Overview

overview

10

Static

static

10

2026-05-28...ry.exe

windows10-2004-x64

10

2026-05-28...ry.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/05/2026, 09:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
  • Size 1.6MB
  • Sample260528-llff8adx4x
  • SHA256 04eaf677b85a49ec62bdf3db4d3eb7f5a324a028e4024ee8b959a0c418b86153
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryneshtaxredpersistencespywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detect Neshta payload 64 IoCs
  • Checks computer location settings 2 TTPs 29 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 50 IoCs
  • Loads dropped DLL 14 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 7 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 57 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:892
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3652
      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:880
        • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:688
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:668
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3136
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4880
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4112
            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:5092
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4556
                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2572
            • C:\ProgramData\Synaptics\Synaptics.exe
              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3520
              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:216
                • C:\Windows\svchost.com
                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1336
                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3696
                    • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                      "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:1012
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4028
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:1232
                    • C:\ProgramData\Synaptics\Synaptics.exe
                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:1468
                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:2560
                        • C:\Windows\svchost.com
                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4384
                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1980
                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:4364
                              • C:\Windows\svchost.com
                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4800
                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2424
                            • C:\ProgramData\Synaptics\Synaptics.exe
                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:2644
                              • C:\Windows\svchost.com
                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:3200
                                • C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE
                                  C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:4960
                                  • C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE
                                    "C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE" InjUpdate
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:1756
                                    • C:\Windows\svchost.com
                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                      18⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3492
                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2368
                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:764
                                    • C:\ProgramData\Synaptics\._cache_Synaptics.exe
                                      "C:\ProgramData\Synaptics\._cache_Synaptics.exe" InjUpdate
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:916
                                      • C:\Windows\svchost.com
                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:1864
                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2576
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\SysWOW64\._cache_Synaptics.exe
      "C:\Windows\system32\._cache_Synaptics.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4504
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1240
        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3780
          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3732
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1676
              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1148
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1640
            • C:\Windows\SysWOW64\._cache_Synaptics.exe
              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:1176
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4132
                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:2332
                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies system executable filetype association
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:908
                    • C:\Windows\svchost.com
                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1776
                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:4400
                  • C:\ProgramData\Synaptics\Synaptics.exe
                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    PID:2632
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1768
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:1188
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:3916
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:4852
  • C:\Windows\System32\mousocoreworker.exe
    C:\Windows\System32\mousocoreworker.exe -Embedding
    1⤵
      PID:2632

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ACROBR~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
          • Size 328KB
          • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ACROTE~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
          • Size 86KB
          • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADOBEC~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
          • Size 5.7MB
          • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADelRCP.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
          • Size 175KB
          • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RdrCEF.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
          • Size 9.4MB
          • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AcroRd32.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
          • Size 2.4MB
          • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WCCHRO~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
          • Size 183KB
          • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Eula.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
          • Size 131KB
          • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FULLTR~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
          • Size 254KB
          • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LOGTRA~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
          • Size 386KB
          • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          READER~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
          • Size 92KB
          • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          arh.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
          • Size 125KB
          • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          32BITM~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
          • Size 142KB
          • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          64BITM~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
          • Size 278KB
          • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADOBEA~1.EXE
          • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
          • Size 454KB
          • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AdobeARM.exe
          • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
          • Size 1.2MB
          • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jaureg.exe
          • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
          • Size 555KB
          • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSTOIN~1.EXE
          • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
          • Size 121KB
          • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java.exe
          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
          • Size 325KB
          • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javaws.exe
          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
          • Size 505KB
          • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DISABL~1.EXE
          • Path C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE
          • Size 5.7MB
          • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IE_TO_~1.EXE
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
          • Size 557KB
          • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ie_to_edge_stub.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
          • Size 562KB
          • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
          • Size 7.1MB
          • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cookie_exporter.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
          • Size 155KB
          • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevated_tracing_service.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
          • Size 3.8MB
          • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
          • Size 2.2MB
          • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          identity_helper.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
          • Size 1.4MB
          • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge_proxy.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe
          • Size 1.5MB
          • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgewebview2.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
          • Size 3.4MB
          • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_helper.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_helper.exe
          • Size 1.6MB
          • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PWAHEL~1.EXE
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
          • Size 1.4MB
          • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
          • Size 4.0MB
          • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RCX581E.tmp
          • Path C:\ProgramData\Synaptics\RCX581E.tmp
          • Size 753KB
          • SHA256 f76907dc1225628936a46fa09f66555899db4ce8e8d46b7b34552516a6754a4f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Synaptics.exe
          • Path C:\ProgramData\Synaptics\Synaptics.exe
          • Size 1.6MB
          • SHA256 04eaf677b85a49ec62bdf3db4d3eb7f5a324a028e4024ee8b959a0c418b86153
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ._cache_._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
          • Path C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
          • Size 95KB
          • SHA256 fedc6a0c85fac7544fe8aee014c46f6aec632211d5322e5f2669bae7aaa7d7b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
          • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
          • Size 889KB
          • SHA256 4bd8c7a5a77b2973aa0e0c0829127c3aa0a56efa6bae947d9e4d9ed8af7ee860
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ._cache_._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
          • Size 55KB
          • SHA256 1701b144ea17db4842862f5187b1ab99eb39df2a6adc7a0f4246dc40c5d63a05
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_ca695912dd5e1f9d458372bc869b7039_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
          • Size 849KB
          • SHA256 77265bdeedb91d813f52257b10ef9a2f6efc8ee7b0fd9ba89b1b0d127efa1695
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          directx.sys
          • Path C:\Windows\directx.sys
          • Size 57B
          • SHA256 998e1546bc98d29ffccb70e81ed00a01f3dbd3015e947d1aabca4cb01775ce28
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          directx.sys
          • Path C:\Windows\directx.sys
          • Size 57B
          • SHA256 d450a68cb3fc838b7658dc7d0c0ebe239a29285410b1af7b76497779d23f27c2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          svchost.com
          • Path C:\Windows\svchost.com
          • Size 40KB
          • SHA256 8fedbe0a2c327e6e0d7e29a1feddfb3474d290546c5f5a2477f6cddc98c96535
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/216-587-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/668-316-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/688-315-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/764-918-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/880-222-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/892-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
          Download

          memory/892-113-0x0000000000400000-0x00000000005A1000-memory.dmp
          Download

          memory/892-0-0x0000000000760000-0x0000000000761000-memory.dmp
          Download

          memory/908-919-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/908-927-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/908-915-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/916-905-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1012-664-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1148-564-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/1148-957-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/1176-597-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1188-588-0x00007FFE0B610000-0x00007FFE0B620000-memory.dmp
          Download

          memory/1188-586-0x00007FFE0B610000-0x00007FFE0B620000-memory.dmp
          Download

          memory/1232-665-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/1232-958-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/1240-479-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1336-589-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1468-689-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/1640-600-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/1676-565-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1752-759-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1752-921-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1752-917-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1752-925-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1756-838-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1768-233-0x00007FFE0B610000-0x00007FFE0B620000-memory.dmp
          Download

          memory/1768-206-0x00007FFE0D770000-0x00007FFE0D780000-memory.dmp
          Download

          memory/1768-208-0x00007FFE0D770000-0x00007FFE0D780000-memory.dmp
          Download

          memory/1768-207-0x00007FFE0D770000-0x00007FFE0D780000-memory.dmp
          Download

          memory/1768-211-0x00007FFE0D770000-0x00007FFE0D780000-memory.dmp
          Download

          memory/1768-241-0x00007FFE0B610000-0x00007FFE0B620000-memory.dmp
          Download

          memory/1768-209-0x00007FFE0D770000-0x00007FFE0D780000-memory.dmp
          Download

          memory/1776-677-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1864-908-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/1980-715-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/2332-684-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/2368-962-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/2368-837-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/2424-960-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/2424-711-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/2560-678-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/2572-509-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/2572-956-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/2576-904-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/2576-963-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/2632-691-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/2644-729-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3136-351-0x0000000000400000-0x00000000005A1000-memory.dmp
          Download

          memory/3136-114-0x0000000000400000-0x00000000005A1000-memory.dmp
          Download

          memory/3200-732-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3492-839-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3520-599-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/3652-916-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3652-920-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3652-928-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3652-710-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3696-675-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/3732-563-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3780-566-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/3916-702-0x00007FFE0B610000-0x00007FFE0B620000-memory.dmp
          Download

          memory/3916-701-0x00007FFE0B610000-0x00007FFE0B620000-memory.dmp
          Download

          memory/4028-666-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4112-499-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/4132-605-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4364-712-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4384-679-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4400-676-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/4400-959-0x0000000000400000-0x000000000041D000-memory.dmp
          Download

          memory/4504-368-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4556-545-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4636-267-0x0000000000400000-0x00000000005A1000-memory.dmp
          Download

          memory/4800-713-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4852-907-0x00007FFE0B610000-0x00007FFE0B620000-memory.dmp
          Download

          memory/4852-906-0x00007FFE0B610000-0x00007FFE0B620000-memory.dmp
          Download

          memory/4880-240-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4960-848-0x0000000000400000-0x00000000004DA000-memory.dmp
          Download

          memory/5092-534-0x0000000000400000-0x000000000041B000-memory.dmp
          Download