Overview

overview

10

Static

static

10

95ac1cb5a1...f4.exe

windows7-x64

10

95ac1cb5a1...f4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-01-2025 07:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4.exe

  • Size

    3.6MB

  • MD5

    575b18de3bde4f0bac81569918c71040

  • SHA1

    fedcaebb7ac62e2cc2f792a6efd7b5feadfd387c

  • SHA256

    95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4

  • SHA512

    c131d03c17da866ffbb97c56c1fd0798f12ed60c17253f6fdabbb77eadd3650b18d20ad6e16e938219e54899b32c412006d0a2ff2a5aecf4cf572df00d0df6fb

  • SSDEEP

    49152:/YZnsHyjtk2MYC5GD/YKnsHyjtk2MYC5GDsYS1Q+09xqoWh5GisYxMGyN0F:QZnsmtk2a/Knsmtk2aGS6bRWTGZYaG8Q

Score
10/10
xredbackdoordiscoveryevasionpersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 21 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 57 IoCs
  • Loads dropped DLL 36 IoCs
  • Adds Run key to start application 2 TTPs 15 IoCs
    persistence
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 33 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 33 IoCs
  • Modifies registry class 21 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4.exe
    "C:\Users\Admin\AppData\Local\Temp\95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:408
    • \??\c:\users\admin\appdata\local\temp\95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4.exe 
      c:\users\admin\appdata\local\temp\95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4.exe 
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3320
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1568
          • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
            c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3960
            • C:\ProgramData\Synaptics\Synaptics.exe
              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:736
              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:664
                • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                  c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:3132
                  • C:\ProgramData\Synaptics\Synaptics.exe
                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:1072
                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:740
                      • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                        c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:2460
                        • C:\ProgramData\Synaptics\Synaptics.exe
                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          PID:5020
                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:3952
                            • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                              c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              PID:1976
                              • C:\ProgramData\Synaptics\Synaptics.exe
                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                PID:2368
                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2428
                                  • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                    c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    PID:2608
                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      PID:3732
                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3200
                                        • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                          c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          PID:4852
                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                            21⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            PID:3716
                                            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                              22⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1152
                                              • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                23⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Adds Run key to start application
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                PID:1308
                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  PID:4456
                                                  • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2348
                                                    • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                      c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      PID:812
                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        PID:3488
                                                        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4004
                                                          • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                            c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            PID:1476
                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              PID:5264
                                                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5360
                                                                • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                  c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:5440
                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5924
                                                                • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                  C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5540
                                                                  • \??\c:\windows\system\explorer.exe
                                                                    c:\windows\system\explorer.exe
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5608
                                                          • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                            C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3220
                                                            • \??\c:\windows\system\explorer.exe
                                                              c:\windows\system\explorer.exe
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1940
                                                    • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                      C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1356
                                                      • \??\c:\windows\system\explorer.exe
                                                        c:\windows\system\explorer.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:992
                                              • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:4108
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4128
                                        • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                          C:\Users\Admin\AppData\Local\icsys.icn.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4948
                                          • \??\c:\windows\system\explorer.exe
                                            c:\windows\system\explorer.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:232
                                  • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                    C:\Users\Admin\AppData\Local\icsys.icn.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2356
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:996
                            • C:\Users\Admin\AppData\Local\icsys.icn.exe
                              C:\Users\Admin\AppData\Local\icsys.icn.exe
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:4092
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:3260
                      • C:\Users\Admin\AppData\Local\icsys.icn.exe
                        C:\Users\Admin\AppData\Local\icsys.icn.exe
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3872
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:4924
                • C:\Users\Admin\AppData\Local\icsys.icn.exe
                  C:\Users\Admin\AppData\Local\icsys.icn.exe
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4636
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2624
          • C:\Users\Admin\AppData\Local\icsys.icn.exe
            C:\Users\Admin\AppData\Local\icsys.icn.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3604
            • \??\c:\windows\system\explorer.exe
              c:\windows\system\explorer.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3544
    • C:\Users\Admin\AppData\Local\icsys.icn.exe
      C:\Users\Admin\AppData\Local\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1080
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visiblity of hidden/system files in Explorer
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2080
        • \??\c:\windows\system\spoolsv.exe
          c:\windows\system\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1424
          • \??\c:\windows\system\svchost.exe
            c:\windows\system\svchost.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4280
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1176
            • C:\Windows\SysWOW64\at.exe
              at 07:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3528
            • C:\Windows\SysWOW64\at.exe
              at 07:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:6036
            • C:\Windows\SysWOW64\at.exe
              at 07:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4820
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4976
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:1560
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:4476
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:468
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:2376
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:3692
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:4688
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:1956
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:688
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:5372
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:5968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\RCXFE9.tmp
    Filesize

    753KB

    MD5

    ceab064b6d1d8ba57444371889936da1

    SHA1

    ed748ba18c6dadf05e9a6aa008443d055375e71e

    SHA256

    6e0d8597ac91fcebce2757d5ccdff21f256c857b7a3ab06d7da3113ac24c6b3b

    SHA512

    c65afe84060cdf24a8ebca454eca6aa0eb73cb5898c6106dec490f2c37cbac6173d3ea5302812787ff137fea219b4d7506b68f193b4709aff03a46157fc82b24

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\1EE0603C-E2F2-4443-82AF-571FF1956257
    Filesize

    177KB

    MD5

    1ca4cf0ad26460131c6445075cc77c08

    SHA1

    da3673bb6d7057ec921c37c7f390982f38ae4b0c

    SHA256

    1cfd301ff83225ebcc3ac928511cf318a030c582aa7ba19e4c92060d28b325b6

    SHA512

    495ff279ef6b942739f5f7d19f712d016156d1e22ec4b33ca93b76178621154d155635ff524e71f12ab6fe9cf88f97ff427ebf75f30922713b5650093a1b121a

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
    Filesize

    2KB

    MD5

    c815be5fe8580055324f8238891f9fd6

    SHA1

    1592590568929fc56c9e7103983d273815eaf404

    SHA256

    04aa08fd5eb7eebe02bc5a7cfd4535e51b6d41641bfeda553984fefdbd33bd09

    SHA512

    e636f9e95ea8680f4538c4beeae3eee5edf240545fbeafebfa5ab160a36ca3704928ca3b68bda3aa5464bf103c1244c61c1841030a5d3ef22b35fb81c135609c

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
    Filesize

    2KB

    MD5

    4103d09a6f9d4417457a876be9b219fa

    SHA1

    99c7b7f71dcd53543c6a28084ccd977a8e070058

    SHA256

    0d9941f08846a9cc3aae009e31fd2c3dd62c30126719f8f95fa30e52bc0ef4f6

    SHA512

    5380699103c242597fd550fce4aa8c451147a85d5236322ac70372cc45189f7f6a79b05c026925166d11a541fdeb60dd62d8942f9a4e534abdc2d3e8d16dcb27

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_synaptics.exe 
    Filesize

    1.7MB

    MD5

    bc95b2206dd7637fe20a16798c406745

    SHA1

    e77612a366109cd0359917b9a177aa114ba7ca83

    SHA256

    09b41d9c265effd7b2bc78cbaee81c3e977c718ddcedcb506f69ffa178eb5a74

    SHA512

    1d081aea628f10327649404114fa571cc87b053ae195a90ff5d4d59c21c8a932d716a32ea252aac324fa0c39bdab8c46bcc9fe85dccc7dc7312d1d22fb4f6540

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    Filesize

    2.6MB

    MD5

    ffa2e235448687e2b7e37bb8a99f38c9

    SHA1

    153b873d572fb6bc8794f7aeec9c208d50182489

    SHA256

    e6edb39132b26125704af6d10cd43f9153cadafa9e8692b809749ef0bb973161

    SHA512

    32d3829bb1d0e0ac21b7cc3d3d3f0e71a5944ebccbdbe7837b0f8608a91859865cad7b26469ff230a2c7720d2f19784ae51cc62cc27c86553d01451cb72d792b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\19585E00
    Filesize

    21KB

    MD5

    07a43275aa8fb10c70140453ba0d31d9

    SHA1

    547972113c519433ea8cbb6a3b4bc10ae1862bf7

    SHA256

    215653fce998dcacec92c677e132dcfd283a894bb39c4a8e67c77c3346d019ae

    SHA512

    5f4eff5bceb8e312cd53b82e8c3ba202cc11867d6f4d364b766ffc38c843ad2a9a68bc8664117594b41da62d0c006da4a829a4be39f3448da0954b68ee81bb7f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4.exe 
    Filesize

    3.4MB

    MD5

    b7de67b0a46cb2b9323b251d34d34708

    SHA1

    993564e1f3bde5422da5b8e74711868725e2c9df

    SHA256

    4c3a7ee11791b181152ba80fc0c29eef05f6a6617aff56ef0edbb4919fde9581

    SHA512

    b407a869cc5b5e86afff7bbfb24ee4c060cd4600d2fc5ef88de3c804299edcf63a0376209a6f2a9175da659608c12ddf0cea5225106646b83dbda10103fdf25f

    Download Submit

  • C:\Users\Admin\AppData\Local\icsys.icn.exe
    Filesize

    206KB

    MD5

    bd7b5016453c5b3414a4eb30747f0f5e

    SHA1

    f143f1bdaaafe645607024424dc8d8178ca89868

    SHA256

    a3a6970b431c34714ee58bccf9668115194262a7e39f19a58fd8d94249568aae

    SHA512

    82af27b4408c84bca5bad2737da410cb64f691131a603aad4aa4029d8b76194077118bd5147208d8a952248e0077de8db6c74aba247abefc6a1eadb2f0fbd139

    Download Submit

  • C:\Users\Admin\AppData\Local\icsys.icn.exe
    Filesize

    206KB

    MD5

    3343be9774d2c669a6cd6f1296ebeae8

    SHA1

    cf675b229c99320d12201e2a1a3d7d32d26c8485

    SHA256

    efc65b4655e6adef136bf0413e6fe45f70fe990528887fac719f9a03e945a0e2

    SHA512

    f9048d3b02ed7ee56d48c9aa21e5ef2e7bfe1ae6a7517741238fc765568024de65fe82ac94e19e7ef8ac17666407462ed664be059db6b5f5c734f6f8780c14b1

    Download Submit

  • C:\Users\Admin\AppData\Roaming\mrsys.exe
    Filesize

    206KB

    MD5

    b1e3711b0559d42857dad402f7adb23d

    SHA1

    102fad7a7946e0072df27f1940cd2604531c940e

    SHA256

    1a6e0211dfc6d2a421e5ebbd517bf1f782d437b5352849876837eadacdabfc74

    SHA512

    3998de50da5c1b1c999cd80b7081f65e12969462c93f6a432d7688b2252a4c3b360b4de81cf55fbfddb64cb68576473fb67592e2969c05e67574b709e300ef86

    Download Submit

  • C:\Windows\System\explorer.exe
    Filesize

    206KB

    MD5

    83e8fd6bdf93fa73b1b4f3ad6e3e9159

    SHA1

    6625d3999496440496179c6af2f9804d1fad5e35

    SHA256

    52297f704f544f546f6e7a5d52639c9852c04e11482263ec69db754f0a029d43

    SHA512

    aef53f8064462deed938d16307b12ca1239f8d0a470d8cf3130cf0fc707b9b6fbbe54d147c043a3ebed35addd94d2852293a92bfd13c5a62baf8a18c7902c90d

    Download Submit

  • C:\Windows\System\spoolsv.exe
    Filesize

    206KB

    MD5

    7435c43373f5df94417b1d88a0c37069

    SHA1

    52e53eae786a0456e84986ffb22dfdc7dbc0de8b

    SHA256

    e8f511114a718774d9ba8f494c2edc9856a73f677dca3e92236a0a98d87348c3

    SHA512

    572fb8dba47ab61d7faad63c0d53733f4d8b9bbab48d914b3ff5282d5d4ebe0a92700f1d21da48a525316296293c0f1ea669149764b3d912d6dc82f611549d9a

    Download Submit

  • C:\Windows\System\svchost.exe
    Filesize

    206KB

    MD5

    f52ba1a6e034eafcc79d65165180e319

    SHA1

    3d0a8c7ba85ea645200cefac549d157a3ae639ea

    SHA256

    e1413266beaafb7c3262cf9af09f43094956d3c7294a938c8cd51cf2ffad95bc

    SHA512

    bf1c64e075099f65d1fe86639fb77c0bdd27dfbd912b1d6a00445ba412cd0667aa6aebf29a5ecdd76cedfbf652c4a8dc5bd679d03d614a28dfec5c0e21cd6a8d

    Download Submit

  • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
    Filesize

    2.4MB

    MD5

    6aea658a809df0b4e0f2b52204fa1e31

    SHA1

    a1819c28ce05dd8521d74dae1375ad9699791dc0

    SHA256

    ea4087068126db22d789769a45831897cdd3060ea0d7f6368f515b479dde1208

    SHA512

    9ed22b45fdbb4d17fce304d578b3387bfdf1fdca353c2011249987f25d264f443a3b6d1099449fb558f9821c634c2c0a4b5b16dda2c7a1b25076acb4d93c20d3

    Download Submit

  • memory/232-726-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/408-121-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/408-0-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/664-324-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/736-286-0x0000000003F60000-0x0000000003FA1000-memory.dmp

    Filesize

    260KB

    Download

  • memory/736-285-0x0000000003F60000-0x0000000003FA1000-memory.dmp

    Filesize

    260KB

    Download

  • memory/736-325-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/740-434-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/812-904-0x00000000022F0000-0x0000000002331000-memory.dmp

    Filesize

    260KB

    Download

  • memory/992-913-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/996-630-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1072-435-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/1072-399-0x0000000003F50000-0x0000000003F91000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1080-119-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1152-821-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1176-110-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1176-112-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1240-120-0x0000000000400000-0x0000000000767000-memory.dmp

    Filesize

    3.4MB

    Download

  • memory/1240-9-0x0000000002500000-0x0000000002501000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1308-811-0x0000000002230000-0x0000000002271000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1308-810-0x0000000002230000-0x0000000002271000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1308-888-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/1356-914-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1424-118-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1476-998-0x0000000000890000-0x00000000008D1000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1568-183-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1568-213-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1940-1006-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1976-605-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/1976-526-0x0000000002450000-0x0000000002491000-memory.dmp

    Filesize

    260KB

    Download

  • memory/1976-527-0x0000000002450000-0x0000000002491000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2080-23-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2080-1214-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2348-915-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2356-631-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2368-607-0x0000000002600000-0x0000000002641000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2368-633-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2368-606-0x0000000002600000-0x0000000002641000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2428-632-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2460-504-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2460-421-0x0000000003F00000-0x0000000003F41000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2608-621-0x0000000003F20000-0x0000000003F61000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2608-699-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2608-620-0x0000000003F20000-0x0000000003F61000-memory.dmp

    Filesize

    260KB

    Download

  • memory/2624-323-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3132-310-0x0000000002540000-0x0000000002581000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3132-309-0x0000000002540000-0x0000000002581000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3132-396-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/3200-728-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3220-1007-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3260-537-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3320-214-0x0000000000400000-0x0000000000767000-memory.dmp

    Filesize

    3.4MB

    Download

  • memory/3488-984-0x0000000003F40000-0x0000000003F81000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3488-983-0x0000000003F40000-0x0000000003F81000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3544-211-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3604-212-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3716-797-0x0000000003F50000-0x0000000003F91000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3716-796-0x0000000003F50000-0x0000000003F91000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3716-822-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/3732-700-0x0000000003F80000-0x0000000003FC1000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3732-729-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/3732-701-0x0000000003F80000-0x0000000003FC1000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3872-433-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3960-281-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/4004-1008-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4092-538-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4128-820-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4280-1215-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4456-890-0x0000000003F50000-0x0000000003F91000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4456-889-0x0000000003F50000-0x0000000003F91000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4636-322-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4636-313-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4852-717-0x0000000003F80000-0x0000000003FC1000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4852-795-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/4924-432-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4948-727-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/4976-193-0x00007FF88A750000-0x00007FF88A760000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4976-189-0x00007FF88A750000-0x00007FF88A760000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4976-197-0x00007FF8886F0000-0x00007FF888700000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4976-192-0x00007FF88A750000-0x00007FF88A760000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4976-190-0x00007FF88A750000-0x00007FF88A760000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4976-206-0x00007FF8886F0000-0x00007FF888700000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4976-188-0x00007FF88A750000-0x00007FF88A760000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5020-508-0x0000000003FA0000-0x0000000003FE1000-memory.dmp

    Filesize

    260KB

    Download

  • memory/5020-539-0x0000000000400000-0x0000000000677000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/5020-507-0x0000000003FA0000-0x0000000003FE1000-memory.dmp

    Filesize

    260KB

    Download

  • memory/5264-1077-0x0000000003F70000-0x0000000003FB1000-memory.dmp

    Filesize

    260KB

    Download

  • memory/5264-1076-0x0000000003F70000-0x0000000003FB1000-memory.dmp

    Filesize

    260KB

    Download

  • memory/5360-1100-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/5440-1091-0x0000000003F20000-0x0000000003F61000-memory.dmp

    Filesize

    260KB

    Download

  • memory/5540-1099-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download