Overview

overview

10

Static

static

10

2026-05-04...or.exe

windows10-2004-x64

10

2026-05-04...or.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/05/2026, 14:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
  • Size 1.7MB
  • Sample260504-rmrtjadv6z
  • SHA256 f6d9b78b52bb037af353d2379eab8eb0cffaf0547b71dcb026f27049ca3f3ae8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryneshtaxredpersistencespywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detect Neshta payload 64 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 43 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 44 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:6088
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            5⤵
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:868
            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1320
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4508
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5440
            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1340
              • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1016
              • C:\ProgramData\Synaptics\Synaptics.exe
                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2068
                • C:\Windows\svchost.com
                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:3688
                  • C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE
                    C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate
                    9⤵
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:5204
                    • C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE
                      "C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5620
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Windows\SysWOW64\._cache_Synaptics.exe
      "C:\Windows\system32\._cache_Synaptics.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5356
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2144
          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3220
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5060
            • C:\Windows\SysWOW64\._cache_Synaptics.exe
              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2028
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2696
                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4356
                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5220
                  • C:\ProgramData\Synaptics\Synaptics.exe
                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:1156
                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:840
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5512
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • Drops file in System32 directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:6012
                          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:3568
                          • C:\ProgramData\Synaptics\Synaptics.exe
                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:2900
                            • C:\Windows\SysWOW64\._cache_Synaptics.exe
                              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:3272
                              • C:\Windows\svchost.com
                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4024
                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  • Drops file in System32 directory
                                  • Suspicious use of WriteProcessMemory
                                  PID:2896
                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3240
                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Drops file in System32 directory
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:4524
                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:1736
                                      • C:\Windows\svchost.com
                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:3528
                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • Drops file in System32 directory
                                          • Suspicious use of WriteProcessMemory
                                          PID:4088
                                          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2436
                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Drops file in System32 directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:4932
                                            • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5432
                                              • C:\Windows\svchost.com
                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4396
                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Adds Run key to start application
                                                  • Drops file in System32 directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4076
                                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4884
                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2504
                                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Drops file in Windows directory
                                                      • Modifies registry class
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1300
                                                      • C:\Windows\svchost.com
                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3964
                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Adds Run key to start application
                                                          • Drops file in System32 directory
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2880
                                                          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5656
                                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Drops file in System32 directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3820
                                                            • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1860
                                                              • C:\Windows\svchost.com
                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:6052
                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5712
                                                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2140
                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Drops file in System32 directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3320
                                                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • Modifies registry class
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5476
                                                                      • C:\Windows\svchost.com
                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2216
                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Adds Run key to start application
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3384
                                                                          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:6080
                                                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Drops file in System32 directory
                                                                            • Modifies registry class
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2212
                                                                            • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Windows directory
                                                                              • Modifies registry class
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4260
                                                                              • C:\Windows\svchost.com
                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1888
                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Adds Run key to start application
                                                                                  • Drops file in System32 directory
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4620
                                                                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4580
                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                    41⤵
                                                                                    • Checks computer location settings
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in System32 directory
                                                                                    • Modifies registry class
                                                                                    PID:3268
                                                                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                      42⤵
                                                                                      • Checks computer location settings
                                                                                      • Drops file in Windows directory
                                                                                      • Modifies registry class
                                                                                      PID:364
                                                                                      • C:\Windows\svchost.com
                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                        43⤵
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5652
                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                          44⤵
                                                                                          • Loads dropped DLL
                                                                                          • Adds Run key to start application
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5984
                                                                                          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                            45⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:6000
                                                                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            • Loads dropped DLL
                                                                                            • Drops file in System32 directory
                                                                                            PID:3944
                                                                                            • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                              46⤵
                                                                                              • Drops file in Windows directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry class
                                                                                              PID:4836
                                                                                              • C:\Windows\svchost.com
                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                47⤵
                                                                                                • Drops file in Windows directory
                                                                                                PID:5868
                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                  48⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • Adds Run key to start application
                                                                                                  • Drops file in System32 directory
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3952
                                                                                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                    49⤵
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:5856
                                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                    49⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Loads dropped DLL
                                                                                                    • Drops file in System32 directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5232
                                                                                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                      50⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Modifies registry class
                                                                                                      PID:744
                                                                                                      • C:\Windows\svchost.com
                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                        51⤵
                                                                                                          PID:1896
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                            52⤵
                                                                                                            • Loads dropped DLL
                                                                                                            • Adds Run key to start application
                                                                                                            • Drops file in System32 directory
                                                                                                            PID:6048
                                                                                                            • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                              "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                              53⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:3032
                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                              53⤵
                                                                                                              • Loads dropped DLL
                                                                                                              • Drops file in System32 directory
                                                                                                              • Modifies registry class
                                                                                                              PID:3312
                                                                                                              • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                54⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Drops file in Windows directory
                                                                                                                • Modifies registry class
                                                                                                                PID:2944
                                                                                                                • C:\Windows\svchost.com
                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                  55⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  PID:3216
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                    56⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:688
                                                                                                                    • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                      "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                      57⤵
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:5728
                                                                                                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                      57⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Modifies registry class
                                                                                                                      PID:2200
                                                                                                                      • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                        "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                        58⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Modifies registry class
                                                                                                                        PID:5892
                                                                                                                        • C:\Windows\svchost.com
                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                          59⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          PID:5808
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                            60⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Adds Run key to start application
                                                                                                                            • Drops file in System32 directory
                                                                                                                            PID:2652
                                                                                                                            • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                              "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                              61⤵
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:1576
                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                              61⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Loads dropped DLL
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5852
                                                                                                                              • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                62⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry class
                                                                                                                                PID:5964
                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                  63⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4800
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                    64⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:4520
                                                                                                                                    • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                      "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                      65⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:1136
                                                                                                                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                      65⤵
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:2584
                                                                                                                                      • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                        "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                        66⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        PID:1324
                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                          67⤵
                                                                                                                                            PID:5248
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                              68⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Modifies registry class
                                                                                                                                              PID:2108
                                                                                                                                              • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                69⤵
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:3300
                                                                                                                                              • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                69⤵
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Modifies registry class
                                                                                                                                                PID:1500
                                                                                                                                                • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                  "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                  70⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:4912
                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                    71⤵
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:5408
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                      72⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      PID:5444
                                                                                                                                                      • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                        "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                        73⤵
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:5552
                                                                                                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                        73⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        PID:976
                                                                                                                                                        • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                          "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                          74⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:5772
                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                            75⤵
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:5728
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                              76⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:3208
                                                                                                                                                              • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                77⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:5304
                                                                                                                                                              • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                77⤵
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                PID:1944
                                                                                                                                                                • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                  "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  PID:3472
                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:5632
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4072
                                                                                                                                                                      • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                        "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                        PID:4464
                                                                                                                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                        81⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        PID:3532
                                                                                                                                                                        • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                          "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          PID:5980
                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                            83⤵
                                                                                                                                                                              PID:1484
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                PID:2680
                                                                                                                                                                                • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                  "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:924
                                                                                                                                                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                  PID:4976
                                                                                                                                                                                  • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    PID:5228
                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3756
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4696
                                                                                                                                                                                        • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                          "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:5480
                                                                                                                                                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:1076
                                                                                                                                                                                          • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            PID:4832
                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:3968
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                PID:4292
                                                                                                                                                                                                • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                  "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:6020
                                                                                                                                                                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                  PID:6112
                                                                                                                                                                                                  • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                    "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                    PID:5488
                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:4016
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        PID:4772
                                                                                                                                                                                                        • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                          "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:1612
                                                                                                                                                                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:2052
                                                                                                                                                                                                          • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:312
                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                PID:4608
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:1136
                                                                                                                                                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    PID:3744
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:1992
                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:4528
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:4948
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                            PID:8
                                                                                                                                                                                                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                            PID:1836
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:5372
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  PID:4876
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                    PID:3236
                                                                                                                                                                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    PID:5004
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:5008
                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:1264
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          PID:4080
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:1960
                                                                                                                                                                                                                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            PID:6056
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:2180
                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:5124
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                  PID:5636
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                    PID:552
                                                                                                                                                                                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    PID:3308
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                      PID:3568
                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5544
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          PID:5776
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                            PID:3300
                                                                                                                                                                                                                                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1916
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                  PID:5500
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                    PID:4020
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                      PID:1172
                                                                                                                                                                                                                                                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                      PID:1940
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                        PID:1844
                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5752
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            PID:3444
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                              PID:3264
                                                                                                                                                                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                              PID:2704
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                    PID:6068
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                      PID:864
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                        PID:5816
                                                                                                                                                                                                                                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        PID:5536
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:3748
                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                              PID:1832
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:4728
                                                                                                                                                                                                                                                                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                  PID:768
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:5948
                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:1132
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                        PID:2728
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                          PID:4656
                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                          PID:3792
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:5968
                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                PID:3768
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                  PID:2672
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                    PID:6000
                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                      PID:3488
                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                          PID:160
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                            PID:5176
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                              PID:1592
                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                              PID:1236
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                PID:4968
                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3392
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                      PID:1780
                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:2128
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:2604
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                            PID:3868
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                              PID:3972
                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:5160
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:2992
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5188
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:1492
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                        PID:1508
                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1032
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:3168
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                PID:4368
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2916

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Event Triggered Execution

                                1
                                T1546

                                Change Default File Association

                                1
                                T1546.001

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Event Triggered Execution

                                1
                                T1546

                                Change Default File Association

                                1
                                T1546.001

                                Defense Evasion

                                Modify Registry

                                2
                                T1112

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Query Registry

                                1
                                T1012

                                System Information Discovery

                                2
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                ACROBR~1.EXE
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                                • Size 328KB
                                • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ACROTE~1.EXE
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
                                • Size 86KB
                                • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ADOBEC~1.EXE
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
                                • Size 5.7MB
                                • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ADelRCP.exe
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                                • Size 175KB
                                • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                RdrCEF.exe
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
                                • Size 9.4MB
                                • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AcroRd32.exe
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                                • Size 2.4MB
                                • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                WCCHRO~1.EXE
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
                                • Size 183KB
                                • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Eula.exe
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                                • Size 131KB
                                • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                FULLTR~1.EXE
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
                                • Size 254KB
                                • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                LOGTRA~1.EXE
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
                                • Size 386KB
                                • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                READER~1.EXE
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
                                • Size 92KB
                                • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                arh.exe
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
                                • Size 125KB
                                • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                32BITM~1.EXE
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
                                • Size 142KB
                                • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                64BITM~1.EXE
                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
                                • Size 278KB
                                • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ADOBEA~1.EXE
                                • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                                • Size 454KB
                                • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                jaureg.exe
                                • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                                • Size 555KB
                                • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VSTOIN~1.EXE
                                • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
                                • Size 121KB
                                • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                javaws.exe
                                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaws.exe
                                • Size 546KB
                                • SHA256 3bee29dd355e50cdf24736a2a53d8fffd9cd93e702109f20d65a7e2e2fcfd9f1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                java.exe
                                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
                                • Size 325KB
                                • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                javaw.exe
                                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
                                • Size 325KB
                                • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                IE_TO_~1.EXE
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
                                • Size 557KB
                                • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                COOKIE~1.EXE
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
                                • Size 161KB
                                • SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ELEVAT~1.EXE
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
                                • Size 1.8MB
                                • SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                IDENTI~1.EXE
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE
                                • Size 1.1MB
                                • SHA256 94c99d3284962585c15fdb061e0685287df11c872ef930263e251d8d3084d5b0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                setup.exe
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe
                                • Size 6.6MB
                                • SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MSEDGE~2.EXE
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE
                                • Size 1.1MB
                                • SHA256 550e6ad6b5fb0dabd28d9009c790b22e9444fc9fc30e952210727f6ac4a00389
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MSEDGE~3.EXE
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~3.EXE
                                • Size 1.5MB
                                • SHA256 eb9bbc44c181ddef0d8b53b69bd7327f5c150c0b72d92805a9f3a9ba333f0575
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                NOTIFI~1.EXE
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE
                                • Size 1.3MB
                                • SHA256 447a7ccfbece37792dfd82e6cf4e644e261dbe0f3e23a13c475276e8e4fa3561
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                PWAHEL~1.EXE
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE
                                • Size 1.1MB
                                • SHA256 c57f8707c1fda09d33efc6b615c0d48174253e9869772841446302748f1f9016
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msedge.exe
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe
                                • Size 3.8MB
                                • SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ELEVAT~1.EXE
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\ELEVAT~1.EXE
                                • Size 3.8MB
                                • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                PWAHEL~1.EXE
                                • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\PWAHEL~1.EXE
                                • Size 1.4MB
                                • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ie_to_edge_stub.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
                                • Size 562KB
                                • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                setup.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
                                • Size 7.1MB
                                • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                cookie_exporter.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
                                • Size 155KB
                                • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                elevation_service.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
                                • Size 2.2MB
                                • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                identity_helper.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
                                • Size 1.4MB
                                • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msedge.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe
                                • Size 4.0MB
                                • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msedge_proxy.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe
                                • Size 1.5MB
                                • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msedge_pwa_launcher.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
                                • Size 1.8MB
                                • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msedgewebview2.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
                                • Size 3.4MB
                                • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                notification_click_helper.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
                                • Size 1.6MB
                                • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msedge.exe
                                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                                • Size 4.0MB
                                • SHA256 80489012dc94a5dce7e87c557fd04458101437555feab9016ddadf4895b0cd5b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                RCX4561.tmp
                                • Path C:\ProgramData\Synaptics\RCX4561.tmp
                                • Size 753KB
                                • SHA256 4dcae97eb5017edd627a55bccde72df8420e65948ece25967070c45e4690bedd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
                                • Size 990KB
                                • SHA256 f257a6fea80db5faea3ee86986d06899ff0299b818b70e723a824a12fa7aa606
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ._cache__CACHE~1.EXE
                                • Path C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
                                • Size 196KB
                                • SHA256 84f69d439cdee84afd417529680730509fd0f11e7e0a9e4f1ba75d15410f6f12
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
                                • Size 949KB
                                • SHA256 fa322f0e2c97cdd994b2aaf53ac94f53f02e08c049863604ece62675b3f13c6c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
                                • Size 1.7MB
                                • SHA256 d267dd7d59eba53b565776fc88a116d8176227225c4cd05c35344f7fb144ec90
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                directx.sys
                                • Path C:\Windows\directx.sys
                                • Size 57B
                                • SHA256 d450a68cb3fc838b7658dc7d0c0ebe239a29285410b1af7b76497779d23f27c2
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                directx.sys
                                • Path C:\Windows\directx.sys
                                • Size 57B
                                • SHA256 e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                svchost.com
                                • Path C:\Windows\svchost.com
                                • Size 40KB
                                • SHA256 03576289d8c009ce2d1cd53661661889d42c266b209fc781b4d47b95f43de122
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/840-828-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/840-829-0x00000000007A0000-0x0000000000D53000-memory.dmp
                                Download

                                memory/868-358-0x0000000000920000-0x0000000000ED3000-memory.dmp
                                Download

                                memory/868-356-0x0000000000400000-0x00000000004F3000-memory.dmp
                                Download

                                memory/868-362-0x00000000060D0000-0x0000000006471000-memory.dmp
                                Download

                                memory/1156-833-0x0000000000870000-0x0000000000E23000-memory.dmp
                                Download

                                memory/1156-834-0x00000000067B0000-0x0000000006B51000-memory.dmp
                                Download

                                memory/1156-832-0x0000000000400000-0x00000000004F3000-memory.dmp
                                Download

                                memory/1340-507-0x00000000008D0000-0x0000000000E83000-memory.dmp
                                Download

                                memory/1340-506-0x0000000000400000-0x00000000004F3000-memory.dmp
                                Download

                                memory/1404-489-0x0000000003180000-0x0000000003521000-memory.dmp
                                Download

                                memory/1404-487-0x0000000000400000-0x00000000005BA000-memory.dmp
                                Download

                                memory/1404-488-0x0000000000960000-0x0000000000F13000-memory.dmp
                                Download

                                memory/1800-532-0x0000000000780000-0x0000000000D33000-memory.dmp
                                Download

                                memory/1800-531-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/1948-125-0x0000000006AC0000-0x0000000006E61000-memory.dmp
                                Download

                                memory/1948-12-0x0000000002910000-0x0000000002911000-memory.dmp
                                Download

                                memory/1948-121-0x0000000000400000-0x00000000005BA000-memory.dmp
                                Download

                                memory/1948-122-0x0000000000B80000-0x0000000001133000-memory.dmp
                                Download

                                memory/1948-13-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                Download

                                memory/2028-735-0x00000000007C0000-0x0000000000D73000-memory.dmp
                                Download

                                memory/2028-734-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/2068-534-0x00000000008B0000-0x0000000000E63000-memory.dmp
                                Download

                                memory/2068-533-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/2144-707-0x0000000000400000-0x00000000004F3000-memory.dmp
                                Download

                                memory/2144-708-0x0000000000870000-0x0000000000E23000-memory.dmp
                                Download

                                memory/2144-709-0x0000000002EA0000-0x0000000003241000-memory.dmp
                                Download

                                memory/2696-737-0x0000000000810000-0x0000000000DC3000-memory.dmp
                                Download

                                memory/2696-736-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/2900-921-0x0000000000910000-0x0000000000EC3000-memory.dmp
                                Download

                                memory/2900-920-0x0000000000400000-0x00000000004F3000-memory.dmp
                                Download

                                memory/3272-917-0x0000000000830000-0x0000000000DE3000-memory.dmp
                                Download

                                memory/3272-916-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/3688-586-0x0000000000810000-0x0000000000DC3000-memory.dmp
                                Download

                                memory/3688-585-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/4024-919-0x0000000000860000-0x0000000000E13000-memory.dmp
                                Download

                                memory/4024-918-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/4068-475-0x0000000000400000-0x00000000005BA000-memory.dmp
                                Download

                                memory/4068-476-0x0000000000940000-0x0000000000EF3000-memory.dmp
                                Download

                                memory/4356-812-0x00000000067B0000-0x0000000006B51000-memory.dmp
                                Download

                                memory/4356-811-0x00000000008D0000-0x0000000000E83000-memory.dmp
                                Download

                                memory/4356-810-0x0000000000400000-0x00000000004F3000-memory.dmp
                                Download

                                memory/4356-813-0x00000000052C0000-0x00000000052CF000-memory.dmp
                                Download

                                memory/4508-271-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/4508-274-0x00000000007F0000-0x0000000000DA3000-memory.dmp
                                Download

                                memory/4596-718-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/4596-719-0x0000000000860000-0x0000000000E13000-memory.dmp
                                Download

                                memory/4776-738-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/4776-739-0x0000000000830000-0x0000000000DE3000-memory.dmp
                                Download

                                memory/5060-740-0x0000000000400000-0x00000000004F3000-memory.dmp
                                Download

                                memory/5060-742-0x00000000067B0000-0x0000000006B51000-memory.dmp
                                Download

                                memory/5060-741-0x0000000000830000-0x0000000000DE3000-memory.dmp
                                Download

                                memory/5204-751-0x0000000000400000-0x00000000004F3000-memory.dmp
                                Download

                                memory/5204-753-0x0000000002E80000-0x0000000003221000-memory.dmp
                                Download

                                memory/5204-752-0x0000000000880000-0x0000000000E33000-memory.dmp
                                Download

                                memory/5356-514-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/5356-515-0x00000000007F0000-0x0000000000DA3000-memory.dmp
                                Download

                                memory/5440-325-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/5440-326-0x0000000000830000-0x0000000000DE3000-memory.dmp
                                Download

                                memory/5512-830-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/5512-831-0x00000000007A0000-0x0000000000D53000-memory.dmp
                                Download

                                memory/6012-899-0x0000000000400000-0x00000000004F3000-memory.dmp
                                Download

                                memory/6012-900-0x0000000000880000-0x0000000000E33000-memory.dmp
                                Download

                                memory/6012-901-0x00000000068F0000-0x0000000006C91000-memory.dmp
                                Download

                                memory/6088-174-0x0000000000400000-0x000000000041B000-memory.dmp
                                Download

                                memory/6088-175-0x00000000007E0000-0x0000000000D93000-memory.dmp
                                Download