Overview

overview

10

Static

static

10

95ac1cb5a1...4N.exe

windows7-x64

10

95ac1cb5a1...4N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-01-2025 22:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4N.exe

  • Size

    3.6MB

  • MD5

    575b18de3bde4f0bac81569918c71040

  • SHA1

    fedcaebb7ac62e2cc2f792a6efd7b5feadfd387c

  • SHA256

    95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4

  • SHA512

    c131d03c17da866ffbb97c56c1fd0798f12ed60c17253f6fdabbb77eadd3650b18d20ad6e16e938219e54899b32c412006d0a2ff2a5aecf4cf572df00d0df6fb

  • SSDEEP

    49152:/YZnsHyjtk2MYC5GD/YKnsHyjtk2MYC5GDsYS1Q+09xqoWh5GisYxMGyN0F:QZnsmtk2a/Knsmtk2aGS6bRWTGZYaG8Q

Score
10/10
xredbackdoordefense_evasiondiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 27 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 48 IoCs
  • Adds Run key to start application 2 TTPs 18 IoCs
    persistence
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 42 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 42 IoCs
  • Modifies registry class 27 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4N.exe
    "C:\Users\Admin\AppData\Local\Temp\95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1352
    • \??\c:\users\admin\appdata\local\temp\95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4n.exe 
      c:\users\admin\appdata\local\temp\95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4n.exe 
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1156
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4116
          • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
            c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3484
            • C:\ProgramData\Synaptics\Synaptics.exe
              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:1468
              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1436
                • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                  c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3820
                  • C:\ProgramData\Synaptics\Synaptics.exe
                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:2308
                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:5004
                      • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                        c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:3428
                        • C:\ProgramData\Synaptics\Synaptics.exe
                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          PID:4736
                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:4232
                            • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                              c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              PID:4520
                              • C:\ProgramData\Synaptics\Synaptics.exe
                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                PID:116
                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4944
                                  • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                    c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    PID:4340
                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      PID:2012
                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3764
                                        • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                          c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          PID:4036
                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                            21⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            PID:3560
                                            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                              22⤵
                                              • Executes dropped EXE
                                              PID:3276
                                              • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                23⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Adds Run key to start application
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                PID:2368
                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  PID:1376
                                                  • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:684
                                                    • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                      c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      PID:4452
                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        PID:4788
                                                        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4548
                                                          • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                            c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            PID:2756
                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              PID:5172
                                                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5240
                                                                • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                  c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:5420
                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    PID:5860
                                                                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6036
                                                                      • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                        c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                        35⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Adds Run key to start application
                                                                        • Modifies registry class
                                                                        PID:6120
                                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                          36⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Modifies registry class
                                                                          PID:5224
                                                                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5688
                                                                            • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                              c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                              38⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Adds Run key to start application
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              PID:5704
                                                                              • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                39⤵
                                                                                • Checks computer location settings
                                                                                • Loads dropped DLL
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry class
                                                                                PID:5460
                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:5920
                                                                                  • \??\c:\users\admin\appdata\local\temp\._cache_synaptics.exe 
                                                                                    c:\users\admin\appdata\local\temp\._cache_synaptics.exe  InjUpdate
                                                                                    41⤵
                                                                                    • Checks computer location settings
                                                                                    • Loads dropped DLL
                                                                                    • Adds Run key to start application
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry class
                                                                                    PID:5244
                                                                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:5296
                                                                                  • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                    C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                                    41⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:5468
                                                                                    • \??\c:\windows\system\explorer.exe
                                                                                      c:\windows\system\explorer.exe
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:6104
                                                                            • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                              C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5800
                                                                              • \??\c:\windows\system\explorer.exe
                                                                                c:\windows\system\explorer.exe
                                                                                39⤵
                                                                                  PID:5876
                                                                        • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                          C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                          35⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2228
                                                                          • \??\c:\windows\system\explorer.exe
                                                                            c:\windows\system\explorer.exe
                                                                            36⤵
                                                                            • Executes dropped EXE
                                                                            PID:4424
                                                                  • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                    C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                                    32⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5452
                                                                    • \??\c:\windows\system\explorer.exe
                                                                      c:\windows\system\explorer.exe
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      PID:5516
                                                            • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                              C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4964
                                                              • \??\c:\windows\system\explorer.exe
                                                                c:\windows\system\explorer.exe
                                                                30⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1856
                                                      • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                        C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                        26⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1356
                                                        • \??\c:\windows\system\explorer.exe
                                                          c:\windows\system\explorer.exe
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2276
                                                • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                  C:\Users\Admin\AppData\Local\icsys.icn.exe
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3680
                                                  • \??\c:\windows\system\explorer.exe
                                                    c:\windows\system\explorer.exe
                                                    24⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1340
                                          • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                            C:\Users\Admin\AppData\Local\icsys.icn.exe
                                            20⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2624
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              21⤵
                                              • Executes dropped EXE
                                              PID:1016
                                    • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                      C:\Users\Admin\AppData\Local\icsys.icn.exe
                                      17⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1332
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        18⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4620
                              • C:\Users\Admin\AppData\Local\icsys.icn.exe
                                C:\Users\Admin\AppData\Local\icsys.icn.exe
                                14⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:1380
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  15⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4656
                        • C:\Users\Admin\AppData\Local\icsys.icn.exe
                          C:\Users\Admin\AppData\Local\icsys.icn.exe
                          11⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:4028
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            12⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:4260
                  • C:\Users\Admin\AppData\Local\icsys.icn.exe
                    C:\Users\Admin\AppData\Local\icsys.icn.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3244
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      9⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4100
            • C:\Users\Admin\AppData\Local\icsys.icn.exe
              C:\Users\Admin\AppData\Local\icsys.icn.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3760
              • \??\c:\windows\system\explorer.exe
                c:\windows\system\explorer.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3616
      • C:\Users\Admin\AppData\Local\icsys.icn.exe
        C:\Users\Admin\AppData\Local\icsys.icn.exe
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1060
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4544
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1720
            • \??\c:\windows\system\svchost.exe
              c:\windows\system\svchost.exe
              5⤵
              • Modifies WinLogon for persistence
              • Modifies visiblity of hidden/system files in Explorer
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4956
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe PR
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2264
              • C:\Windows\SysWOW64\at.exe
                at 22:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2572
              • C:\Windows\SysWOW64\at.exe
                at 22:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3296
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1752
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      PID:1604
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      PID:1416
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      PID:4800
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      PID:1440
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      PID:408
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:2508
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:1392
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:4632
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:5256
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:6052
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:5696
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:5472
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:5500

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Synaptics\RCXC861.tmp
      Filesize

      753KB

      MD5

      ceab064b6d1d8ba57444371889936da1

      SHA1

      ed748ba18c6dadf05e9a6aa008443d055375e71e

      SHA256

      6e0d8597ac91fcebce2757d5ccdff21f256c857b7a3ab06d7da3113ac24c6b3b

      SHA512

      c65afe84060cdf24a8ebca454eca6aa0eb73cb5898c6106dec490f2c37cbac6173d3ea5302812787ff137fea219b4d7506b68f193b4709aff03a46157fc82b24

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\A66E7CA9-56F5-49A2-95A7-814798250E8D
      Filesize

      177KB

      MD5

      fdb0b8ebf058a7f559fe85b3e33783d0

      SHA1

      7feb483ec06e70f349b95651becc5e785e8ec40b

      SHA256

      fdf72f44e08097e8087eb5259ccd6b20187f6ab4ae7b6be73c0851e56c632d95

      SHA512

      ae2dc576962572bc31c38facab946c7f7b23177998af760f22f0e89930ff6c5d3837d064ed24384b00fbb18349da0018dbfd7df16f283a8a2673ce119cde44d2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
      Filesize

      12KB

      MD5

      9e819cdd7bb6d52d68fed4e516532de3

      SHA1

      e28955120850521057df8f3438ee8482db3f8834

      SHA256

      622991d48f8b706001e700cf962a47c441809d2ee8fcd624a246f26249c9c304

      SHA512

      d80fe68f1d942d9bcab94d7f336cb671ec110f16cfbccb4daa57b4322303e14b015a7161d477cde2830d1ce38baf011f106726060c7f26f8c800c11945c101dc

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
      Filesize

      2KB

      MD5

      7cc76fcc2defc19fb30142733265b6da

      SHA1

      725a2911577fd146b2b07df1784ff65a6d3d56c9

      SHA256

      4c1ce334edeae73a6818f4830607a0e6fb8bcacfa58c5ad679cfd8e7fe9d7fe0

      SHA512

      c3963a26e54fb88100ee073128a1c1703bed3cd03ffa2321f65efa7a307926bdf42ea15abd56536c0697c8c303a48833e4385765d939d4b3d15e9645dd69db05

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
      Filesize

      2KB

      MD5

      8dada9d08ca2a650751c00150e0ca10e

      SHA1

      acc121297dd97f557df88514cfe52406f256435b

      SHA256

      c0a7c919cf29d40c7ec94c51e9aad092630d6dee81db58ad5d83d1dbd9133dc3

      SHA512

      30d929af912433dc5766b5bf10b8fbb888fd3bd47082e8fef368a37b0565fd15849db2be6fb2a8736176bcfa8787ec745fc3b24761e2f045a74ee8e125c5e73b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_synaptics.exe 
      Filesize

      1.7MB

      MD5

      bc95b2206dd7637fe20a16798c406745

      SHA1

      e77612a366109cd0359917b9a177aa114ba7ca83

      SHA256

      09b41d9c265effd7b2bc78cbaee81c3e977c718ddcedcb506f69ffa178eb5a74

      SHA512

      1d081aea628f10327649404114fa571cc87b053ae195a90ff5d4d59c21c8a932d716a32ea252aac324fa0c39bdab8c46bcc9fe85dccc7dc7312d1d22fb4f6540

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      Filesize

      2.6MB

      MD5

      ffa2e235448687e2b7e37bb8a99f38c9

      SHA1

      153b873d572fb6bc8794f7aeec9c208d50182489

      SHA256

      e6edb39132b26125704af6d10cd43f9153cadafa9e8692b809749ef0bb973161

      SHA512

      32d3829bb1d0e0ac21b7cc3d3d3f0e71a5944ebccbdbe7837b0f8608a91859865cad7b26469ff230a2c7720d2f19784ae51cc62cc27c86553d01451cb72d792b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\._cache_synaptics.exe 
      Filesize

      2.4MB

      MD5

      6aea658a809df0b4e0f2b52204fa1e31

      SHA1

      a1819c28ce05dd8521d74dae1375ad9699791dc0

      SHA256

      ea4087068126db22d789769a45831897cdd3060ea0d7f6368f515b479dde1208

      SHA512

      9ed22b45fdbb4d17fce304d578b3387bfdf1fdca353c2011249987f25d264f443a3b6d1099449fb558f9821c634c2c0a4b5b16dda2c7a1b25076acb4d93c20d3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\18285E00
      Filesize

      24KB

      MD5

      32edb9dea87d4d2ac98ba8c14199052c

      SHA1

      c2c2cfa93c97668676256bc22e99f213a303de9b

      SHA256

      88e10b581f0fb503635e301182da9ffd9527f56a6cd0def4118ca5b3994dfcd3

      SHA512

      19ea5a9b3dd1d78c365ae1b3172b9aaa9e46855c336d891be1a43c224b625628609469be9e39ff863c43453f85bf8e8e0d8bf025c57533bd3655674e0579c969

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\95ac1cb5a12aa976d60eb2b2e0639c61311a8430f4b4656aebc56b85ec2abff4n.exe 
      Filesize

      3.4MB

      MD5

      b7de67b0a46cb2b9323b251d34d34708

      SHA1

      993564e1f3bde5422da5b8e74711868725e2c9df

      SHA256

      4c3a7ee11791b181152ba80fc0c29eef05f6a6617aff56ef0edbb4919fde9581

      SHA512

      b407a869cc5b5e86afff7bbfb24ee4c060cd4600d2fc5ef88de3c804299edcf63a0376209a6f2a9175da659608c12ddf0cea5225106646b83dbda10103fdf25f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\XPhmPWcJ.xlsm
      Filesize

      17KB

      MD5

      e566fc53051035e1e6fd0ed1823de0f9

      SHA1

      00bc96c48b98676ecd67e81a6f1d7754e4156044

      SHA256

      8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

      SHA512

      a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

      Download Submit

    • C:\Users\Admin\AppData\Local\icsys.icn.exe
      Filesize

      206KB

      MD5

      bd7b5016453c5b3414a4eb30747f0f5e

      SHA1

      f143f1bdaaafe645607024424dc8d8178ca89868

      SHA256

      a3a6970b431c34714ee58bccf9668115194262a7e39f19a58fd8d94249568aae

      SHA512

      82af27b4408c84bca5bad2737da410cb64f691131a603aad4aa4029d8b76194077118bd5147208d8a952248e0077de8db6c74aba247abefc6a1eadb2f0fbd139

      Download Submit

    • C:\Users\Admin\AppData\Local\icsys.icn.exe
      Filesize

      206KB

      MD5

      3343be9774d2c669a6cd6f1296ebeae8

      SHA1

      cf675b229c99320d12201e2a1a3d7d32d26c8485

      SHA256

      efc65b4655e6adef136bf0413e6fe45f70fe990528887fac719f9a03e945a0e2

      SHA512

      f9048d3b02ed7ee56d48c9aa21e5ef2e7bfe1ae6a7517741238fc765568024de65fe82ac94e19e7ef8ac17666407462ed664be059db6b5f5c734f6f8780c14b1

      Download Submit

    • C:\Users\Admin\AppData\Roaming\mrsys.exe
      Filesize

      206KB

      MD5

      d41b05b67313e086fd477a5fd8ac35bc

      SHA1

      52932a1358d1be85949953291ebab76fc104bb81

      SHA256

      cf9ff8b3ce298305d1bf22a75d694aa52b75b3c0f53621037666e5792bff3efc

      SHA512

      9fc4725ce9fbbbbc20ca861407253a7b27358d068d69a6d01ae7efe56d3d799b1c72a1a5020a0db2052f2fb10c65adff358f56a1b1f4933ba2d181f17ab43d44

      Download Submit

    • C:\Windows\System\explorer.exe
      Filesize

      206KB

      MD5

      eea0ec93e2a3ec910b6adb0d7863496f

      SHA1

      8095450908ab5f6da2952b22536b0a31a87f8535

      SHA256

      631ccaf7422544cc05e201d27e298cf292407e41cb77dcc38c2489936d5293c9

      SHA512

      9b0b768dda089fceeb4725c16334157e0f2d0d2775e48a7d7eac2d065f9b9a02f8ae5f4def23c891d05d32e5876d20897f83ae86737f1ad154ec0514944b1951

      Download Submit

    • C:\Windows\System\spoolsv.exe
      Filesize

      206KB

      MD5

      506f4ba8f907d7e3f5de06e62ce90d34

      SHA1

      56ba23a687614ebb84fb571b7879fb79a9055068

      SHA256

      a1cbd99d9a35e4724867cabe5c1be6e4f2ba665f9537bb648fbd9e4152d29e99

      SHA512

      bd52df17007bbfd8a6ef6864c05d98548541c86f5b20fa0aa440fd61032c250084c5c3235f8311884b3e8b7571f8ccae90501c342333f365313d13813c74b316

      Download Submit

    • C:\Windows\System\svchost.exe
      Filesize

      206KB

      MD5

      8fe111c88c4517031006dd3c08b9314f

      SHA1

      3ccf91d56df80fa32773b484c07ea97cc895a2d6

      SHA256

      ce672a59e153e241b63cc2e2b79674e3f47f3c2b72307f21af900a00ed802c9a

      SHA512

      f0213514778aac014a7b873bb4e2e7608ed94aa9311b04d884397d9b210786fe9c7187c57f06243a4e8e75b8b60fa6db753a9836500fb46f43799a7f342da5de

      Download Submit

    • memory/116-634-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/116-609-0x00000000022A0000-0x00000000022E1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/116-608-0x00000000022A0000-0x00000000022E1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/684-919-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1016-728-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1060-15-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1060-109-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1156-215-0x0000000000400000-0x0000000000767000-memory.dmp

      Filesize

      3.4MB

      Download

    • memory/1340-821-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1352-0-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1352-111-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1356-918-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1376-891-0x0000000003F60000-0x0000000003FA1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1376-892-0x0000000003F60000-0x0000000003FA1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1380-539-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1436-328-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1468-286-0x0000000003FB0000-0x0000000003FF1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1468-329-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/1468-287-0x0000000003FB0000-0x0000000003FF1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1720-108-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1720-34-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1752-190-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1752-193-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1752-188-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1752-197-0x00007FF8F4420000-0x00007FF8F4430000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1752-192-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1752-208-0x00007FF8F4420000-0x00007FF8F4430000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1752-189-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1856-1010-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2012-701-0x0000000003F70000-0x0000000003FB1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2012-730-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2228-1200-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2264-57-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2276-917-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2308-404-0x0000000003F50000-0x0000000003F91000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2308-437-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2368-813-0x0000000003F10000-0x0000000003F51000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2368-890-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2368-812-0x0000000003F10000-0x0000000003F51000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2624-727-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2756-1001-0x0000000003F30000-0x0000000003F71000-memory.dmp

      Filesize

      260KB

      Download

    • memory/2756-1002-0x0000000003F30000-0x0000000003F71000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3244-327-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3276-823-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3428-507-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/3428-422-0x0000000003F00000-0x0000000003F41000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3484-282-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/3560-824-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/3560-797-0x0000000002480000-0x00000000024C1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3560-798-0x0000000002480000-0x00000000024C1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3616-212-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3680-822-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3760-202-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3760-213-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3764-729-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3820-401-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/3820-311-0x00000000028D0000-0x0000000002911000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3820-312-0x00000000028D0000-0x0000000002911000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4028-434-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4036-717-0x0000000003F30000-0x0000000003F71000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4036-796-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/4036-718-0x0000000003F30000-0x0000000003F71000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4100-326-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4116-183-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4116-214-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4156-122-0x0000000000400000-0x0000000000767000-memory.dmp

      Filesize

      3.4MB

      Download

    • memory/4156-9-0x00000000024F0000-0x00000000024F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4232-540-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4260-433-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4340-622-0x00000000025D0000-0x0000000002611000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4340-623-0x00000000025D0000-0x0000000002611000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4340-700-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/4424-1198-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4452-909-0x0000000003EF0000-0x0000000003F31000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4452-908-0x0000000003EF0000-0x0000000003F31000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4520-530-0x0000000003EF0000-0x0000000003F31000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4520-529-0x0000000003EF0000-0x0000000003F31000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4520-607-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/4544-1268-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4548-1012-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4620-632-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4656-538-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4736-541-0x0000000000400000-0x0000000000677000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/4736-510-0x0000000002540000-0x0000000002581000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4736-511-0x0000000002540000-0x0000000002581000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4788-987-0x00000000023B0000-0x00000000023F1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4944-633-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4956-1271-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/4964-1011-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5004-435-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5172-1081-0x0000000003F40000-0x0000000003F81000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5172-1080-0x0000000003F40000-0x0000000003F81000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5224-1269-0x0000000003FA0000-0x0000000003FE1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5224-1270-0x0000000003FA0000-0x0000000003FE1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5240-1108-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5244-1379-0x0000000002440000-0x0000000002481000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5244-1378-0x0000000002440000-0x0000000002481000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5420-1096-0x0000000003EF0000-0x0000000003F31000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5420-1095-0x0000000003EF0000-0x0000000003F31000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5452-1106-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5460-1364-0x0000000002480000-0x00000000024C1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5468-1388-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5516-1105-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5688-1296-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5704-1285-0x0000000002320000-0x0000000002361000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5704-1284-0x0000000002320000-0x0000000002361000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5800-1294-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5860-1175-0x0000000003F70000-0x0000000003FB1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5876-1295-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/5920-1389-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/6036-1201-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/6104-1387-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/6120-1188-0x0000000003FA0000-0x0000000003FE1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/6120-1189-0x0000000003FA0000-0x0000000003FE1000-memory.dmp

      Filesize

      260KB

      Download