2564
                                                                                                • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                                                  c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                                                  46⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Loads dropped DLL
                                                                                                  • Adds Run key to start application
                                                                                                  • Modifies registry class
                                                                                                  PID:4028
                                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                    47⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Loads dropped DLL
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies registry class
                                                                                                    PID:4592
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                      48⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3584
                                                                                                      • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                                                        c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                                                        49⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Loads dropped DLL
                                                                                                        • Adds Run key to start application
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Modifies registry class
                                                                                                        PID:1016
                                                                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                          50⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Loads dropped DLL
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Modifies registry class
                                                                                                          PID:1744
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                            51⤵
                                                                                                              PID:2680
                                                                                                              • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                                                                c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                                                                52⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Loads dropped DLL
                                                                                                                • Adds Run key to start application
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry class
                                                                                                                PID:4796
                                                                                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                  53⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4256
                                                                                                              • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                                                C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                                                52⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:1984
                                                                                                                • \??\c:\windows\system\explorer.exe
                                                                                                                  c:\windows\system\explorer.exe
                                                                                                                  53⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:220
                                                                                                        • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                                          C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                                          49⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1816
                                                                                                          • \??\c:\windows\system\explorer.exe
                                                                                                            c:\windows\system\explorer.exe
                                                                                                            50⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2952
                                                                                                  • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                                    C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                                    46⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2964
                                                                                                    • \??\c:\windows\system\explorer.exe
                                                                                                      c:\windows\system\explorer.exe
                                                                                                      47⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2400
                                                                                            • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                              C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                              43⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2808
                                                                                              • \??\c:\windows\system\explorer.exe
                                                                                                c:\windows\system\explorer.exe
                                                                                                44⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:916
                                                                                      • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                        C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                        40⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4124
                                                                                        • \??\c:\windows\system\explorer.exe
                                                                                          c:\windows\system\explorer.exe
                                                                                          41⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4748
                                                                                • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                  C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                  37⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:4540
                                                                                  • \??\c:\windows\system\explorer.exe
                                                                                    c:\windows\system\explorer.exe
                                                                                    38⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1436
                                                                          • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                            C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                            34⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5100
                                                                            • \??\c:\windows\system\explorer.exe
                                                                              c:\windows\system\explorer.exe
                                                                              35⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1244
                                                                    • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                      C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                      31⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2300
                                                                      • \??\c:\windows\system\explorer.exe
                                                                        c:\windows\system\explorer.exe
                                                                        32⤵
                                                                        • Executes dropped EXE
                                                                        PID:1780
                                                              • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                28⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2276
                                                                • \??\c:\windows\system\explorer.exe
                                                                  c:\windows\system\explorer.exe
                                                                  29⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:3964
                                                        • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                          C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                          25⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2644
                                                          • \??\c:\windows\system\explorer.exe
                                                            c:\windows\system\explorer.exe
                                                            26⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4900
                                                  • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                    C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                    22⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4992
                                                    • \??\c:\windows\system\explorer.exe
                                                      c:\windows\system\explorer.exe
                                                      23⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4356
                                            • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                              C:\Users\Admin\AppData\Local\icsys.icn.exe
                                              19⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1432
                                              • \??\c:\windows\system\explorer.exe
                                                c:\windows\system\explorer.exe
                                                20⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5060
                                      • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                        C:\Users\Admin\AppData\Local\icsys.icn.exe
                                        16⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1748
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          17⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4012
                                • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                  C:\Users\Admin\AppData\Local\icsys.icn.exe
                                  13⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5008
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    14⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4876
                          • C:\Users\Admin\AppData\Local\icsys.icn.exe
                            C:\Users\Admin\AppData\Local\icsys.icn.exe
                            10⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:628
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              11⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:556
                    • C:\Users\Admin\AppData\Local\icsys.icn.exe
                      C:\Users\Admin\AppData\Local\icsys.icn.exe
                      7⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:4960
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        8⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:704
              • C:\Users\Admin\AppData\Local\icsys.icn.exe
                C:\Users\Admin\AppData\Local\icsys.icn.exe
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1064
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3920
        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
          1⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: AddClipboardFormatListener
          PID:1696

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Synaptics\RCX3C6B.tmp
          Filesize

          753KB

          MD5

          1cdbeea56a97090c2f052185c334f9b0

          SHA1

          4833d6b5b4930dc9645628bed2e9926c3bf4e1ed

          SHA256

          f154450a0fffcb44f0a5c5c7cafaff34d34ade7bf22c179fe8940c751c696bb4

          SHA512

          c53502086e0ba66029b754be2046d9a478cfd200b96aba529d33a539c59635f8bb339a9b0408b8829f2f9b67a2bc570048f7360e8f23ae49bc96a8b36a3beee3

          Download Submit

        • C:\ProgramData\Synaptics\Synaptics.exe
          Filesize

          2.9MB

          MD5

          7a1a9085e0f549ec511d7d2663099c70

          SHA1

          3b21d3dbc01758bd15fdaab3e3c51513436b6a46

          SHA256

          7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4

          SHA512

          3f0561bcc0583d5b8d68f0666f5de1676e8dbaa817720519a25fa014cc46715ed6c3f2928b976c0e6ab0558939945e6478292a0936f5695d344f4ca58dd6c245

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_synaptics.exe 
          Filesize

          1.2MB

          MD5

          3bec3aeb9f99dbf9c2b6bb89b4add39a

          SHA1

          f401abce66e942f966607d67a432a628622d6516

          SHA256

          eb717518e0e2a90a3e061792ee5b380ee6634fb982c62682e9c6170af8ca46b8

          SHA512

          cb278d7d83c84fe64bd3bde517d29e52df6fa2c94d063d48a2543c296e4e962763b883317844c08e47e8b9dbaf3505cc27782703608b98603e11d776eb7777b7

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\._cache_7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4N.exe
          Filesize

          2.1MB

          MD5

          e3faeb35f56273ecce987a94379d3683

          SHA1

          7cb189451c6c4af1efee17453f90c1a6aae2fabb

          SHA256

          4f5f4b955e6659bcf44c5abab6d692f1adf2f9677751035bf422106af8442180

          SHA512

          7d316bad87a9f895311628a3abf7eebd77dd5774f8935044bd317e50961d2dc60983299acb7aff13f4285b141ab352991ba8ebba64fb9d28f60726a3f6e244cf

          Download Submit

        • C:\Users\Admin\AppData\Local\icsys.icn.exe
          Filesize

          206KB

          MD5

          20602f77608fd2bdebecb54d6ddad08f

          SHA1

          bba0a2150a4fea15db48ea7d2398eb1344cf749f

          SHA256

          0b0ac637272ff103bcf0e0e79df4ab4f36307f1d4386dd2c49f39031969dce62

          SHA512

          82beb0f477c5c5eaa7dedd710ab883b377ce55c385aff0d40136ebc45db2e340664325cbffd52e5604fe0716f9cf91453b0e1b8e1ce0fa1f0291930e1f0e8a1b

          Download Submit

        • C:\Users\Admin\AppData\Roaming\mrsys.exe
          Filesize

          206KB

          MD5

          c44dc10e9c0739c64f19120934f43ec2

          SHA1

          1eac846660d46a776364db7da52359e3bd425870

          SHA256

          b714862cc1b542b907b03642a6219bf1bba8baff8ce5f721846572d5968ae6f4

          SHA512

          9152ef8f9c19624c4e85aef5b5dc2eb4f8af8d906abb048233548517d5e5eb31125701dc780268ee5edf14586b7d008ca208eca9859defd448e9c26d356b6ddf

          Download Submit

        • C:\Windows\System\svchost.exe
          Filesize

          206KB

          MD5

          02bb77daf9c08ba9e34b54409796de1d

          SHA1

          fdb55c133ed9940b7d4536ddeda9d5631ff25513

          SHA256

          7b3c8b347669bca71161c8b2f4d048baff565ae98dbb00fd0ae63e776eba4af8

          SHA512

          e25a6111022ae7d0f33f76565cb0a82fe0c706781ba9b8b7df8ebecb5ea6142c1e0e949c6bbabdc89cdeafe1579ceddeef5470649e71d37a9f6621ce8dfb09a2

          Download Submit

        • \??\c:\users\admin\appdata\local\temp\._cache_7b3d84cf9e2bb957cdf2bde4a694890dfa3b0ee28df8771f21da8fea5323eea4n.exe 
          Filesize

          1.9MB

          MD5

          68dbfb2c9a0951dac513985e40e89d3a

          SHA1

          8083d2cea9e0bf96160b051f19860d2f6e06d65a

          SHA256

          94ca6644e8842c073b9b19ab260214cf9c89bbb4ff65e332d2104ec67b316093

          SHA512

          f7fd4efca17edc8771909b279554e57ed2451db8c41591e8c1dbef2583f24a5e90f9c43a1f16fe874e157b5604ce820cf8f88ee07e8a5ab2010245f18545bebc

          Download Submit

        • \??\c:\windows\system\explorer.exe
          Filesize

          206KB

          MD5

          c3dda635c2d32883b6ac4214941f2fa0

          SHA1

          58938345aeea61e94c7c2f92df6eac4fab3c7f35

          SHA256

          2210d9bad42b2a329dad18b94dd42ec6c5f86ff6f5fe3f17668c6e26de88e208

          SHA512

          3d274594f24ebe171db110586bd7ffbdab8f82d9e696f291046254c4a0959b38e7d0d15e0fa276237e0b4fbf9f62654c4286e43a479a1d7f0955d0f8954f6560

          Download Submit

        • \??\c:\windows\system\spoolsv.exe
          Filesize

          206KB

          MD5

          59929b07ff3e10cd04e0336cfd2178b9

          SHA1

          e3aa807dc9dd6222901b627e7ee4761f336db0d7

          SHA256

          6eaed3a0469ec5d042ea2f020c757ae72b15d270fdca508f0ae3d750eebad7fc

          SHA512

          0902406d87e934ea263a053f225392448682eb6f5dc5b4dc067ebeb1cb9ab2666954af888569df53d4f8f9c8dd925af7b6bb763b7dfd93f6b06aac5573dc9014

          Download Submit

        • memory/448-331-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/556-455-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/628-456-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/704-357-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/844-527-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/844-444-0x0000000002530000-0x0000000002571000-memory.dmp

          Filesize

          260KB

          Download

        • memory/844-443-0x0000000002530000-0x0000000002571000-memory.dmp

          Filesize

          260KB

          Download

        • memory/904-992-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/916-1424-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/996-885-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/996-808-0x0000000003EF0000-0x0000000003F31000-memory.dmp

          Filesize

          260KB

          Download

        • memory/996-807-0x0000000003EF0000-0x0000000003F31000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1016-1665-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1064-263-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1116-644-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1232-1166-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1240-134-0x0000000000870000-0x0000000000871000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1240-264-0x0000000000400000-0x00000000006E0000-memory.dmp

          Filesize

          2.9MB

          Download

        • memory/1244-1164-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1264-542-0x00000000022E0000-0x0000000002321000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1264-624-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1264-543-0x00000000022E0000-0x0000000002321000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1432-730-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1436-1252-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1456-249-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1456-64-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1484-974-0x0000000003EC0000-0x0000000003F01000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1484-993-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1484-973-0x0000000003EC0000-0x0000000003F01000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1696-1760-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1696-1759-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1696-1764-0x00007FFD76230000-0x00007FFD76240000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1696-1763-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1696-1762-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1696-1761-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1696-1765-0x00007FFD76230000-0x00007FFD76240000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1744-1686-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1748-642-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1780-1077-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1828-1233-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1828-1156-0x0000000002570000-0x00000000025B1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1828-1155-0x0000000002570000-0x00000000025B1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1836-360-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1860-1146-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1860-1069-0x00000000023A0000-0x00000000023E1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1860-1068-0x00000000023A0000-0x00000000023E1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1964-819-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1964-799-0x0000000003EB0000-0x0000000003EF1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/1964-800-0x0000000003EB0000-0x0000000003EF1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2024-557-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/2024-531-0x0000000003F00000-0x0000000003F41000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2024-530-0x0000000003F00000-0x0000000003F41000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2028-625-0x0000000002570000-0x00000000025B1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2028-645-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/2028-626-0x0000000002570000-0x00000000025B1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2104-241-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2124-131-0x0000000000400000-0x00000000006E0000-memory.dmp

          Filesize

          2.9MB

          Download

        • memory/2124-0-0x00000000009E0000-0x00000000009E1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2164-1321-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/2164-1243-0x00000000023D0000-0x0000000002411000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2276-991-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2300-1078-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2412-712-0x0000000003EC0000-0x0000000003F01000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2412-713-0x0000000003EC0000-0x0000000003F01000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2412-732-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/2644-904-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2672-1167-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/2672-1147-0x0000000003EB0000-0x0000000003EF1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2672-1148-0x0000000003EB0000-0x0000000003EF1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2836-1339-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2852-886-0x00000000023C0000-0x0000000002401000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2852-887-0x00000000023C0000-0x0000000002401000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2852-906-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/2860-1235-0x0000000003EB0000-0x0000000003EF1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2860-1255-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/2860-1234-0x0000000003EB0000-0x0000000003EF1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2876-457-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2956-556-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3080-895-0x00000000022A0000-0x00000000022E1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3080-894-0x00000000022A0000-0x00000000022E1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3080-972-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/3140-1512-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/3220-1079-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3252-798-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/3252-721-0x0000000003EA0000-0x0000000003EE1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3252-720-0x0000000003EA0000-0x0000000003EE1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3436-358-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3612-1406-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/3756-1408-0x0000000003EF0000-0x0000000003F31000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3756-1427-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/3756-1407-0x0000000003EF0000-0x0000000003F31000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3760-1242-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3856-248-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3856-204-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3880-634-0x0000000003EC0000-0x0000000003F01000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3880-711-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/3880-633-0x0000000003EC0000-0x0000000003F01000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3920-261-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3964-990-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3972-1340-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/3972-1322-0x00000000024F0000-0x0000000002531000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3972-1323-0x00000000024F0000-0x0000000002531000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4012-643-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4028-1578-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/4124-1338-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4256-1752-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

          Download

        • memory/4256-1786-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

          Download

        • memory/4352-1080-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/4352-1061-0x00000000024B0000-0x00000000024F1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4352-1060-0x00000000024B0000-0x00000000024F1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4356-816-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4392-429-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/4392-345-0x0000000003EE0000-0x0000000003F21000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4392-346-0x0000000003EE0000-0x0000000003F21000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4436-262-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4496-246-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4532-247-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/4540-1253-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4592-1599-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/4624-818-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4660-1248-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4744-1254-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4748-1337-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4796-1751-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/4824-905-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4876-554-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4880-731-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4900-903-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4908-1493-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/4908-1415-0x0000000003EB0000-0x0000000003EF1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4908-1416-0x0000000003EB0000-0x0000000003EF1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4960-359-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/4992-817-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/5008-555-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/5060-729-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/5064-432-0x0000000002570000-0x00000000025B1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/5064-458-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/5088-982-0x0000000003E70000-0x0000000003EB1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/5088-981-0x0000000003E70000-0x0000000003EB1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/5088-1059-0x0000000000400000-0x00000000005F0000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/5100-1165-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download