Overview

overview

10

Static

static

10

2026-05-28...da.exe

windows10-2004-x64

10

2026-05-28...da.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/05/2026, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
  • Size 3.3MB
  • Sample260528-e7jbnsft7m
  • SHA256 6f52f69c303432dec22989cc6201036ede691bdf2764211da2f052283d072e2e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryneshtaxredpersistencespywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detect Neshta payload 60 IoCs
  • Checks computer location settings 2 TTPs 30 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 51 IoCs
  • Loads dropped DLL 8 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 7 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 56 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 27 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 21 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4176
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:2236
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1464
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4364
            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3888
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2332
                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:5068
                  • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
                    "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:1712
                    • C:\Windows\svchost.com
                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4984
                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4904
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                          dw20.exe -x -s 1240
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          PID:5428
                  • C:\ProgramData\Synaptics\Synaptics.exe
                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:1540
                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:4072
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:7116
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:6624
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                            dw20.exe -x -s 1116
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:3128
            • C:\ProgramData\Synaptics\Synaptics.exe
              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3976
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4404
                • C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:8
                  • C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE
                    "C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE" InjUpdate
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:1620
                    • C:\Windows\svchost.com
                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2736
                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:4556
                        • C:\ProgramData\Synaptics\._cache__CACHE~2.EXE
                          "C:\ProgramData\Synaptics\._cache__CACHE~2.EXE" InjUpdate
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:3952
                          • C:\Windows\svchost.com
                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:5688
                            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:6292
                              • C:\ProgramData\Synaptics\._cache__CACHE~1.EXE
                                "C:\ProgramData\Synaptics\._cache__CACHE~1.EXE" InjUpdate
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:4812
                                • C:\Windows\svchost.com
                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:6528
                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:6428
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                      dw20.exe -x -s 1132
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      PID:7216
                              • C:\ProgramData\Synaptics\Synaptics.exe
                                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:5460
                                • C:\ProgramData\Synaptics\._cache_Synaptics.exe
                                  "C:\ProgramData\Synaptics\._cache_Synaptics.exe" InjUpdate
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:6472
                                  • C:\Windows\svchost.com
                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:6004
                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                      18⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3276
                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                        dw20.exe -x -s 1116
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Checks processor information in registry
                                        • Enumerates system info in registry
                                        PID:7928
                        • C:\ProgramData\Synaptics\Synaptics.exe
                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:5248
                          • C:\ProgramData\Synaptics\._cache_Synaptics.exe
                            "C:\ProgramData\Synaptics\._cache_Synaptics.exe" InjUpdate
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:4600
                            • C:\Windows\svchost.com
                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                              14⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5920
                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:6448
                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                  dw20.exe -x -s 1156
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  PID:5432
                  • C:\ProgramData\Synaptics\Synaptics.exe
                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:3656
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Windows\SysWOW64\._cache_Synaptics.exe
      "C:\Windows\system32\._cache_Synaptics.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2668
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3872
          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4564
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:884
              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:624
                • C:\Windows\SysWOW64\._cache__CACHE~1.EXE
                  "C:\Windows\SysWOW64\._cache__CACHE~1.EXE"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1552
                  • C:\Windows\svchost.com
                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2504
                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2500
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                        dw20.exe -x -s 1012
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:5768
                • C:\ProgramData\Synaptics\Synaptics.exe
                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  PID:2112
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
            5⤵
            • Executes dropped EXE
            PID:4120
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2892
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:5400
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:7272

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        2
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        3
        T1012

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEC~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
        • Size 5.7MB
        • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADelRCP.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
        • Size 175KB
        • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WCCHRO~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
        • Size 183KB
        • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Eula.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
        • Size 131KB
        • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FULLTR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
        • Size 254KB
        • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        READER~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
        • Size 92KB
        • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        arh.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
        • Size 125KB
        • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        64BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
        • Size 278KB
        • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEA~1.EXE
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
        • Size 494KB
        • SHA256 32be2bca2b848da78c02140a288f1bb771cb66757f90d20126b1bcfd5bb40e62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\java.exe
        • Size 325KB
        • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaw.exe
        • Size 325KB
        • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaws.exe
        • Size 546KB
        • SHA256 3bee29dd355e50cdf24736a2a53d8fffd9cd93e702109f20d65a7e2e2fcfd9f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IE_TO_~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
        • Size 557KB
        • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        COOKIE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
        • Size 161KB
        • SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe
        • Size 6.6MB
        • SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE
        • Size 3.2MB
        • SHA256 fc0701d5c47cbd883929abfccf5f6ba88f76a4d0ebfa2d28160cf6c28f018e26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~2.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE
        • Size 1.1MB
        • SHA256 550e6ad6b5fb0dabd28d9009c790b22e9444fc9fc30e952210727f6ac4a00389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe
        • Size 3.8MB
        • SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IE_TO_~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\BHO\IE_TO_~1.EXE
        • Size 562KB
        • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
        • Size 7.1MB
        • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
        • Size 155KB
        • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
        • Size 3.8MB
        • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
        • Size 2.2MB
        • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
        • Size 1.4MB
        • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_pwa_launcher.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
        • Size 1.8MB
        • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgewebview2.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
        • Size 3.4MB
        • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_click_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
        • Size 1.6MB
        • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
        • Size 1.5MB
        • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
        • Size 1.4MB
        • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
        • Size 4.0MB
        • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX7700.tmp
        • Path C:\ProgramData\Synaptics\RCX7700.tmp
        • Size 753KB
        • SHA256 3191bb5f7030e09e7c540bcdf711b2438cd80ffabcc648f67a3a6fb7e38f76ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Synaptics.exe
        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 3.3MB
        • SHA256 6f52f69c303432dec22989cc6201036ede691bdf2764211da2f052283d072e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
        • Size 1.8MB
        • SHA256 ff89fbc6cd0ccaba79e75198fec89b2be39985013c6634130a20cfa33e95a39d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
        • Size 2.6MB
        • SHA256 50cbae6947928a47c7c020835a5bfcd32dc11d54d9a59c5c056058d632bebf59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
        • Size 1.8MB
        • SHA256 bd7b6afde137df8bef047d9e854cdba11a971c6e1bc9b0186cab3aec17a595ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_b1994d75b730e7d2460e18daae3b2759_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_rhada.exe
        • Size 2.5MB
        • SHA256 a1932de7e9097d188d26aa0c039870c9598c3a8dce8f7401c1301fdc09098b33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache__CACHE~1.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~1.EXE
        • Size 1016KB
        • SHA256 8513ab71b3152da522168db4795fdbff36d8d190501df81d3ff986cf0019cd0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8E595E00
        • Path C:\Users\Admin\AppData\Local\Temp\8E595E00
        • Size 24KB
        • SHA256 3ecb39bcfa21878878817b49cc20852f2550abfd1e1ea65434aefebfccd9425d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        directx.sys
        • Path C:\Windows\directx.sys
        • Size 165B
        • SHA256 974d64ecac77dc286ac872be3677ba62a1e4f5826c3a3c81bde5352e97dcde15
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        directx.sys
        • Path C:\Windows\directx.sys
        • Size 57B
        • SHA256 e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        directx.sys
        • Path C:\Windows\directx.sys
        • Size 57B
        • SHA256 84ba3f2b07e112efaff6ee034b84db960521db9e504a4ac77a5e8e5e988d86d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 8c1ac16bac57c992faa8c66b68522be82f690561e77d9cd33bc557f3b642600e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/884-708-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1464-266-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1480-304-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1640-223-0x0000000000400000-0x0000000000691000-memory.dmp
        Download

        memory/1664-551-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1712-702-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2236-305-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2332-472-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2548-326-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2668-315-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2848-246-0x0000000000400000-0x0000000000758000-memory.dmp
        Download

        memory/2892-209-0x00007FFBB4D70000-0x00007FFBB4D80000-memory.dmp
        Download

        memory/2892-215-0x00007FFBB4D70000-0x00007FFBB4D80000-memory.dmp
        Download

        memory/2892-218-0x00007FFBB4D70000-0x00007FFBB4D80000-memory.dmp
        Download

        memory/2892-279-0x00007FFBB29C0000-0x00007FFBB29D0000-memory.dmp
        Download

        memory/2892-217-0x00007FFBB4D70000-0x00007FFBB4D80000-memory.dmp
        Download

        memory/2892-241-0x00007FFBB29C0000-0x00007FFBB29D0000-memory.dmp
        Download

        memory/2892-216-0x00007FFBB4D70000-0x00007FFBB4D80000-memory.dmp
        Download

        memory/3872-610-0x0000000000400000-0x0000000000691000-memory.dmp
        Download

        memory/3888-459-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/3976-530-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4176-102-0x0000000000400000-0x0000000000758000-memory.dmp
        Download

        memory/4176-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
        Download

        memory/4176-0-0x0000000000910000-0x0000000000911000-memory.dmp
        Download

        memory/4364-516-0x0000000000400000-0x0000000000691000-memory.dmp
        Download

        memory/4404-533-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4564-700-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4604-105-0x0000000000400000-0x0000000000758000-memory.dmp
        Download

        memory/4604-106-0x0000000000400000-0x0000000000758000-memory.dmp
        Download

        memory/4604-406-0x0000000000400000-0x0000000000758000-memory.dmp
        Download

        memory/4904-750-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-749-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-782-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-780-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-778-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-776-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-774-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-772-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-768-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-766-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-764-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-762-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-758-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-756-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-755-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-752-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-744-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-736-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-770-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-746-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-734-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-740-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-738-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-742-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-730-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-726-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-724-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-723-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-720-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-718-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-716-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-714-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-712-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-710-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-732-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-728-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-709-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/4904-760-0x0000000000A90000-0x0000000000B7E000-memory.dmp
        Download

        memory/5068-701-0x0000000000400000-0x00000000005CB000-memory.dmp
        Download