xred | 0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-02-2025 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
Size

10.9MB
MD5

f7e1cfc6c7f7ff4dd762af36588cda54
SHA1

583e0bfed1a770d4d60fcdb3ed9abe701b7f0f49
SHA256

0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe
SHA512

77f775a2a001a2cbf2146d1c0200f158a7217cf96bc796678b3d1879f0705115239c72c5530cbf930aed57eed18080c7d7dfb784e3d17799f9578cd911530820
SSDEEP

196608:y0I9SsDPwSQZmqFcfpckEi3+9Yq2AyqRZ6VkdLko5pxK13gmli:y0I9HDPwjZ3FAbEdm1qRdlWBgmli

Score

10^/10

xred backdoor discovery persistence upx vmprotect

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 15 IoCs

pid	Process
2448	csrss1.exe
2836	csrss2.exe
3040	svchost.exe
2704	svchost.exe
2648	._cache_csrss1.exe
2660	Synaptics.exe
2852	csrss3.exe
2156	._cache_Synaptics.exe
2472	WinStore.Ap.exe
1012	svchost.exe
1948	svchost.exe
444	._cache_csrss3.exe
2480	WinStore.Ap.exe
2588	svchost.exe
1040	svchost.exe

Loads dropped DLL 31 IoCs

pid	Process
1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
2448	csrss1.exe
2448	csrss1.exe
2448	csrss1.exe
2448	csrss1.exe
2448	csrss1.exe
1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
2660	Synaptics.exe
2660	Synaptics.exe
2660	Synaptics.exe
2648	._cache_csrss1.exe
2648	._cache_csrss1.exe
2852	csrss3.exe
2852	csrss3.exe
2852	csrss3.exe
2156	._cache_Synaptics.exe
2156	._cache_Synaptics.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
1320	WerFault.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1956-39-0x0000000000400000-0x000000000194F000-memory.dmp	vmprotect
behavioral1/memory/1956-48-0x0000000000400000-0x000000000194F000-memory.dmp	vmprotect
behavioral1/memory/1956-186-0x0000000000400000-0x000000000194F000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	csrss1.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000012277-43.dat	upx
behavioral1/memory/2448-50-0x0000000000400000-0x00000000009E4000-memory.dmp	upx
behavioral1/memory/2448-52-0x0000000000400000-0x00000000009E4000-memory.dmp	upx
behavioral1/memory/2660-99-0x0000000000400000-0x00000000009E4000-memory.dmp	upx
behavioral1/memory/2448-95-0x0000000000400000-0x00000000009E4000-memory.dmp	upx
behavioral1/memory/2660-230-0x0000000000400000-0x00000000009E4000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	csrss2.exe
File opened for modification	C:\Windows\svchost.exe	csrss2.exe
File opened for modification	C:\Windows\svchost.exe	WinStore.Ap.exe
File opened for modification	C:\Windows\svchost.exe	WinStore.Ap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2808	3040	WerFault.exe	32
956	1012	WerFault.exe	41
788	2588	WerFault.exe	46
1320	2156	WerFault.exe	39
3032	2648	WerFault.exe	35

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinStore.Ap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_csrss1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_csrss3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2264	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
2648	._cache_csrss1.exe
2648	._cache_csrss1.exe
2156	._cache_Synaptics.exe
2156	._cache_Synaptics.exe
2156	._cache_Synaptics.exe
2156	._cache_Synaptics.exe
2156	._cache_Synaptics.exe
2156	._cache_Synaptics.exe
2156	._cache_Synaptics.exe
2156	._cache_Synaptics.exe
2648	._cache_csrss1.exe
2648	._cache_csrss1.exe
2648	._cache_csrss1.exe
2648	._cache_csrss1.exe
2648	._cache_csrss1.exe
2648	._cache_csrss1.exe
2156	._cache_Synaptics.exe
2648	._cache_csrss1.exe
2156	._cache_Synaptics.exe
2648	._cache_csrss1.exe
2156	._cache_Synaptics.exe
2648	._cache_csrss1.exe
2156	._cache_Synaptics.exe
2648	._cache_csrss1.exe
2156	._cache_Synaptics.exe
2648	._cache_csrss1.exe
2156	._cache_Synaptics.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
2648	._cache_csrss1.exe
2648	._cache_csrss1.exe
2648	._cache_csrss1.exe
2156	._cache_Synaptics.exe
2156	._cache_Synaptics.exe
444	._cache_csrss3.exe
444	._cache_csrss3.exe
2156	._cache_Synaptics.exe
2264	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2448	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	30
PID 1956 wrote to memory of 2448	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	30
PID 1956 wrote to memory of 2448	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	30
PID 1956 wrote to memory of 2448	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	30
PID 1956 wrote to memory of 2836	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	31
PID 1956 wrote to memory of 2836	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	31
PID 1956 wrote to memory of 2836	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	31
PID 1956 wrote to memory of 2836	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	31
PID 3040 wrote to memory of 2704	3040	svchost.exe	33
PID 3040 wrote to memory of 2704	3040	svchost.exe	33
PID 3040 wrote to memory of 2704	3040	svchost.exe	33
PID 3040 wrote to memory of 2704	3040	svchost.exe	33
PID 3040 wrote to memory of 2808	3040	svchost.exe	34
PID 3040 wrote to memory of 2808	3040	svchost.exe	34
PID 3040 wrote to memory of 2808	3040	svchost.exe	34
PID 3040 wrote to memory of 2808	3040	svchost.exe	34
PID 2448 wrote to memory of 2648	2448	csrss1.exe	35
PID 2448 wrote to memory of 2648	2448	csrss1.exe	35
PID 2448 wrote to memory of 2648	2448	csrss1.exe	35
PID 2448 wrote to memory of 2648	2448	csrss1.exe	35
PID 2448 wrote to memory of 2660	2448	csrss1.exe	36
PID 2448 wrote to memory of 2660	2448	csrss1.exe	36
PID 2448 wrote to memory of 2660	2448	csrss1.exe	36
PID 2448 wrote to memory of 2660	2448	csrss1.exe	36
PID 1956 wrote to memory of 2852	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	38
PID 1956 wrote to memory of 2852	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	38
PID 1956 wrote to memory of 2852	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	38
PID 1956 wrote to memory of 2852	1956	0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe	38
PID 2660 wrote to memory of 2156	2660	Synaptics.exe	39
PID 2660 wrote to memory of 2156	2660	Synaptics.exe	39
PID 2660 wrote to memory of 2156	2660	Synaptics.exe	39
PID 2660 wrote to memory of 2156	2660	Synaptics.exe	39
PID 2648 wrote to memory of 2472	2648	._cache_csrss1.exe	40
PID 2648 wrote to memory of 2472	2648	._cache_csrss1.exe	40
PID 2648 wrote to memory of 2472	2648	._cache_csrss1.exe	40
PID 2648 wrote to memory of 2472	2648	._cache_csrss1.exe	40
PID 2852 wrote to memory of 444	2852	csrss3.exe	42
PID 2852 wrote to memory of 444	2852	csrss3.exe	42
PID 2852 wrote to memory of 444	2852	csrss3.exe	42
PID 2852 wrote to memory of 444	2852	csrss3.exe	42
PID 1012 wrote to memory of 1948	1012	svchost.exe	43
PID 1012 wrote to memory of 1948	1012	svchost.exe	43
PID 1012 wrote to memory of 1948	1012	svchost.exe	43
PID 1012 wrote to memory of 1948	1012	svchost.exe	43
PID 1012 wrote to memory of 956	1012	svchost.exe	44
PID 1012 wrote to memory of 956	1012	svchost.exe	44
PID 1012 wrote to memory of 956	1012	svchost.exe	44
PID 1012 wrote to memory of 956	1012	svchost.exe	44
PID 2156 wrote to memory of 2480	2156	._cache_Synaptics.exe	45
PID 2156 wrote to memory of 2480	2156	._cache_Synaptics.exe	45
PID 2156 wrote to memory of 2480	2156	._cache_Synaptics.exe	45
PID 2156 wrote to memory of 2480	2156	._cache_Synaptics.exe	45
PID 2588 wrote to memory of 1040	2588	svchost.exe	47
PID 2588 wrote to memory of 1040	2588	svchost.exe	47
PID 2588 wrote to memory of 1040	2588	svchost.exe	47
PID 2588 wrote to memory of 1040	2588	svchost.exe	47
PID 2588 wrote to memory of 788	2588	svchost.exe	48
PID 2588 wrote to memory of 788	2588	svchost.exe	48
PID 2588 wrote to memory of 788	2588	svchost.exe	48
PID 2588 wrote to memory of 788	2588	svchost.exe	48
PID 2156 wrote to memory of 1320	2156	._cache_Synaptics.exe	50
PID 2156 wrote to memory of 1320	2156	._cache_Synaptics.exe	50
PID 2156 wrote to memory of 1320	2156	._cache_Synaptics.exe	50
PID 2156 wrote to memory of 1320	2156	._cache_Synaptics.exe	50

C:\Users\Admin\AppData\Local\Temp\0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe
"C:\Users\Admin\AppData\Local\Temp\0332f856f89265c4e07f109108afdc3a68effd45a570a1a837c8f7b5b875f4fe.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\csrss1.exe
  C:\Users\Admin\AppData\Local\Temp\csrss1.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Users\Admin\AppData\Local\Temp\._cache_csrss1.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_csrss1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\WinStore.Ap.exe
      C:\Users\Admin\AppData\Local\Temp\WinStore.Ap.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 844
      4⤵
      Loads dropped DLL
      Program crash
      PID:3032
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\WinStore.Ap.exe
        
        C:\Users\Admin\AppData\Local\Temp\WinStore.Ap.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2480
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 836
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1320
- C:\Users\Admin\AppData\Local\Temp\csrss2.exe
  C:\Users\Admin\AppData\Local\Temp\csrss2.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2836
- C:\Users\Admin\AppData\Local\Temp\csrss3.exe
  C:\Users\Admin\AppData\Local\Temp\csrss3.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\._cache_csrss3.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_csrss3.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:444

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 172
  2⤵
  - Program crash
  PID:2808

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 172
  2⤵
  - Program crash
  PID:956

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 172
  2⤵
  - Program crash
  PID:788

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\._cache_csrss1.exe

Filesize
5.0MB

MD5
044d17f97d75da98e9eb2aa62ec7b75a

SHA1
0115b76acb7424b55252416f5f96dfcbd8575c17

SHA256
d9161c71e9aa4ed4cbe22b6fda94e18c85b43125fc5cee102daa0db5f9b60a34

SHA512
f3e3d0ec861a0ee5aedf45b2d05c0a4de4cece59ce7c848e1294885a22409a8d88ab045c52606a4bd60585d7ac8ec084b200886f518cafb691eb0333385f2200

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_csrss3.exe

Filesize
700KB

MD5
e90eddc4db34ec03b80c552e53b5c69c

SHA1
885cff8c7f6fcc362332dcaec0beadb73ea28eba

SHA256
7e7825184c8bd575fac683ee957fc530100de3399e22d611d12ddf155d62e336

SHA512
3e9fae21e9a528072fc8add9bb3bd8a2f6183fc4375beebe05e4ae0383cfc4619dbd1061737eeea439caea1f9bb81dab1cf9c5b887077024b8d92bb1a5807095

Download Submit
C:\Users\Admin\AppData\Local\Temp\LfcZDbfx.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\LfcZDbfx.xlsm

Filesize
24KB

MD5
b0efc43925b7550685e18b7e480301e3

SHA1
fa60b1b2f2ec1200644a4227847fbb442ec7f7dd

SHA256
eb4a4dd4807131f9b8d2c4f09bbc3f40fbcd1b410eaefa0960a6a59dc2013152

SHA512
73ef773175f47a53822c4a3b2f4fa93fce56bd8c71016e4c06a56c190d0bfbf15f752d34b3ffded6d16d0d8651f3e5404c6428c85d8e86e6cd33729157f40fd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinStore.Ap.exe

Filesize
36KB

MD5
6bcfc02cec27994f21fbd864eab7cced

SHA1
941469f26107f8e5576943b8a6f1338a2a0694b8

SHA256
aac2fcb25f1022e52ca001f655c50e94f59b8cb1447a3a89b31f5b51b1c1cbc3

SHA512
1988fe89ccd35335927ec444b6d0c178d28198f3270bb12bad89fc5a9e70527a5a03b9c7c89330dc7dafc141d2156eb2795288454c74c9a8c8e0abcdd5378fc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss3.exe

Filesize
1.4MB

MD5
948ef47cbef691ed14da3dd81fd12d99

SHA1
3d495e706c9456d76d19013cb89ff87c874f2e8e

SHA256
ef700e93e37470b99acbcd35e450bf63f03b19a362d3821350c62abacd6c9d54

SHA512
9f0b5268794f4b168fb6ae0197a1f56acba6d9820f295cc24947354b8cece0dadfca0f5f7967f607f578125de39232a801e17c6f1f14b35288c98c16d6a37d62

Download Submit
\Users\Admin\AppData\Local\Temp\csrss1.exe

Filesize
5.1MB

MD5
f33b166aa53dcbdb6ee38dbc041ed51b

SHA1
fd77e28afa1008b7a2d43191fea2a42bbab37df2

SHA256
aa5fe8561ad9325981bd6f514c25b8a15571120638fb37ad6e151b8f4defe135

SHA512
8f3a82e3921796c092c31b1e7aefa15776b277810f5248bb39988af7cb1576aafc974e9046a2defa5f2e959269f4dbcba8244afc67463348afc8c66a675cf619

Download Submit
\Users\Admin\AppData\Local\Temp\csrss2.exe

Filesize
36KB

MD5
1c47934968624092ab9d889aa6c42f89

SHA1
6371c0b5bf568225e637a9049d3b7b2888e7ec1f

SHA256
ee8f0bab814a672f624ed59f157806229cc194aaf3704aea7f49e6f5fd70c0b0

SHA512
d35c84a17e29d401a563dfa7b9b0c56d3a266a5bdc00dc85ee2e35b44931639c4b1ddd08ef178797144086fa3a09c3daad35340e0c99217f06adfdecc069752c

Download Submit
memory/444-297-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/444-185-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1956-7-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1956-48-0x0000000000400000-0x000000000194F000-memory.dmp

Filesize
21.3MB

Download
memory/1956-9-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1956-35-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1956-5-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1956-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1956-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1956-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1956-39-0x0000000000400000-0x000000000194F000-memory.dmp

Filesize
21.3MB

Download
memory/1956-14-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1956-49-0x0000000003600000-0x0000000003BE4000-memory.dmp

Filesize
5.9MB

Download
memory/1956-33-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1956-51-0x0000000003600000-0x0000000003BE4000-memory.dmp

Filesize
5.9MB

Download
memory/1956-24-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1956-31-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1956-17-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1956-30-0x0000000000B3C000-0x0000000000E6B000-memory.dmp

Filesize
3.2MB

Download
memory/1956-19-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1956-187-0x0000000003600000-0x0000000003BE4000-memory.dmp

Filesize
5.9MB

Download
memory/1956-184-0x0000000000B3C000-0x0000000000E6B000-memory.dmp

Filesize
3.2MB

Download
memory/1956-29-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1956-12-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1956-186-0x0000000000400000-0x000000000194F000-memory.dmp

Filesize
21.3MB

Download
memory/1956-27-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1956-22-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2448-97-0x0000000005F10000-0x00000000064F4000-memory.dmp

Filesize
5.9MB

Download
memory/2448-95-0x0000000000400000-0x00000000009E4000-memory.dmp

Filesize
5.9MB

Download
memory/2448-50-0x0000000000400000-0x00000000009E4000-memory.dmp

Filesize
5.9MB

Download
memory/2448-52-0x0000000000400000-0x00000000009E4000-memory.dmp

Filesize
5.9MB

Download
memory/2448-71-0x0000000004510000-0x0000000004520000-memory.dmp

Filesize
64KB

Download
memory/2448-98-0x0000000004510000-0x0000000004520000-memory.dmp

Filesize
64KB

Download
memory/2448-96-0x0000000005F10000-0x00000000064F4000-memory.dmp

Filesize
5.9MB

Download
memory/2648-126-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2648-116-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2648-121-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2648-124-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2648-84-0x0000000010000000-0x0000000010891000-memory.dmp

Filesize
8.6MB

Download
memory/2648-129-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2648-131-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2648-134-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2660-165-0x0000000004500000-0x0000000004510000-memory.dmp

Filesize
64KB

Download
memory/2660-99-0x0000000000400000-0x00000000009E4000-memory.dmp

Filesize
5.9MB

Download
memory/2660-230-0x0000000000400000-0x00000000009E4000-memory.dmp

Filesize
5.9MB

Download
memory/2660-241-0x0000000004500000-0x0000000004510000-memory.dmp

Filesize
64KB

Download