Analysis
- max time kernel
74s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/07/2026, 22:45
General
- Target 2026-07-10_481ae4c6765e1d5e254f225292a20143_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stea.exe
- Size 16.6MB
- Sample260710-2pr77adv8m
- SHA256 7ffa07d78dfa0da827b89d76ea1b7f89b65804935a503221589ba378167ff5d8
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Family: Xred
Xred is backdoor written in Delphi.
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 21 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 59 IoCs
- Loads dropped DLL 36 IoCs
- Adds Run key to start application 2 TTPs 14 IoCs
- Drops file in System32 directory 7 IoCs
- Drops file in Windows directory 16 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 60 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 21 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 58 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_481ae4c6765e1d5e254f225292a20143_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stea.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_481ae4c6765e1d5e254f225292a20143_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stea.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\2026-07-10_481ae4c6765e1d5e254f225292a20143_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stea.exec:\users\admin\appdata\local\temp\2026-07-10_481ae4c6765e1d5e254f225292a20143_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stea.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate8⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate9⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate10⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate11⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate16⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate17⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate18⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate20⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate21⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate22⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate23⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate26⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate27⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate28⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate29⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate30⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate33⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate34⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate35⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate36⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate37⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate38⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate39⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate40⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate41⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate42⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate43⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate44⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate45⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate46⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate47⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate48⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate49⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate50⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate51⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate52⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate53⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate54⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate55⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate56⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate57⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate58⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate59⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate60⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate61⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate62⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate63⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate64⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate65⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate66⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate67⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate68⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate69⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate70⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate71⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate72⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate73⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate74⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate75⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate76⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate77⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate78⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate79⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate80⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate81⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate82⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate83⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate84⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate85⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate86⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate87⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate88⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate89⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate90⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate91⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate92⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate93⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate94⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate95⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate96⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate97⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate98⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate99⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate100⤵
-
\??\c:\users\admin\appdata\local\temp\._cache_synaptics.exec:\users\admin\appdata\local\temp\._cache_synaptics.exe InjUpdate101⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate102⤵
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe101⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe102⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe98⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe99⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe95⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe96⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe92⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe93⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe89⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe90⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe86⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe87⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe83⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe84⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe80⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe81⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe77⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe78⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe74⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe75⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe71⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe72⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe68⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe69⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe65⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe66⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe62⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe63⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe59⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe60⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe56⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe57⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe53⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe54⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe50⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe51⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe47⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe48⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe44⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe45⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe41⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe42⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe38⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe39⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe35⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe36⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe33⤵
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\._cache_synaptics.exec:\windows\syswow64\._cache_synaptics.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
RCXD721.tmp
._cache_._cache_synaptics.exe
._cache_Synaptics.exe
2026-07-10_481ae4c6765e1d5e254f225292a20143_dark-comet_darkgate_elex_gcleaner_glassworm_redline-stea.exe
explorer.exe
icsys.icn.exe
icsys.icn.exe
spoolsv.exe
._cache_synaptics.exe
svchost.exe
memory/8-480-0x0000000000400000-0x000000000041F000-memory.dmp
memory/224-281-0x0000000000400000-0x000000000041F000-memory.dmp
memory/408-2634-0x0000000000400000-0x000000000139F000-memory.dmp
memory/436-392-0x0000000000400000-0x000000000041F000-memory.dmp
memory/444-1261-0x0000000000400000-0x000000000041F000-memory.dmp
memory/556-52-0x0000000000400000-0x000000000041F000-memory.dmp
memory/568-2803-0x0000000000400000-0x000000000139F000-memory.dmp
memory/640-916-0x0000000000400000-0x000000000041F000-memory.dmp
memory/732-0-0x0000000000400000-0x000000000041F000-memory.dmp
memory/732-58-0x0000000000400000-0x000000000041F000-memory.dmp
memory/756-1606-0x0000000000400000-0x000000000139F000-memory.dmp
memory/1128-575-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1292-1165-0x0000000003050000-0x000000000306F000-memory.dmp
memory/1292-1166-0x0000000003050000-0x000000000306F000-memory.dmp
memory/1292-1242-0x0000000000400000-0x000000000139F000-memory.dmp
memory/1456-1259-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1472-2891-0x0000000000400000-0x000000000139F000-memory.dmp
memory/1608-2293-0x0000000000400000-0x000000000139F000-memory.dmp
memory/1688-829-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1704-745-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1744-642-0x00000000050C0000-0x00000000050DF000-memory.dmp
memory/1744-643-0x00000000050C0000-0x00000000050DF000-memory.dmp
memory/1744-662-0x0000000000400000-0x000000000139F000-memory.dmp
memory/1772-1069-0x0000000000400000-0x000000000139F000-memory.dmp
memory/1772-1070-0x0000000003150000-0x0000000003162000-memory.dmp
memory/1772-992-0x0000000003150000-0x000000000316F000-memory.dmp
memory/1772-993-0x0000000003150000-0x000000000316F000-memory.dmp
memory/1860-1843-0x0000000000400000-0x000000000139F000-memory.dmp
memory/1880-347-0x0000000000400000-0x000000000139F000-memory.dmp
memory/1896-283-0x0000000000400000-0x000000000147E000-memory.dmp
memory/1936-985-0x00000000050D0000-0x00000000050EF000-memory.dmp
memory/1936-984-0x00000000050D0000-0x00000000050EF000-memory.dmp
memory/1936-1003-0x0000000000400000-0x000000000139F000-memory.dmp
memory/2060-117-0x0000000000400000-0x000000000147E000-memory.dmp
memory/2060-9-0x0000000003210000-0x0000000003211000-memory.dmp
memory/2060-10-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/2080-244-0x0000000000400000-0x000000000147E000-memory.dmp
memory/2092-1413-0x0000000000400000-0x000000000139F000-memory.dmp
memory/2092-1336-0x0000000005080000-0x000000000509F000-memory.dmp
memory/2092-1337-0x0000000005080000-0x000000000509F000-memory.dmp
memory/2112-727-0x0000000000400000-0x000000000139F000-memory.dmp
memory/2112-650-0x0000000005090000-0x00000000050AF000-memory.dmp
memory/2112-651-0x0000000005090000-0x00000000050AF000-memory.dmp
memory/2132-660-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2172-2784-0x0000000000400000-0x000000000139F000-memory.dmp
memory/2196-901-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2232-1260-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2280-1499-0x0000000000400000-0x000000000139F000-memory.dmp
memory/2460-2186-0x0000000000400000-0x000000000139F000-memory.dmp
memory/2512-576-0x0000000000400000-0x000000000139F000-memory.dmp
memory/2512-553-0x00000000050D0000-0x00000000050EF000-memory.dmp
memory/2512-552-0x00000000050D0000-0x00000000050EF000-memory.dmp
memory/2640-1345-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2672-830-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2748-353-0x00000000031B0000-0x00000000031CF000-memory.dmp
memory/2748-354-0x00000000031B0000-0x00000000031CF000-memory.dmp
memory/2748-374-0x0000000000400000-0x000000000139F000-memory.dmp
memory/2944-1864-0x0000000000400000-0x000000000139F000-memory.dmp
memory/2960-831-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3060-1174-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3200-350-0x0000000000400000-0x000000000139F000-memory.dmp
memory/3256-1004-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3284-467-0x00000000031E0000-0x00000000031FF000-memory.dmp
memory/3284-466-0x00000000031E0000-0x00000000031FF000-memory.dmp
memory/3284-549-0x0000000000400000-0x000000000139F000-memory.dmp
memory/3288-1585-0x0000000000400000-0x000000000139F000-memory.dmp
memory/3372-898-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3380-908-0x0000000005090000-0x00000000050AF000-memory.dmp
memory/3380-983-0x0000000000400000-0x000000000139F000-memory.dmp
memory/3464-1243-0x0000000003130000-0x000000000314F000-memory.dmp
memory/3464-1262-0x0000000000400000-0x000000000139F000-memory.dmp
memory/3484-2718-0x0000000000400000-0x000000000139F000-memory.dmp
memory/3500-1519-0x0000000000400000-0x000000000139F000-memory.dmp
memory/3564-1949-0x0000000000400000-0x000000000139F000-memory.dmp
memory/3788-1757-0x0000000000400000-0x000000000139F000-memory.dmp
memory/3816-2464-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4016-2699-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4052-574-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4056-821-0x0000000003170000-0x000000000318F000-memory.dmp
memory/4056-897-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4056-820-0x0000000003170000-0x000000000318F000-memory.dmp
memory/4064-383-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4108-1156-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4108-1079-0x0000000003160000-0x000000000317F000-memory.dmp
memory/4108-1080-0x0000000003160000-0x000000000317F000-memory.dmp
memory/4116-917-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4164-1692-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4284-2100-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4336-641-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4336-564-0x00000000030E0000-0x00000000030FF000-memory.dmp
memory/4336-565-0x00000000030E0000-0x00000000030FF000-memory.dmp
memory/4380-1089-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4420-1671-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4464-900-0x00000000031B0000-0x00000000031CF000-memory.dmp
memory/4464-918-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4464-899-0x00000000031B0000-0x00000000031CF000-memory.dmp
memory/4468-1929-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4564-1250-0x0000000003170000-0x000000000318F000-memory.dmp
memory/4564-1251-0x0000000003170000-0x000000000318F000-memory.dmp
memory/4564-1327-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4600-1175-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4624-659-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4636-2444-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4668-279-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4680-729-0x0000000003120000-0x000000000313F000-memory.dmp
memory/4680-728-0x0000000003120000-0x000000000313F000-memory.dmp
memory/4680-746-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4704-356-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4704-393-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4716-743-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4744-1002-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4896-1001-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4908-479-0x0000000000400000-0x000000000139F000-memory.dmp
memory/4908-454-0x0000000003320000-0x000000000333F000-memory.dmp
memory/4908-455-0x0000000003320000-0x000000000333F000-memory.dmp
memory/5020-491-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5044-1346-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5196-367-0x0000000003260000-0x000000000327F000-memory.dmp
memory/5196-368-0x0000000003260000-0x000000000327F000-memory.dmp
memory/5196-451-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5200-2273-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5220-2870-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5296-1176-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5316-744-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5340-2117-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5364-811-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5384-2529-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5396-2379-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5400-2550-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5448-832-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5448-812-0x00000000031A0000-0x00000000031BF000-memory.dmp
memory/5448-813-0x00000000031A0000-0x00000000031BF000-memory.dmp
memory/5452-2207-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5460-56-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5512-282-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5512-181-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5596-278-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5604-478-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5656-661-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5700-47-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5712-1434-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5772-2035-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5800-2615-0x0000000000400000-0x000000000139F000-memory.dmp
memory/5812-1090-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5868-573-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5992-1088-0x0000000000400000-0x000000000041F000-memory.dmp
memory/6012-1328-0x0000000003240000-0x000000000325F000-memory.dmp
memory/6012-1347-0x0000000000400000-0x000000000139F000-memory.dmp
memory/6012-1329-0x0000000003240000-0x000000000325F000-memory.dmp
memory/6024-1157-0x0000000003240000-0x000000000325F000-memory.dmp
memory/6024-1158-0x0000000003240000-0x000000000325F000-memory.dmp
memory/6024-1177-0x0000000000400000-0x000000000139F000-memory.dmp
memory/6028-280-0x0000000000400000-0x000000000041F000-memory.dmp
memory/6028-271-0x0000000000400000-0x000000000041F000-memory.dmp
memory/6032-2358-0x0000000000400000-0x000000000139F000-memory.dmp
memory/6044-1778-0x0000000000400000-0x000000000139F000-memory.dmp
memory/6064-1091-0x0000000000400000-0x000000000139F000-memory.dmp
memory/6064-1071-0x00000000050D0000-0x00000000050EF000-memory.dmp
memory/6064-1072-0x00000000050D0000-0x00000000050EF000-memory.dmp
memory/6072-2014-0x0000000000400000-0x000000000139F000-memory.dmp