Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- user interaction
yes - max time kernel
148s - max time network
159s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/02/2026, 09:27
General
- Target Synaptics.exe
- Size 764KB
- Sample260211-leyn8aes8e
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
xworm
-
XWorm V5.6
-
147.185.221.25:63795
-
Install_directory
%AppData%
-
install_file
XClient.exe
Extracted
-
mylobot
-
pqrqtaz.ru:9879
-
pickcas.ru:6464
-
quwkbin.ru:3496
-
rkbupij.ru:6653
-
pcqmayq.ru:3629
-
mmuliwe.ru:3541
-
stoizji.ru:5189
-
sfdfrhh.ru:3511
-
ynciazz.ru:4127
-
mkglhnw.ru:1946
-
njeeili.ru:9987
-
dldzeoo.ru:7525
-
tkbiqjq.ru:5145
-
uenosbl.ru:2935
-
faayshc.ru:9865
-
nttfazc.ru:6761
-
nfwsyog.ru:7172
-
uyfusxm.ru:7372
-
hxkclwx.ru:1294
-
zgoysam.ru:2338
Extracted
-
xworm
-
5.0
-
police-turkish.gl.at.ply.gg:46359
-
98LKJ8osZWR75pSw
-
install_file
USB.exe
Extracted
-
stealc
-
crypt
-
http://196.251.107.23
-
url_path
/7ffc7a279c17c091.php
Extracted
-
redline
-
ddwwnnll
-
196.251.107.104:1912
Extracted
-
quasar
-
1.4.1
-
DDNS
-
193.161.193.99:32471
-
807f3187-d087-4fff-beff-e73293a32af8
-
encryption_key
81A0C14D4C705B3C678E573C849DE7F6A3671A8B
-
install_name
jusched.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
CachedLogs
-
reconnect_delay
3000
-
startup_key
Java Update Scheduler
-
subdirectory
Java
Extracted
-
44caliber
-
https://discord.com/api/webhooks/1146486791835230260/bE9QI2eAT_dyqn0dm7VljbMDjUklfKOXxq3ua0HOtKeG6TIgizThvorpCYQf2NEkabwH
Extracted
-
quasar
-
1.4.1
-
RuntimeBroker
-
wisedreams-53895.portmap.io:53895
-
3660874b-db54-4220-a432-d5fe6599ee7f
-
encryption_key
2EEF46A138D721E58A3C90F6CE7CFC94A47B0492
-
install_name
updater.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RuntimeBroker
-
subdirectory
SubDir
Signatures
- 44Caliber
An open source infostealer written in C#.
- 44Caliber family
- Detect Xworm Payload 4 IoCs
- Detects Rhadamanthys Payload 1 IoCs
- Detects SvcStealer Payload 1 IoCs
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- Mylobot
Botnet which first appeared in 2017 written in C++.
- Mylobot family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 5 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Redline family
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Rhadamanthys family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Svcstealer family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Downloads MZ/PE file 31 IoCs
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Drops startup file 3 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 64 IoCs
- Suspicious use of SetThreadContext 12 IoCs
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 43 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 54 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 28 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies registry class 12 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ShellHost.exe"C:\Users\Admin\AppData\Local\Temp\Files\ShellHost.exe"4⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\darts-pixelit.exe"C:\Users\Admin\AppData\Local\Temp\Files\darts-pixelit.exe"4⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Konsol.exe"C:\Users\Admin\AppData\Local\Temp\Files\Konsol.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1210.exe"C:\Users\Admin\AppData\Local\Temp\Files\1210.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe"C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hs.exe"C:\Users\Admin\AppData\Local\Temp\Files\hs.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\HamSphere\HamSphere_4.010a\HamSphere_4.010a.exe"C:\HamSphere\HamSphere_4.010a\HamSphere_4.010a.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 18367⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Tinder%20Bot.exe"C:\Users\Admin\AppData\Local\Temp\Files\Tinder%20Bot.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\m.exe"C:\Users\Admin\AppData\Local\Temp\Files\m.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\m.exe"C:\Users\Admin\AppData\Local\Temp\Files\m.exe"6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ui.exe"C:\Users\Admin\AppData\Local\Temp\Files\ui.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\ui.exe"C:\Users\Admin\AppData\Local\Temp\Files\ui.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\8.exe"C:\Users\Admin\AppData\Local\Temp\Files\8.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /tn "D5922B3CD8D8319B" /tr "C:\Users\Admin\AppData\Roaming\D5922B3CD8D8319B\D5922B3CD8D8319B.exe"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe"C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe"5⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"6⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"6⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Destover.exe"C:\Users\Admin\AppData\Local\Temp\Files\Destover.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\update.exe"C:\Users\Admin\AppData\Local\Temp\Files\update.exe"5⤵
- Modifies visibility of file extensions in Explorer
- Downloads MZ/PE file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1_240697531.exe"C:\Users\Admin\AppData\Local\Temp\1_240697531.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2_240698953.exe"C:\Users\Admin\AppData\Local\Temp\2_240698953.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-IF81P6Z9DV.tmp\2_240698953.tmp"C:\Users\Admin\AppData\Local\Temp\is-IF81P6Z9DV.tmp\2_240698953.tmp" /SL5="$20376,3851360,893440,C:\Users\Admin\AppData\Local\Temp\2_240698953.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\2_240698953.exe"C:\Users\Admin\AppData\Local\Temp\2_240698953.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80988⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-7HB5AI4X4Y.tmp\2_240698953.tmp"C:\Users\Admin\AppData\Local\Temp\is-7HB5AI4X4Y.tmp\2_240698953.tmp" /SL5="$40380,3851360,893440,C:\Users\Admin\AppData\Local\Temp\2_240698953.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80989⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe"C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe" -Embedding10⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3_240700437.exe"C:\Users\Admin\AppData\Local\Temp\3_240700437.exe"6⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\temp_27572.exe"C:\Users\Admin\AppData\Local\Temp\temp_27572.exe"7⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"8⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
-
-
C:\Users\Admin\AppData\Local\AtdLIKZ8o7GV.exe"C:\Users\Admin\AppData\Local\AtdLIKZ8o7GV.exe"8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"9⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows SystemEnv Core" /tr "C:\Users\Admin\AppData\Local\AtdLIKZ8o7GV.exe"9⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\2DXmWg1zi1kE.exe"C:\Users\Admin\AppData\Local\2DXmWg1zi1kE.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\temp_27576.exe"C:\Users\Admin\AppData\Local\Temp\temp_27576.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\ProgramData\gubki.exe"C:\ProgramData\gubki.exe"8⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4_240704328.exe"C:\Users\Admin\AppData\Local\Temp\4_240704328.exe"6⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\5_240708140.exe"C:\Users\Admin\AppData\Local\Temp\5_240708140.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\6_240708953.exe"C:\Users\Admin\AppData\Local\Temp\6_240708953.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\o.exe"C:\Users\Admin\AppData\Local\Temp\Files\o.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\o.exe"C:\Users\Admin\AppData\Local\Temp\Files\o.exe"6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dxwebsetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\dxwebsetup.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\subprocess.exe"C:\Users\Admin\AppData\Local\Temp\Files\subprocess.exe"5⤵
- Drops startup file
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\order_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Files\order_pdf.exe"5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\Files\nc64.exe"C:\Users\Admin\AppData\Local\Temp\Files\nc64.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\bypass.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"5⤵
-
-
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Gathers network information
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\m.exe"C:\Windows\System32\Files\m.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\m.exe"C:\Windows\SysWOW64\Files\m.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\Files\t2.exe"C:\Windows\System32\Files\t2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\t2.exe"C:\Windows\SysWOW64\Files\t2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\Files\FhWghQuFWpqoe.exe"C:\Windows\System32\Files\FhWghQuFWpqoe.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Files\Loader.exe"C:\Windows\System32\Files\Loader.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Files\aibpcqx.exe"C:\Windows\System32\Files\aibpcqx.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\1.exe"C:\Windows\System32\Files\1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Files\1.exe"C:\Windows\SysWOW64\Files\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
-
-
-
C:\Windows\SysWOW64\Files\agent.exe"C:\Windows\System32\Files\agent.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Files\o.exe"C:\Windows\System32\Files\o.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Files\o.exe"C:\Windows\SysWOW64\Files\o.exe"4⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
-
-
-
C:\Windows\SysWOW64\Files\kdmapper_Release.exe"C:\Windows\System32\Files\kdmapper_Release.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\BootstrapperNew.exe"C:\Windows\System32\Files\BootstrapperNew.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\CritScript.exe"C:\Windows\System32\Files\CritScript.exe"3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"4⤵
-
-
-
C:\Windows\SysWOW64\Files\file.exe"C:\Windows\System32\Files\file.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\D5922B3CD8D8319B\D5922B3CD8D8319B.exeC:\Users\Admin\AppData\Roaming\D5922B3CD8D8319B\D5922B3CD8D8319B.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\ProgramData\gubki.exeC:\ProgramData\gubki.exe1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\AtdLIKZ8o7GV.exeC:\Users\Admin\AppData\Local\AtdLIKZ8o7GV.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"2⤵
-
-
C:\Users\Admin\AppData\Local\AtdLIKZ8o7GV.exeC:\Users\Admin\AppData\Local\AtdLIKZ8o7GV.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"2⤵
-
-
C:\Users\Admin\AppData\Roaming\D5922B3CD8D8319B\D5922B3CD8D8319B.exeC:\Users\Admin\AppData\Roaming\D5922B3CD8D8319B\D5922B3CD8D8319B.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1400 -ip 14001⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exeC:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe -Embedding1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\AtdLIKZ8o7GV.exeC:\Users\Admin\AppData\Local\AtdLIKZ8o7GV.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"2⤵
-
-
C:\Users\Admin\AppData\Roaming\D5922B3CD8D8319B\D5922B3CD8D8319B.exeC:\Users\Admin\AppData\Roaming\D5922B3CD8D8319B\D5922B3CD8D8319B.exe1⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exeC:\Users\Admin\AppData\Roaming\SubDir\updater.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
HamSphere_4.010a.exe
win32_MoveNoDrop32x32.gif
Process.txt
Synaptics.exe
2DXmWg1zi1kE.exe
AtdLIKZ8o7GV.exe
computed_hashes.json
arbitration_service_config.json
default_cloud_config.json
keys.json
appsglobals.txt
._cache_Synaptics.exe
1MWBEoyo.xlsm
1_240697531.exe
2_240698953.exe
3_240700437.exe
4_240704328.exe
5_240708140.exe
C0285E00
02.08.2022.exe
1210.exe
8.exe
CFXBypass.exe
Destover.exe
Fast%20Download.exe
Konsol.exe
LOIC.exe
ShellHost.exe
TempSpoofer.exe
Tinder%20Bot.exe
XClient.exe
bypass.exe
compiled.exe
connector1.exe
darts-pixelit.exe
dxwebsetup.exe
hs.exe
nc64.exe
order_pdf.exe
subprocess.exe
svchost.exe
t2.exe
ui.exe
update.exe
History
userinstall.dll
JUSCHED.EXE
Crypto.Cipher._AES.pyd
Crypto.Cipher._ARC4.pyd
Crypto.Cipher._DES.pyd
Crypto.Util.strxor.pyd
_ctypes.pyd
_hashlib.pyd
python27.dll
pywintypes27.dll
win32api.pyd
win32cred.pyd
win32event.pyd
win32net.pyd
win32process.pyd
win32security.pyd
win32service.pyd
win32ts.pyd
__PSScriptPolicyTest_legqjlyx.1nx.ps1
cv_debug.log
_isdecmp.dll
System.dll
temp_27572.exe
temp_27576.exe
tmp57B9.tmp.dat
tmp57BB.tmp.dat
02.08.2022.exe
BootstrapperNew.exe
CritScript.exe
FhWghQuFWpqoe.exe
Loader.exe
agent.exe
file.exe
kdmapper_Release.exe
new.exe
dsetup.dll
dsetup32.dll
memory/896-196-0x00007FFB8AAF0000-0x00007FFB8AB00000-memory.dmp
memory/896-421-0x000002AD826B0000-0x000002AD8275E000-memory.dmp
memory/896-200-0x00007FFB8AAF0000-0x00007FFB8AB00000-memory.dmp
memory/896-195-0x00007FFB8AAF0000-0x00007FFB8AB00000-memory.dmp
memory/896-199-0x000002AD426A0000-0x000002AD426B0000-memory.dmp
memory/896-205-0x00007FFB888D0000-0x00007FFB888E0000-memory.dmp
memory/896-204-0x00007FFB888D0000-0x00007FFB888E0000-memory.dmp
memory/896-198-0x00007FFB8AAF0000-0x00007FFB8AB00000-memory.dmp
memory/896-197-0x00007FFB8AAF0000-0x00007FFB8AB00000-memory.dmp
memory/1396-2270-0x00000000004A0000-0x0000000000502000-memory.dmp
memory/1396-2293-0x0000000004E50000-0x0000000004F2E000-memory.dmp
memory/1536-307-0x0000000002190000-0x00000000021A0000-memory.dmp
memory/1620-452-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1640-527-0x0000000000AE0000-0x0000000000B08000-memory.dmp
memory/1832-439-0x0000000000CE0000-0x0000000000CE4000-memory.dmp
memory/1832-441-0x0000000000CE0000-0x0000000000CE4000-memory.dmp
memory/2084-2577-0x00000000005F0000-0x0000000000914000-memory.dmp
memory/2344-1577-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1566-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1554-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1567-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1570-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1572-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1564-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1559-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1565-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1575-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1576-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1574-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1573-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1571-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1569-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1568-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2344-1563-0x00007FF788FE0000-0x00007FF7890AC000-memory.dmp
memory/2368-1550-0x00000000009B0000-0x00000000009B4000-memory.dmp
memory/2472-468-0x0000000005750000-0x0000000005821000-memory.dmp
memory/2472-422-0x0000000005750000-0x0000000005821000-memory.dmp
memory/2736-1681-0x0000000000B60000-0x0000000000F05000-memory.dmp
memory/2844-516-0x0000000000390000-0x0000000000394000-memory.dmp
memory/2844-515-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2956-0-0x0000000002330000-0x0000000002331000-memory.dmp
memory/2956-127-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/2956-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/2960-2753-0x0000000000400000-0x0000000000500000-memory.dmp
memory/3000-513-0x0000000000390000-0x0000000000394000-memory.dmp
memory/3128-2516-0x0000000000460000-0x0000000000464000-memory.dmp
memory/3296-935-0x0000000000A10000-0x0000000000A28000-memory.dmp
memory/3300-442-0x0000000000400000-0x0000000000436000-memory.dmp
memory/3320-2810-0x0000000000BE0000-0x0000000000BF0000-memory.dmp
memory/3468-1908-0x0000000005080000-0x0000000005112000-memory.dmp
memory/3468-2148-0x0000000006C90000-0x0000000006E52000-memory.dmp
memory/3468-2150-0x0000000006E60000-0x0000000006EB0000-memory.dmp
memory/3468-2149-0x0000000007390000-0x00000000078BC000-memory.dmp
memory/3468-2037-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/3468-1916-0x00000000054B0000-0x00000000054FC000-memory.dmp
memory/3468-1915-0x0000000005330000-0x000000000536C000-memory.dmp
memory/3468-1913-0x00000000052D0000-0x00000000052E2000-memory.dmp
memory/3468-1912-0x00000000053A0000-0x00000000054AA000-memory.dmp
memory/3468-1911-0x0000000006160000-0x0000000006778000-memory.dmp
memory/3468-1909-0x0000000005060000-0x000000000506A000-memory.dmp
memory/3468-1907-0x0000000005590000-0x0000000005B36000-memory.dmp
memory/3468-1906-0x0000000000670000-0x00000000006C2000-memory.dmp
memory/3552-466-0x0000000006380000-0x0000000006451000-memory.dmp
memory/3564-131-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3564-203-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3900-420-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3916-2800-0x00000000002A0000-0x00000000005C4000-memory.dmp
memory/4044-2415-0x00000000002B0000-0x00000000002B4000-memory.dmp
memory/4184-132-0x00000000003B0000-0x00000000003B8000-memory.dmp
memory/4184-419-0x0000000005930000-0x0000000005A01000-memory.dmp
memory/4184-133-0x0000000004D40000-0x0000000004DDC000-memory.dmp
memory/4184-352-0x0000000005FD0000-0x0000000005FD1000-memory.dmp
memory/4508-345-0x0000000000230000-0x0000000000234000-memory.dmp
memory/4508-341-0x0000000000230000-0x0000000000234000-memory.dmp
memory/4608-258-0x0000000000530000-0x000000000054A000-memory.dmp
memory/4608-383-0x0000000000D60000-0x0000000000D6C000-memory.dmp
memory/4636-1647-0x00007FF601A40000-0x00007FF601A5E000-memory.dmp
memory/4636-1855-0x00007FF601A40000-0x00007FF601A5E000-memory.dmp
memory/4740-343-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4740-346-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4816-2513-0x0000000000460000-0x0000000000464000-memory.dmp
memory/4876-1653-0x0000000000120000-0x00000000004C5000-memory.dmp
memory/4888-1651-0x0000000000110000-0x00000000001F9000-memory.dmp
memory/4908-397-0x0000000000D00000-0x0000000000D04000-memory.dmp
memory/4920-1630-0x0000000000110000-0x00000000001F9000-memory.dmp
memory/4920-1654-0x0000000000110000-0x00000000001F9000-memory.dmp
memory/4932-347-0x0000000000AF0000-0x0000000000B26000-memory.dmp
memory/4932-349-0x0000000000AF0000-0x0000000000B26000-memory.dmp
memory/4932-353-0x0000000000AF0000-0x0000000000B26000-memory.dmp
memory/4932-351-0x0000000000AF0000-0x0000000000B26000-memory.dmp
memory/4932-348-0x0000000000AF0000-0x0000000000B26000-memory.dmp
memory/4932-350-0x0000000000AF0000-0x0000000000B26000-memory.dmp
memory/5000-2771-0x000001FE9D580000-0x000001FE9D5CA000-memory.dmp
memory/5108-2552-0x0000023F51860000-0x0000023F51886000-memory.dmp
memory/5108-2557-0x0000023F51FE0000-0x0000023F51FE8000-memory.dmp
memory/5108-2545-0x0000023F329D0000-0x0000023F32CB2000-memory.dmp
memory/5108-2546-0x0000023F33100000-0x0000023F33110000-memory.dmp
memory/5108-2547-0x0000023F51250000-0x0000023F51258000-memory.dmp
memory/5108-2548-0x0000023F51820000-0x0000023F51858000-memory.dmp
memory/5108-2550-0x0000023F51EB0000-0x0000023F51FB0000-memory.dmp
memory/5108-2555-0x0000023F51890000-0x0000023F5189A000-memory.dmp
memory/5108-2554-0x0000023F51FB0000-0x0000023F51FC6000-memory.dmp
memory/5108-2553-0x0000023F518A0000-0x0000023F518A8000-memory.dmp
memory/5108-2556-0x0000023F51810000-0x0000023F5181A000-memory.dmp
memory/5108-2549-0x0000023F517F0000-0x0000023F517FE000-memory.dmp
memory/5108-2551-0x0000023F51800000-0x0000023F5180A000-memory.dmp
memory/5160-506-0x0000021036E20000-0x00000210370B8000-memory.dmp
memory/5272-2412-0x00000000002B0000-0x00000000002B4000-memory.dmp
memory/5300-1520-0x0000000002A40000-0x0000000002A52000-memory.dmp
memory/5300-1519-0x00000000029F0000-0x00000000029FC000-memory.dmp
memory/5300-1506-0x000000001BA60000-0x000000001BA82000-memory.dmp
memory/5300-1499-0x0000000000920000-0x0000000000930000-memory.dmp
memory/5328-366-0x0000000000430000-0x000000000043A000-memory.dmp
memory/5328-367-0x0000000004D00000-0x0000000005057000-memory.dmp
memory/5348-496-0x0000000000C60000-0x0000000000C6E000-memory.dmp
memory/5528-451-0x0000000000D80000-0x0000000000D84000-memory.dmp
memory/5528-449-0x0000000000D80000-0x0000000000D84000-memory.dmp
memory/5728-1683-0x00007FFB9D690000-0x00007FFB9D8F6000-memory.dmp
memory/5728-1685-0x00007FF7C1D70000-0x00007FF7C1EC4000-memory.dmp
memory/5728-2446-0x00007FFB9D690000-0x00007FFB9D8F6000-memory.dmp
memory/5728-1869-0x00007FFB9D690000-0x00007FFB9D8F6000-memory.dmp
memory/5752-2617-0x00007FFB9DB00000-0x00007FFB9DD66000-memory.dmp
memory/5752-2640-0x00007FFB9DB00000-0x00007FFB9DD66000-memory.dmp
memory/5752-2618-0x00007FF7C1D70000-0x00007FF7C1EC4000-memory.dmp
memory/5804-418-0x0000000003490000-0x0000000003890000-memory.dmp
memory/5804-384-0x0000000003490000-0x0000000003890000-memory.dmp
memory/5804-386-0x00007FFBCAA60000-0x00007FFBCAC69000-memory.dmp
memory/5804-388-0x00000000771E0000-0x0000000077432000-memory.dmp
memory/5804-417-0x0000000003490000-0x0000000003890000-memory.dmp
memory/5804-385-0x0000000003490000-0x0000000003890000-memory.dmp
memory/5804-412-0x0000000004210000-0x0000000004247000-memory.dmp
memory/5804-377-0x00000000015B0000-0x0000000001646000-memory.dmp
memory/5872-401-0x0000000000400000-0x0000000000436000-memory.dmp
memory/5872-400-0x0000000000D00000-0x0000000000D04000-memory.dmp
memory/5904-1553-0x0000000000400000-0x0000000000436000-memory.dmp
memory/5904-1552-0x00000000009B0000-0x00000000009B4000-memory.dmp