Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- user interaction
yes - max time kernel
78s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20251231-en - resource tags
- submitted
17/01/2026, 16:48
General
- Target Synaptics.exe
- Size 764KB
- Sample260117-vbc3sagy6d
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
mylobot
-
pqrqtaz.ru:9879
-
pickcas.ru:6464
-
quwkbin.ru:3496
-
rkbupij.ru:6653
-
pcqmayq.ru:3629
-
mmuliwe.ru:3541
-
stoizji.ru:5189
-
sfdfrhh.ru:3511
-
ynciazz.ru:4127
-
mkglhnw.ru:1946
-
njeeili.ru:9987
-
dldzeoo.ru:7525
-
tkbiqjq.ru:5145
-
uenosbl.ru:2935
-
faayshc.ru:9865
-
nttfazc.ru:6761
-
nfwsyog.ru:7172
-
uyfusxm.ru:7372
-
hxkclwx.ru:1294
-
zgoysam.ru:2338
Extracted
-
metasploit
-
metasploit_stager
-
103.165.81.230:8848
Extracted
-
xworm
-
XWorm V5.6
-
147.185.221.25:63795
-
Install_directory
%AppData%
-
install_file
XClient.exe
Extracted
-
asyncrat
-
0.5.8
-
Default
-
196.251.107.104:6606
-
196.251.107.104:7707
-
196.251.107.104:8808
-
kqNlEor85bqX
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
-
bdaejec
-
ddos.dnsnb8.net
Extracted
-
discordrat
-
discord_token
MTE1ODQ5NzkyODQ2MjIwNTExOQ.GRJ0l6.7SpFGKSu5G_J8dWAJje9hfCtSecIS6RuVXIE_E
-
server_id
1153564868197236846
Extracted
-
quasar
-
1.4.1
-
DDNS
-
193.161.193.99:32471
-
807f3187-d087-4fff-beff-e73293a32af8
-
encryption_key
81A0C14D4C705B3C678E573C849DE7F6A3671A8B
-
install_name
jusched.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
CachedLogs
-
reconnect_delay
3000
-
startup_key
Java Update Scheduler
-
subdirectory
Java
Extracted
-
gurcu
-
https://api.telegram.org/bot7617703274:AAFEXxgPRP1fZGT5UCjcRV4hUZdtNFxyusQ/sendMessage?chat_id=-4568449403
-
http://209.38.221.184:8080
-
http://46.235.26.83:8080
-
http://147.28.185.29:80
-
http://206.166.251.4:8080
-
http://51.159.4.50:8080
-
http://167.235.70.96:8080
-
http://194.164.198.113:8080
-
http://132.145.17.167:9090
-
https://5.196.181.135:443
-
http://116.202.101.219:8080
-
https://185.217.98.121:443
-
http://185.217.98.121:8080
-
http://159.203.174.113:8090
-
http://107.161.20.142:8080
-
https://192.99.196.191:443
-
http://65.49.205.24:8080
-
https://154.9.207.142:443
-
http://67.230.176.97:8080
-
http://8.222.143.111:8080
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Bdaejec
Bdaejec is a backdoor written in C++.
- Bdaejec family
- Detect Neshta payload 5 IoCs
- Detect Xworm Payload 4 IoCs
- Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
- Detects MaskGramStealer payload 1 IoCs
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Gurcu family
- Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
- MaskGramStealer
MaskGramStealer is an information stealer.
- Maskgram_stealer family
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Metasploit family
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Mimikatz family
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Modiloader family
- Mylobot
Botnet which first appeared in 2017 written in C++.
- Mylobot family
- Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Neshta family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 3 IoCs
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
- Async RAT payload 1 IoCs
- ModiLoader Second Stage 1 IoCs
- Downloads MZ/PE file 24 IoCs
- Drops file in Drivers directory 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 21 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 11 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
- Adds Run key to start application 2 TTPs 16 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 43 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 54 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 21 IoCs
- Runs ping.exe 1 TTPs 6 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 15 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 3 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\TestExe.exe"C:\Users\Admin\AppData\Local\Temp\Files\TestExe.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\up.exe"C:\Users\Admin\AppData\Local\Temp\Files\up.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Agentnov.exe"C:\Users\Admin\AppData\Local\Temp\Files\Agentnov.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor\Ay6NG0F6W31r02DmYDfvXlcoXOiJ0g7CZGFgavsjaHVxbb7p79qA9PCcolLF.vbe"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor\OnzNiMkRKunjlA2ZJK8bvmP0uahZr4XmUT5IbmeTTuY8hxSaQt1L4to.bat" "5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor\WinIntoruntime.exe"C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor/WinIntoruntime.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\WININT~1.EXE"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3582-490\WININT~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\WININT~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tiuJdyJ5V6.bat"9⤵
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\STATIC~1.EXE"11⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\STATIC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\STATIC~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rLVfIpz4WT.bat"13⤵
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"14⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LqM2MqbNda.bat"15⤵
-
C:\Windows\system32\chcp.comchcp 6500116⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"16⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2hXwS5IfKK.bat"17⤵
-
C:\Windows\system32\chcp.comchcp 6500118⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"18⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\40vfctpQnk.bat"19⤵
-
C:\Windows\system32\chcp.comchcp 6500120⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"20⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XcOf3EZBsc.bat"21⤵
-
C:\Windows\system32\chcp.comchcp 6500122⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost22⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"22⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r7mooz1sjZ.bat"23⤵
-
C:\Windows\system32\chcp.comchcp 6500124⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"24⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ycxw1CWDXu.bat"25⤵
-
C:\Windows\system32\chcp.comchcp 6500126⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost26⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"26⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cRBFrjfuSR.bat"27⤵
-
C:\Windows\system32\chcp.comchcp 6500128⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost28⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"28⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qi3SEoFf8b.bat"29⤵
-
C:\Windows\system32\chcp.comchcp 6500130⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost30⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"30⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VzpByHn75i.bat"31⤵
-
C:\Windows\system32\chcp.comchcp 6500132⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost32⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\staticfile.exe"C:\Users\Admin\AppData\Local\staticfile.exe"32⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SlRmWYpFEV.bat"33⤵
-
C:\Windows\system32\chcp.comchcp 6500134⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\m.exe"C:\Users\Admin\AppData\Local\Temp\Files\m.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\m.exe"C:\Users\Admin\AppData\Local\Temp\Files\m.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\csrss.exe"C:\Users\Admin\AppData\Local\Temp\Files\csrss.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\MS14-068.exe"C:\Users\Admin\AppData\Local\Temp\Files\MS14-068.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\MS14-068.exe"C:\Users\Admin\AppData\Local\Temp\Files\MS14-068.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exe"3⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exeC:\Users\Admin\AppData\Local\Temp\Files\VoidRAT.exe4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\ctfmon.exe"3⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\Files\ctfmon.exeC:\Users\Admin\AppData\Local\Temp\Files\ctfmon.exe4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\ctfmon.exeC:\Users\Admin\AppData\Roaming\ctfmon.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\access.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\access.exeC:\Users\Admin\AppData\Local\Temp\Files\access.exe4⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\master.exe"C:\Users\Admin\AppData\Local\Temp\Files\master.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\purchaseorder.exe"C:\Users\Admin\AppData\Local\Temp\Files\purchaseorder.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\kzgqdtrG.cmd" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o6⤵
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o6⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "6⤵
- Executes dropped EXE
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 106⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\xpha.pifC:\\Users\\Public\\xpha.pif 127.0.0.1 -n 107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows \SysWOW64\per.exe"C:\\Windows \\SysWOW64\\per.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SYSTEM32\esentutl.exeesentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o7⤵
-
-
C:\Users\Public\pha.pifC:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"6⤵
- Executes dropped EXE
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW646⤵
- Executes dropped EXE
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\Files\purchaseorder.exe /d C:\\Users\\Public\\Libraries\\Grtdqgzk.PIF /o5⤵
-
-
C:\Users\Public\Libraries\kzgqdtrG.pifC:\Users\Public\Libraries\kzgqdtrG.pif5⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\tqg1699uiwak.exe"C:\Users\Admin\AppData\Local\Temp\Files\tqg1699uiwak.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_5800_134131421975295129\DiscordSpotifyBypass.exeC:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\AUTOUP~1.EXE"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\AUTOUP~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\AUTOUP~1.EXE5⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exe"4⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exeC:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exe5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\REXCEL~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\REXCEL~1.EXE6⤵
-
C:\Users\Admin\AppData\Local\Temp\INSAC48.tmpC:\Users\Admin\AppData\Local\Temp\INSAC48.tmp /SL3 $9028E C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\REXCEL~1.EXE 1126546 1136290 614407⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\iupdate.exe"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\iupdate.exeC:\Users\Admin\AppData\Local\Temp\Files\iupdate.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\444.exe"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\444.exeC:\Users\Admin\AppData\Local\Temp\Files\444.exe5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\conhost.exe"6⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Roaming\conhost.exeC:\Users\Admin\AppData\Roaming\conhost.exe7⤵
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE8⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\020820~1.EXE"4⤵
- Drops file in Windows directory
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\SHARPH~1.EXE"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\SHARPH~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\SHARPH~1.EXE5⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\BNKRIG~1.EXE"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\BNKRIG~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\BNKRIG~1.EXE5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles7⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\system32\findstr.exefindstr /R /C:"[ ]:[ ]"7⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"6⤵
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show networks mode=bssid7⤵
-
-
C:\Windows\system32\findstr.exefindstr "SSID BSSID Signal"7⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\CLIENT~1.EXE"4⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\CLIENT~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\CLIENT~1.EXE5⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\NANOCO~1.EXE"4⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\Files\NANOCO~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\NANOCO~1.EXE5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "6⤵
-
C:\Windows\SysWOW64\mode.commode 30,207⤵
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 107⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"7⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\SELF-I~1.EXE"4⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\Files\SELF-I~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\SELF-I~1.EXE5⤵
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\Polarised_97.74.8_INSTALL.exe"C:\Windows\System32\Files\Polarised_97.74.8_INSTALL.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GSSMU.tmp\Polarised_97.74.8_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-GSSMU.tmp\Polarised_97.74.8_INSTALL.tmp" /SL5="$601C6,2714024,817152,C:\Windows\SysWOW64\Files\Polarised_97.74.8_INSTALL.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\Polarised_97.74.8_INSTALL.exe"C:\Windows\SysWOW64\Files\Polarised_97.74.8_INSTALL.exe" /VERYSILENT /PASSWORD=c9d4bb30-cb45-43e6-a5a5-0428b46e6eec5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QM3AU.tmp\Polarised_97.74.8_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-QM3AU.tmp\Polarised_97.74.8_INSTALL.tmp" /SL5="$701C6,2714024,817152,C:\Windows\SysWOW64\Files\Polarised_97.74.8_INSTALL.exe" /VERYSILENT /PASSWORD=c9d4bb30-cb45-43e6-a5a5-0428b46e6eec6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe"C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\Files\1.exe"C:\Windows\System32\Files\1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\1.exe"C:\Windows\System32\Files\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\SysWOW64\Files\relogintool.exe"C:\Windows\System32\Files\relogintool.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jhclHl.exeC:\Users\Admin\AppData\Local\Temp\jhclHl.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
C:\Windows\SysWOW64\Files\XClient.exe"C:\Windows\System32\Files\XClient.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Files\m.exe"C:\Windows\System32\Files\m.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Files\m.exe"C:\Windows\System32\Files\m.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\Files\Setup.exe"C:\Windows\System32\Files\Setup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Setup.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Setup.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\Files\NAMUVPN7.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Files\NAMUVPN7.exeC:\Windows\System32\Files\NAMUVPN7.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\namu864.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\namu864.exeC:\Users\Admin\AppData\Roaming\namu864.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cmstp.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\.\cmstp.exe namu864.inf7⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\Files\BLOXFL~1.EXE"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Files\BLOXFL~1.EXEC:\Windows\System32\Files\BLOXFL~1.EXE4⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\BLOXFL~1.EXE"5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\BLOXFL~1.EXEC:\Windows\BLOXFL~1.EXE6⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"7⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"7⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Windows\Bloxflip Predictor.exe"5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\Files\pst.exe"3⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\Files\pst.exeC:\Windows\System32\Files\pst.exe4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\Files\ui.exe"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Files\ui.exeC:\Windows\System32\Files\ui.exe4⤵
-
C:\Windows\SysWOW64\Files\ui.exeC:\Windows\System32\Files\ui.exe5⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\Files\SERIAL~1.EXE"3⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\Files\SERIAL~1.EXEC:\Windows\System32\Files\SERIAL~1.EXE4⤵
- Adds Run key to start application
-
C:\Windows\SYSTEM32\cmd.execmd /c "Serials_Checker.bat"5⤵
-
C:\Windows\system32\mode.commode con: cols=90 lines=486⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get processorid6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic memorychip get serialnumber6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Description,PNPDeviceID6⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\Files\CRITSC~1.EXE"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Files\CRITSC~1.EXEC:\Windows\System32\Files\CRITSC~1.EXE4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"5⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXEC:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE6⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\Files\Discord.exe"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Files\Discord.exeC:\Windows\System32\Files\Discord.exe4⤵
-
C:\Windows\SysWOW64\Files\Discord.exeC:\Windows\System32\Files\Discord.exe5⤵
- Loads dropped DLL
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exeC:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 4882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1696 -ip 16961⤵
-
C:\Users\Admin\AppData\Roaming\c09876ca.exeC:\Users\Admin\AppData\Roaming\c09876ca.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\c09876ca\c09876ca.exeC:\c09876ca\c09876ca.exe1⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2dc 0x2d81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
-
C:\Windows\Bloxflip Predictor.exe"C:\Windows\Bloxflip Predictor.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe" ..1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exeC:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe -Embedding1⤵
-
C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exeC:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
4Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
ProtobufLite.dll
eServiceHost.exe
msvcp140.dll
sciter-x.dll
vcruntime140.dll
Synaptics.exe
k2[1].rar
._cache_Synaptics.exe
16777EA0.exe
Setup.exe
WinIntoruntime.exe
EAB75E00
02.08.2022.exe
444.exe
Agentnov.exe
AutoUpdate.exe
CFXBypass.exe
Client-built.exe
CryptoWall.exe
DiscordSpotifyBypass.exe
EmailVerify.exe
MS14-068.exe
NanoCore_Portable.exe
SharpHound.exe
TempSpoofer.exe
TestExe.exe
VoidRAT.exe
access.exe
bnkrigkawd.exe
csrss.exe
ctfmon.exe
iupdate.exe
keygen.exe
master.exe
purchaseorder.exe
rxd_en_1.exe
self-injection.exe
tqg1699uiwak.exe
up.exe
JUSCHED.EXE
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
flag_aq.png
flag_cx.png
flag_gp.png
flag_sj.png
TTFlQwnI.xlsm
__PSScriptPolicyTest_hfbostzo.hb3.ps1
_isdecmp.dll
Polarised_97.74.8_INSTALL.tmp
DiscordSpotifyBypass.exe
VCRUNTIME140.dll
python310.dll
Ay6NG0F6W31r02DmYDfvXlcoXOiJ0g7CZGFgavsjaHVxbb7p79qA9PCcolLF.vbe
namu864.exe
alpha.pif
02.08.2022.exe
1.exe
Bloxflip%20Predictor.exe
CritScript.exe
Discord.exe
NAMUVPN7.exe
Polarised_97.74.8_INSTALL.exe
Serials_Checker.exe
Setup.exe
XClient.exe
pst.exe
relogintool.exe
ui.exe
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
memory/452-336-0x0000000000EA0000-0x0000000000ED6000-memory.dmp
memory/452-338-0x0000000000EA0000-0x0000000000ED6000-memory.dmp
memory/452-339-0x0000000000EA0000-0x0000000000ED6000-memory.dmp
memory/452-337-0x0000000000EA0000-0x0000000000ED6000-memory.dmp
memory/452-340-0x0000000000EA0000-0x0000000000ED6000-memory.dmp
memory/452-343-0x0000000000EA0000-0x0000000000ED6000-memory.dmp
memory/672-920-0x0000000000D90000-0x0000000000F2A000-memory.dmp
memory/904-1788-0x0000000140000000-0x0000000140169000-memory.dmp
memory/904-1558-0x0000000140000000-0x0000000140169000-memory.dmp
memory/976-1024-0x0000000000400000-0x0000000000487000-memory.dmp
memory/976-954-0x0000000000400000-0x0000000000487000-memory.dmp
memory/1056-739-0x0000000005430000-0x0000000005442000-memory.dmp
memory/1056-937-0x000000006ED10000-0x000000006EE77000-memory.dmp
memory/1056-387-0x000000006ED10000-0x000000006EE77000-memory.dmp
memory/1056-507-0x0000000002A10000-0x0000000002AB2000-memory.dmp
memory/1056-905-0x0000000005D50000-0x0000000005DB6000-memory.dmp
memory/1056-326-0x000000006ED10000-0x000000006EE77000-memory.dmp
memory/1096-3311-0x000001B5F11A0000-0x000001B5F11B8000-memory.dmp
memory/1096-3324-0x000001B5F37D0000-0x000001B5F3992000-memory.dmp
memory/1128-284-0x0000000000BE0000-0x0000000000CB7000-memory.dmp
memory/1128-329-0x0000000000BE0000-0x0000000000CB7000-memory.dmp
memory/1584-196-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1648-574-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1648-573-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1696-380-0x000000006ED10000-0x000000006EE77000-memory.dmp
memory/1840-1124-0x000000001C2B0000-0x000000001C34C000-memory.dmp
memory/1840-1116-0x000000001C680000-0x000000001CB4E000-memory.dmp
memory/1840-1115-0x000000001BED0000-0x000000001C0AE000-memory.dmp
memory/1840-1135-0x0000000001860000-0x0000000001868000-memory.dmp
memory/1864-605-0x0000000000F40000-0x0000000000F65000-memory.dmp
memory/1864-587-0x0000000000F40000-0x0000000000F65000-memory.dmp
memory/2128-588-0x0000000001020000-0x0000000001045000-memory.dmp
memory/2128-774-0x0000000001020000-0x0000000001045000-memory.dmp
memory/2168-923-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2168-924-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2232-552-0x00000000008F0000-0x0000000000900000-memory.dmp
memory/2232-560-0x000000001B460000-0x000000001B482000-memory.dmp
memory/2300-932-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2324-3477-0x0000000140000000-0x0000000140216000-memory.dmp
memory/2324-1676-0x0000000140000000-0x0000000140216000-memory.dmp
memory/2432-775-0x0000000000AE0000-0x0000000000B05000-memory.dmp
memory/2432-567-0x0000000000AE0000-0x0000000000B05000-memory.dmp
memory/2568-1638-0x0000000140000000-0x00000001401C0000-memory.dmp
memory/2568-1652-0x0000000140000000-0x00000001401C0000-memory.dmp
memory/2644-467-0x0000000031720000-0x0000000032347000-memory.dmp
memory/2644-495-0x0000000031720000-0x0000000032347000-memory.dmp
memory/2732-604-0x0000000000610000-0x0000000000635000-memory.dmp
memory/2732-607-0x0000000000610000-0x0000000000635000-memory.dmp
memory/3076-1008-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3136-1025-0x0000000000E70000-0x0000000000E79000-memory.dmp
memory/3136-705-0x0000000000E70000-0x0000000000E79000-memory.dmp
memory/3228-1041-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3244-537-0x0000000002B60000-0x0000000002C40000-memory.dmp
memory/3244-539-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3244-536-0x00000000006D0000-0x00000000006DD000-memory.dmp
memory/3424-1137-0x0000000000400000-0x000000000054A000-memory.dmp
memory/3424-1176-0x00000000241F0000-0x0000000024212000-memory.dmp
memory/3424-1157-0x0000000021A20000-0x0000000021A44000-memory.dmp
memory/3424-1520-0x0000000000400000-0x000000000054A000-memory.dmp
memory/3480-287-0x0000000000BE0000-0x0000000000CB7000-memory.dmp
memory/3480-270-0x0000000000BE0000-0x0000000000CB7000-memory.dmp
memory/3608-199-0x00007FFE73950000-0x00007FFE73960000-memory.dmp
memory/3608-203-0x00007FFE714E0000-0x00007FFE714F0000-memory.dmp
memory/3608-201-0x00007FFE73950000-0x00007FFE73960000-memory.dmp
memory/3608-197-0x00007FFE73950000-0x00007FFE73960000-memory.dmp
memory/3608-200-0x00007FFE73950000-0x00007FFE73960000-memory.dmp
memory/3608-198-0x00007FFE73950000-0x00007FFE73960000-memory.dmp
memory/3608-204-0x00007FFE714E0000-0x00007FFE714F0000-memory.dmp
memory/3684-129-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3684-274-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3684-130-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3860-454-0x0000000000DD0000-0x0000000000DE0000-memory.dmp
memory/3860-455-0x0000000005D80000-0x0000000006324000-memory.dmp
memory/3860-456-0x00000000056A0000-0x0000000005732000-memory.dmp
memory/3860-457-0x0000000005740000-0x000000000574A000-memory.dmp
memory/4124-685-0x00000000001B0000-0x00000000001C0000-memory.dmp
memory/4148-1608-0x0000000140000000-0x00000001402E9000-memory.dmp
memory/4148-1449-0x0000000140000000-0x00000001402E9000-memory.dmp
memory/4164-599-0x0000000000630000-0x0000000000655000-memory.dmp
memory/4164-593-0x0000000000630000-0x0000000000655000-memory.dmp
memory/4176-1622-0x0000000140000000-0x000000014013F000-memory.dmp
memory/4176-1459-0x0000000140000000-0x000000014013F000-memory.dmp
memory/4224-286-0x00000000003B0000-0x0000000000713000-memory.dmp
memory/4272-589-0x00000000012C0000-0x00000000012E5000-memory.dmp
memory/4300-133-0x00000000003B0000-0x00000000003B8000-memory.dmp
memory/4300-342-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/4300-135-0x0000000004CF0000-0x0000000004D8C000-memory.dmp
memory/4348-1481-0x0000000140000000-0x0000000140135000-memory.dmp
memory/4348-1433-0x0000000140000000-0x0000000140135000-memory.dmp
memory/4776-1023-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4836-1534-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/4836-3187-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/4836-1687-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/4904-128-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4904-0-0x00000000006D0000-0x00000000006D1000-memory.dmp
memory/4904-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/5096-505-0x0000023B615F0000-0x0000023B615F1000-memory.dmp
memory/5096-504-0x00007FF69BFD0000-0x00007FF69BFEC000-memory.dmp
memory/5096-756-0x00007FF69BFD0000-0x00007FF69BFEC000-memory.dmp
memory/5096-1639-0x00007FF69BFD0000-0x00007FF69BFEC000-memory.dmp
memory/5160-540-0x0000000000400000-0x0000000000430000-memory.dmp
memory/5244-335-0x0000000000400000-0x0000000000436000-memory.dmp
memory/5244-341-0x0000000000400000-0x0000000000436000-memory.dmp
memory/5244-333-0x0000000000400000-0x0000000000436000-memory.dmp
memory/5352-939-0x0000000000400000-0x0000000000548000-memory.dmp
memory/5352-704-0x0000000000400000-0x0000000000548000-memory.dmp
memory/5352-710-0x0000000000400000-0x0000000000548000-memory.dmp
memory/5428-606-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5428-940-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5428-938-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5648-374-0x0000017260DC0000-0x0000017260DC1000-memory.dmp
memory/5648-458-0x00000000002A0000-0x00000000002AE000-memory.dmp
memory/5688-3528-0x0000000140000000-0x000000014014C000-memory.dmp
memory/5688-1692-0x0000000140000000-0x000000014014C000-memory.dmp
memory/5816-328-0x0000000000980000-0x0000000000CE3000-memory.dmp
memory/5884-737-0x0000000000980000-0x000000000099A000-memory.dmp
memory/5968-1712-0x0000000140000000-0x0000000140179000-memory.dmp
memory/6100-493-0x0000000000400000-0x000000000058B000-memory.dmp
memory/6100-365-0x0000000002ED0000-0x0000000003ED0000-memory.dmp
memory/6100-381-0x0000000002ED0000-0x0000000003ED0000-memory.dmp
memory/6108-683-0x0000000000400000-0x0000000000436000-memory.dmp
memory/6108-682-0x0000000000400000-0x0000000000436000-memory.dmp
memory/6140-610-0x0000000000920000-0x0000000000930000-memory.dmp
memory/6140-633-0x0000000000DD0000-0x0000000000DE0000-memory.dmp
memory/6188-1609-0x0000000140000000-0x0000000140188000-memory.dmp
memory/6188-1985-0x0000000140000000-0x0000000140188000-memory.dmp
memory/6192-1637-0x0000000140000000-0x0000000140155000-memory.dmp
memory/6192-1480-0x0000000140000000-0x0000000140155000-memory.dmp
memory/6416-1654-0x0000000140000000-0x0000000140131000-memory.dmp
memory/6416-1509-0x0000000140000000-0x0000000140131000-memory.dmp
memory/6444-1624-0x0000000140000000-0x0000000140168000-memory.dmp
memory/6444-2380-0x0000000140000000-0x0000000140168000-memory.dmp
memory/6512-3266-0x0000000140000000-0x0000000140147000-memory.dmp
memory/6512-1653-0x0000000140000000-0x0000000140147000-memory.dmp
memory/6580-1665-0x0000000140000000-0x00000001401FC000-memory.dmp
memory/6580-3465-0x0000000140000000-0x00000001401FC000-memory.dmp
memory/6592-1513-0x0000000000400000-0x000000000051D000-memory.dmp
memory/6592-1657-0x0000000000400000-0x000000000051D000-memory.dmp
memory/6648-1545-0x0000000140000000-0x0000000140130000-memory.dmp
memory/6648-1388-0x0000000140000000-0x0000000140130000-memory.dmp
memory/6712-1523-0x0000000140000000-0x000000014011B000-memory.dmp
memory/6712-1667-0x0000000140000000-0x000000014011B000-memory.dmp
memory/6896-1414-0x0000000140000000-0x000000014012F000-memory.dmp
memory/7012-1546-0x0000000140000000-0x000000014011C000-memory.dmp
memory/7012-1711-0x0000000140000000-0x000000014011C000-memory.dmp
memory/7064-3437-0x0000000000640000-0x0000000000964000-memory.dmp
memory/8368-3534-0x00007FFEA9F70000-0x00007FFEA9F7D000-memory.dmp
memory/8368-3531-0x00007FFEA9EE0000-0x00007FFEA9EF9000-memory.dmp
memory/8368-3537-0x00007FFE804F0000-0x00007FFE80864000-memory.dmp
memory/8368-3530-0x00007FFEA9F80000-0x00007FFEA9F8F000-memory.dmp
memory/8368-3478-0x00007FFE80870000-0x00007FFE80CD5000-memory.dmp
memory/8368-3532-0x00007FFEA72F0000-0x00007FFEA731C000-memory.dmp
memory/8368-3533-0x00007FFEA9D70000-0x00007FFEA9D89000-memory.dmp
memory/8368-3529-0x00007FFEA9F90000-0x00007FFEA9FB4000-memory.dmp
memory/8368-3538-0x00007FFEA46D0000-0x00007FFEA4786000-memory.dmp
memory/8368-3535-0x00007FFEA4C70000-0x00007FFEA4C9E000-memory.dmp
memory/8784-3370-0x000001918A920000-0x000001918A930000-memory.dmp
memory/8784-3365-0x000001918A410000-0x000001918A514000-memory.dmp
memory/8784-3368-0x000001918A940000-0x000001918A97C000-memory.dmp
memory/9176-3282-0x00000203A5970000-0x00000203A59A0000-memory.dmp