xred | 47ccf7af5db91cfd6774898fe25950ec95ac5a9cc44334603259b2c10bca7b8a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Size 2.7MB
Sample260803-c5tnhsxane
SHA256 47ccf7af5db91cfd6774898fe25950ec95ac5a9cc44334603259b2c10bca7b8a
MD5 5af98b017d095f61ebe894def4f1f8e1
SHA1 5f943a6ed85797b590060ee525bb8756f61ca4ed
SHA512 33896debc120d7af084e725184df6766f07cd09ad602ad43d47802f5bb3fa4c025bec6c7f994dfe3c2103b89c53001716a4bfa07ce632c4eec4eba7fd661fd70
SSDEEP 49152:ensHyjtk2MYC5GhV83EilpQJSPYGKEilpQJSPYG:ensmtk2ak83EilnKEiln
TLSH
T12CD5E032B2928476D1235A38CD5AE3B4482A7E142D34794F3BF43E4F6F3E6816D152A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery xred persistence spyware stealer

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Executes dropped EXE 14 IoCs

pid	Process
1568	elevation_service.exe
2408	elevation_service.exe
1964	maintenanceservice.exe
6880	OSE.EXE
828	PerceptionSimulationService.exe
1104	perfhost.exe
6212	._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
5984	ReFsDedupSvc.exe
6576	Synaptics.exe
4376	SensorDataService.exe
5036	ssh-agent.exe
244	AgentService.exe
1396	Synaptics.exe
5388	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f6d54eeb957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process
2384	1396	WerFault.exe
264	6576	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075b74d6ff122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000308c09aff122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe
2408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3296	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Token: SeTakeOwnershipPrivilege	1568	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	244	AgentService.exe
Token: 33	5388	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5388	SearchIndexer.exe
Token: SeBackupPrivilege	5984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5984	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1568	elevation_service.exe
Token: SeDebugPrivilege	2408	elevation_service.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 6212	3296	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe	96
PID 3296 wrote to memory of 6576	3296	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe	98
PID 5388 wrote to memory of 5592	5388	SearchIndexer.exe	110
PID 5388 wrote to memory of 5964	5388	SearchIndexer.exe	111
PID 5388 wrote to memory of 2480	5388	SearchIndexer.exe	112
PID 5388 wrote to memory of 5156	5388	SearchIndexer.exe	113
PID 5388 wrote to memory of 4444	5388	SearchIndexer.exe	117
PID 5388 wrote to memory of 1284	5388	SearchIndexer.exe	118
PID 5388 wrote to memory of 4888	5388	SearchIndexer.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6212
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 520
    3⤵
    - Program crash
    PID:264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1964

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6880

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:828

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6576 -ip 6576
1⤵
PID:3948

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:244

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 492
  2⤵
  - Program crash
  PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1396 -ip 1396
1⤵
PID:6944

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8c787750f1fb44f6fbd274da14193ed600b44d31c03187c83836490a5ae1ce31
MD5 5901f324189f3d6e83898bb8be0f057b
SHA1 3dfd615b79907c8adaac449ad5b6bafc255918a4
SHA512 9ebd681dae2c0f7a53cfd835b1e293905bc8e68f91d4aaaec16635e0a60aa0484d098c20a0dbdc167b3157e75cd8286c4c183e206b0bf6b31a683053f5b68446
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxniEilpQJSPYG:K3q6HjBFEiln
TLSH
T115D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 831d9b588786ff7ac88a70edb31714680a1e62ad26d6fd0fa65812409d266f8f
MD5 324a6c39641c6853c32a36e50b56dea1
SHA1 1278ef17d825003f85e9593d5092b8456ea5ac5f
SHA512 36ff66973cb4a505fa062a09e454609d5e723ad87e087c4f73eb831412d1951ee64da17abad96f33872c151067911b367e5041077cc7946d804aa5489209c182
SSDEEP 12288:Z1XLsswWkxy2lRq2czAL8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:3XYfDtczAL8qZ5xpHEilpQJSPYT8L
TLSH
T11165F12877E404F9ED678278C9A2C115EA73BC1547A0E78B03E499261F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 46777bda30a7db854dec13fc865ddb34ca53f345ff8eaf6bf78c7b00cb531ef6
MD5 0ce647f975092ed032cdd257866be33f
SHA1 c9ea5a19a9d027cc25164303b03ff4cd9416cd26
SHA512 a7814bfae335b337a75d232f961be729d80cf809caafff165489dbe8772f303e111546dc25900e492d87c747a2f06a4c408d19a70a16925134b2981cb0dca751
SSDEEP 24576:d0Le5ji0hmxMrM48qZ5xpHEilpQJSPYT8L:dPji0AyDEilpQJSPYG
TLSH
T1F8859E15F6748335D073C0B9C5D2A68EE97130861B308ACB5286D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2170c5a6ec770a4436a06d9e7fb95d178e721340e63447ff6aa8dccd37d95a25
MD5 0e2546832fadec63ad539e91bc1556cf
SHA1 3e6429059d573bfdcd895a1c8cf9169f286a2a43
SHA512 8a8626d73644e35479f70f5c03dd5c53601590ad692357d8fc51ad57b7675880f205ba54f7d83802872de2949fcd1bdef5bb640390345005623c8868ddac9d8c
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyua8qZ5xpHEilpQJSPYT8L:U/ezSC6vUzPvxHjyHEilpQJSPYG
TLSH
T1D4755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e3f8834690fd382c4e38bd0e3fd1c6b378537539f10cd4cc95c42296ffc1b63b
MD5 beafaec9e441662778657d1da1c8a21f
SHA1 0a0a6186302fb26731ed532e4d7dd22e9d932df9
SHA512 570690eab2a43f683a657d7f6037f6bf372d3c9aaf6b303cef78fb4a8fdbedea5814a599d21cc5bbfb25dfcf656e93848cb457b2f5593f9e18dde9438669e8f5
SSDEEP 24576:6VbqPb88hv/l+6f8qZ5xpHEilpQJSPYT8L:6VO88hXl+2EilpQJSPYG
TLSH
T122559E66F5748331D073C0BAC5D2AA9AEE3234414B31CACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 af732b7f28f8444e0df37aa865a26f9c15c11bdc9278eb6ae469da704bc74af1
MD5 fe9c5082e771c29b75a5e3f5c0cbe382
SHA1 5c2761bd910a23d95d48a1ad2f7dc20c64f442c9
SHA512 6880dbc3b90fdc2f5ea73a52913cbf9b257259bd3163083cb9b4b774d2df78d7a2ac16c102a4ec212d65ed5d8144b9f0bb9cd1f82b7dbd063c1909247b60e066
SSDEEP 12288:2uU8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:2uU8qZ5xpHEilpQJSPYT8L
TLSH
T1184523485A54C0D5F79B6BB093C5F1DEA8B99E1844D8DA0FB4B07C0B493EA78DC9C863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b808ce8fcc90e5c57be0648e2026051aa314434ac8daf6a37961f9e4f2e7b231
MD5 d0fd2bacdd08603f33e85ad98a1de78b
SHA1 ec1eba7c81549a1fd9ab5902bcda57a1a4d5e117
SHA512 d5cc83c4072c3d0302466f3c3b929e1ddb91b1dcca7b5c0496cc295c734d52c2e7febf6f9605e1f69891c93f143e69ed3e5ceb64df43a787cad8e3af76ad410d
SSDEEP 12288:DeBNUbTVO86Un8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:DJIUn8qZ5xpHEilpQJSPYT8L
TLSH
T19465CF3BAE28FCD2D27A9DB85791C240E77278304B61A3CBE175820EDE235E45D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d423179d677c4d29633783a04021497a36ef8d157192fcbb4c790ba0dbcb133f
MD5 bef45aef9f4429e95b4856ebe3786cfd
SHA1 b573aa8a8577e0ce8c20853693836492e655b3b8
SHA512 2ddd9a736ac71eea4888c24b738112c0b3a58c8c09d0f906899348e9bbe1b9f741d3dcd2332a41836399918140a56b1a362a529db97014a2eb97b06e89384824
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:sQvGAdlCEL8c/yRNw5CIEiln
TLSH
T1B0267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 81626294e571f92fa4b979b2c52c276024741169dd201923f82ed8295eaaaebd
MD5 6780e73832f9a4209da102699514c3e7
SHA1 405fff49e8f39229f493a1a8af5f50138398379a
SHA512 b2f60b3ff8d19bbe5972fc51b4a7f770e75571b831d7858a3f54432f543129796783996b4e150aa8c14d4bae229afa42ba292e035afaa119856d92150ae28abb
SSDEEP 12288:VAwSfxL/2Dc3uDLLmt0LDQewsAjJ8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFEa:2newsAjJ8qZ5xpHEilpQJSPYT8L
TLSH
T16975E030FA74E036D3BB0DB21B26D71A547CBA204B911AC3F3E85D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e5ec98c168c38821a42be093e57d0d75b737a1a19cb426a638432f736e7761d8
MD5 e9c8d83f40d66530f75e9ca3e14a2624
SHA1 b9a4af86a09f543f9dfd6b10b2529ad5172ceae4
SHA512 a319d6184f9f54d7b02bfb8d395bf9aa2ab1c4d7d2205bc5efa9b8c0acd064803153a2d3614cbd79c6b564a97b98ef989244181b4af9963a84e6b859e2883bfb
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHQiln:OUEtQevvqc2W1cpV2EI32Q
TLSH
T1E7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 744cfad6e3cf6c1b6b7080a3a799f66f342b6f5151c4c3e94a77e092295adeeb
MD5 da9bb01a7a7f22410525595b588c0189
SHA1 1c4145ee43e1406e702630ad62527cc408819543
SHA512 4a773736d6437b7954ea8ca09f39bd50be50dcc10cc7468cf4ab55ad6c1020d62e4138cd7c04ed714c41eb56b069a3af9fc7b5ca8b684d65164d8f679d23d198
SSDEEP 49152:RCbRquA/m2yL5zLfFiV+XenmE3/zTEilpQJSPYG:eoq2Vjnm8Eiln
TLSH
T1F2D58D0976B8C1E4D1F6C77886A2C647F37178154B30ABEF5265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fc9b339887d9f4163262d48f47936ac2ab47cfadc3785353901533ba3be0d378
MD5 62ae693c67e8e73fa88c9165352ea892
SHA1 05cc370f344f27ef2a3aff48772421af12a1638d
SHA512 4a45dd065d7c63b5e5432246c9e4ebfe66b392a47fae3a352c9cb2f33f88340f9ec01a663d694ca2ec37e1511bf08011ed7e3ca57cecc91b6776f1319d8ed450
SSDEEP 24576:7AhGLJIFoiwtA5l7S53+8qZ5xpHEilpQJSPYT8L:7AMyFoiq5sEilpQJSPYG
TLSH
T1B4359D80E7F951D4F5B3AAB899B69171EA76BCA95E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8a12f4d5798d48f8693c09232c757f480c4d745562c1afa826f23b9bdaffeae9
MD5 5fd68f83acd62d7fe168464d22f1651e
SHA1 ab16470916e13bc3903136d98e115827a5ccd63b
SHA512 d559a796239dc292763f79e0a425946eb3de56e8375ebb480cb289aca4730bd994a7f16a4f52d5da3f558d6251f086b631309052ab7b5852f529959a00de0cca
SSDEEP 12288:Tmw5HEjsChNHBFgl0WDm+Cy8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:ywueOW18qZ5xpHEilpQJSPYT8L
TLSH
T1B165F14976A408F9FA6792388687C136F7F2BC012A65DB1F1760C61B5F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b6bff674e879c7caeb40462a5af742c36da634a72ea78b24846762dcdba5b440
MD5 72e6ffa6a481632eb8938a5bbd463f23
SHA1 e078bfc8df4d7e07710925f8a01ee6f30359ca82
SHA512 d87f6a152cdfeff9f82800d7aa8da26d89239ccb341f4e828f48ecca060116a3e8737f5b70773bbb383441a6f6640a5ee647e414dfa290922c221daffb8ba705
SSDEEP 12288:yXZ1IyZ8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:KZug8qZ5xpHEilpQJSPYT8L
TLSH
T1D655128933A460F9F2A7A278CAD19249E7B27C1513B583CF2160552B1F37AE55D3C732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7e0ad32b146f781658efdf34ff5c027a18d5de5f442cd4e57854a5c48277701b
MD5 720d93f714205aba0ef8c262f7a44155
SHA1 cd9b04f767821664b744c95ee1a4c362041ca9fd
SHA512 bb3fd892c91f75a1c05da53ecf9f7814caf06fffbda977855d7277f9fb460a5cf62013317b0f1d701ee3f501ea5597d190292fc9bc531f575f3369527bec8b23
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:xQRQyi36YOcPQLvw2gAf+PN3BEiln
TLSH
T176667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9b5d24fcb96ac13066060bd7b8338e593959b49dcc1e236e3a9c2326a82aff4b
MD5 0a1f05f0d1c016082e40b5d701508cf2
SHA1 fcee26186ef0d171c99879f5b7a689507d0b68f9
SHA512 5302c606c4a19accd9c958fc81ac7a6d28f0ecdfcfe01b6a89ff1174d2fc8cc9bc643d35968af221f2f051bb10af33d1cd75fbb4a167df0bf21e4f66ae7e5cac
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:XQRQyi36YOcPQLvw2gAf+PN3BEiln
TLSH
T1A0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a6a47318d4c4c7f56463e21cd6f0cd722b800114a2bfa45b3db929813bd6c92a
MD5 6c3e3823a7820da308ea9b79c2907932
SHA1 3f18d9c6474d34f090238d09f4c409e4ab9d00a0
SHA512 45296dd22503fed419070ca72a1ceb35cd849e599454a198842b8369ad2b647708ffc7b05577e3509229c80d0a74c2395eceb48082e670c397621356703d583e
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Q8qZ5xpHEilpQJ:B68Qg55nhheWu7PNU3/DEilpQJSPYG
TLSH
T1A4B55933B2F200A9D44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5a7edd294436e0b59d53b83c12ce5f2ff78ae0aea47898ecc4efbeab46992b45
MD5 3a91e17f9e89615d63e00036dbb36329
SHA1 7dda8599b0f60553892806790161663f6024c559
SHA512 98f1d9a7e387cdbd12c94b283fcf853e95375d58699a45e943a428031909c2bed1d189641b08fb11a3fa593735582dff2fce07c9efdcffaa9a4b2b172107cbcd
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:wy5112gYy5azzVvL69nLKnhZeEiln
TLSH
T11A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d6909ce6b35823e89ab87c5f3c7c0611baacbc7a9d6d9542aca68f9ef4a7236a
MD5 bd250e0d6c07531d8901c1a83f3d30fd
SHA1 bcc5bed2026be0a4371f500034367a2b9d4cbc4a
SHA512 adfcb17f9d2df35a25d1bde916922d14fe89771d4b41d7556a8f9e2a5ed2d1ab02b0710a49ba1196ecd7cc076568f24aafd3798d1311a8abcc43a2a04c7f60e7
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glBEilpQJSPYG:vu6JmVxd2dBEiln
TLSH
T1A8D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 45979598614d025b1392fe225fbc4753f59a24b47dbd8b6ba01ca7e49ca5314a
MD5 e2cf99272aea1ee20eab696a6b022c4c
SHA1 26bf05ec0064d1daf690e76c2c9778854fabb200
SHA512 a0cb0355a4128f58e3397dfa1e121002c93c55ec95c45c98b17195fdaeb16894572d2afab98a7afc596cedb08c60a2fa2dd8ff49205a191fea324a4b2c92cfc5
SSDEEP 49152:z1hpsNoJpF1A6UU44CwH7R4xNEilpQJSPYG:zmifPbR8Eiln
TLSH
T153B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B6961F7BBE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 52e0fe515e7965f4c6cadd83d18c37b9d25f342b499adfa734f96da829cd96db
MD5 21baf9c7dd000c0b782d932b0b8dfc36
SHA1 d720205251c1fa056235b2f972facd4459ea05a0
SHA512 a3d7723b26139226dc70b9331965dab5a0dd14a988d6648db2c6a885dd4d436fb25b85a3e924f24956dbd3b1b87de8b31390026941b23b2044e5a6bb9b2e0047
SSDEEP 49152:8SuZQIY0Be2KRRVtOnks6NMHq6EilpQJSPYG:+5dKTi616Eiln
TLSH
T1F9C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ed3791dea521275d6219382b22194a90409ac0c3108da29a3f5b6d1947d35acf
MD5 869b9a62434b65fb8bf060c45002bc76
SHA1 b3e26942c9b866f3edc76deab3073bce791364f6
SHA512 728e20029b737373bb8e7b5e9cf51b2583a9af80c97c6cf8dac23ee3edcbfe95cba83d909d910af58f844043ea23c1060010897bec5b181cc2f226ec29871eff
SSDEEP 49152:ohtSn8EApI0figngiDn0AP5wpEilpQJSPYG:5X2iyphQEiln
TLSH
T1DF95BE13F2D900E8D05ED178C7468632E962BC150B39BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 85e569e6c0f9f1c3a0f545324960aa5d822c96879806010406475916d0d55750
MD5 17cebd44dcbb18800d81313edfab8843
SHA1 c67f6478b6743a9a8ff4a156850c64e56e4099ba
SHA512 ffb18770586d52276294d59c154cb46812004371cfcf554175c164123f38385ee69926b4f81728a015ec2c382b958d7d53417b1355d984152443f6d123bad934
SSDEEP 12288:Mc8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:Mc8qZ5xpHEilpQJSPYT8L
TLSH
T1FA45234C6964C1DAF74BA7F0D3C2E1DDE8AC5E1C54D8960FB5A438075A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dc1f69cf8ff0ef36aa141be9903de87aae8b6bf3cf0a6dc9026af05726b478c0
MD5 717f51c5ef3857d6bbdf6e0ea6999f64
SHA1 2720ad0e57b3b5b952951e94d461343f46764bd7
SHA512 66bc0f3f1f1eaed7a2367b31ec1edda01a77217271849b9b77aeeabcd1aa7a44b15df645886e2d6af43af109842b8cbc249acdcb744493a5189d6c8e05498c8e
SSDEEP 12288:vl8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:vl8qZ5xpHEilpQJSPYT8L
TLSH
T1CB45234C6964C1DAF74BA7F0D3C2E1DDE8B85E1C54D8864FB5A438075A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bae9e96879f6ea323422ab0bab868f16df14eca917bd9bd8df62185d6838c904
MD5 e9df579cafeb4713c0aa8a99c2ce91f8
SHA1 53c3695b843c17827cfb3a14385d9f87aae74cc6
SHA512 720d5a4874b32b33bb92083be7704488467eadfb081f4d07af50239925e7353cc5fd96dc007f5df78588f5f3ecbf523acfa9cbd741a7bf59bfa0e00f0dae9001
SSDEEP 12288:XP8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:XP8qZ5xpHEilpQJSPYT8L
TLSH
T12845234C6964C1CAF74B67F0D382E1DDE8B85E1C54D89A4FB5A438075A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d71ae733d97b884e253617ba9dd56850bfe58f1e3b0c4477ab164455dd310f54
MD5 679cf0bd3f63bfe8978767381ee500e2
SHA1 053adc23f8643f56619edf5172e454c577080609
SHA512 e1e2a8613d6f703a32e79dd1c4ccd7cecd3bec52e4a61edb8eecc024376cf475ce050e016cecea4cdb4b857be25e028fad8c7446a8a9c09e8b822082e3318aa3
SSDEEP 12288:fVe8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:U8qZ5xpHEilpQJSPYT8L
TLSH
T11F4523082B6880C5F657E3B4C782E19DE5B8BD1895F5978FB5602C0B0E3A7B85C7CD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0787521778fe8ac25533c10f419b973b02e9ba0f3f1f52149802e21108091bbb
MD5 7e58a04214496d26fdd27a963572a9f3
SHA1 5404480e70914b92acaf78956336a669653800a0
SHA512 c3c0392191f0baf0f3e865d0e3de8ba144480f36ce4a70e8c08ebe115a3b09f71f98c7a2575194f78ac36f33baf408a87c35bcc2645239ce488d2de9fe9c15c1
SSDEEP 12288:S28kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:S28qZ5xpHEilpQJSPYT8L
TLSH
T13045234C6964C1CAF74B67F0D3C2E2DDE8B85E1C54D8964FB5E438075A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e10dc4af5a5097241586eb2d1ff60914dd28a772cea8dd3eb7244d736f099eff
MD5 2727a13abb13555fe2e86ba243cf1bfb
SHA1 60e919d4a99ba60fae225d7a8b6e35e8901c07c5
SHA512 7c5e20a6e7cc2c2bc0d51ae1d3e3e0f48a0a10c32ad3bc1f672eb273ad69878732a5df4cb3ee96cbf41b041ef9cc42666a77c56f7d0373ac0af880f70b17b308
SSDEEP 12288:aR8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:aR8qZ5xpHEilpQJSPYT8L
TLSH
T1E045234C6964C1DAF74BA7F0D3C2E1DDE8A85E1C54D8970FB5A438075A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bc9f36df1422f4801915812184070674289a6b03104ac0ddb7bda86913f6a29f
MD5 9cafd98ad66cb652b0596e6732311ee3
SHA1 fadf84fd23cfd241811fa7371151f57d104aada6
SHA512 65e66c0a573a4895ad7488bd55b818d55277b40703c2e081e8670435c8c1cfae991fa1b368ea143dbd313efb25ffb69f5022c03c10baa19c39af4f5f30c02cee
SSDEEP 12288:D98kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:D98qZ5xpHEilpQJSPYT8L
TLSH
T1D945234C6A64C1DAF74BA7F0D381E1DDE8B85E1C54D8870FB5A478075A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b1dec3efeefeba303092f41a0415e1cb8dba7f8c5f49bf3540c7bdf32b6fd50b
MD5 f5a6183f85aa298c44bd56e897445d6c
SHA1 8da253fd4fb3d2821b3fe42763169240f1a75b73
SHA512 c8340385ea652dd37da2de919941e683e1e3a6a52d4921919f618a3a3166235bf3d1612b1a84f076977472b18971434d35d8b8ab805d2833554aea5698b685ca
SSDEEP 12288:IiZwbQzzFEoS2cPvyF8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:LZM4zFVSOF8qZ5xpHEilpQJSPYT8L
TLSH
T1D7650198B39048F8ED67827EC955994AD6B27C190AA0C60F13F436275F373A11C3DFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5cf1e0e029ae02c42b0737c9bef885065c6f97502d0cc6c5cc083b482f54e10f
MD5 13a70095730d753753316f39250ff230
SHA1 2a11033015a48915f20b134bd95ea24d2371732a
SHA512 ee1c8857b94e8e6ee65497cdf5bce3993b20e1211c690453bbb43cfab6fcba43ed9837a6aa83eea32a72b5c6c7c539620bc9bb768bfadcfa66915aff1bf1a33d
SSDEEP 12288:cw8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:cw8qZ5xpHEilpQJSPYT8L
TLSH
T13945234C6964C1C9F74B67F0D3C2E2DDA8BC9E1C54D8974FB5A438075A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 506acc2a8c13c2e9a62dd329faf3291764cce228457b6f8444f790fbf39ae14e
MD5 b37dede6dfb43c80e0a38e41af0dccb9
SHA1 1c645ed6615459541c4607540b0ef8166bd4e6fe
SHA512 62f7e63f3c862f495c5ecb79360103a1d93c2fc14ce2ccb42562cd3db18f15c5114d66cd1aff27546f533dbd34d35c3cfc937408711a66190c0899de2382cc90
SSDEEP 12288:ek8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:ek8qZ5xpHEilpQJSPYT8L
TLSH
T15B45234C6964C1DAF74B67F083C2E1DDA8BC9E1C54D8974FB5A438075A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 97d2de4463df8dcbf4822773304a82b1b9cdc76bb6b2425048cab59c873e61d7
MD5 4264d7a4c50c04a9437a9ea8e8ad4181
SHA1 03ce3f7868d69083c8f6b197ed528d50f4289099
SHA512 e0f8bdc1e5a98cbd932f0f900da37c2ee669af41d91ce9bcb29b12759a74e427f9272f854aab942e953d6112117a4957579c3e9cbfb9a34e809a31da416316b8
SSDEEP 12288:VyPz5L8Z8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:8zyZ8qZ5xpHEilpQJSPYT8L
TLSH
T1E655120B73A020F9E2679274CA925646F775BC3507608B9F63A016372F376A09D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0b7e3e2e4ba5404bcf70b17ec2c2abf2078445a318a6e3d02284670655732206
MD5 f9da2ecf6dcfe2eb36a42a4fea3c691f
SHA1 964172e044a87fcd48dfa722de2f828e2f6ed0e0
SHA512 70f048ae1dfa59c0103617a7730c09d6dcc08ab076cc284a1d9312746ca98cb447a517a7c2c1c10433223b584e580cff5d6ac2eae995214a3c8eac57a9cb8b5d
SSDEEP 12288:Jw8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:Jw8qZ5xpHEilpQJSPYT8L
TLSH
T16F45234C6964C1C9F74B67F0D382E2DDE8AC5E1C54D89B4FF5A438075A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 24b4c585a24150f0169f047eeb60cb03716556db58bc4eee3d4d8be7cd0d8ef6
MD5 076b5a9a745e462cd631f9dcba4e0141
SHA1 99ef65ae7d7b4eaae44f47ebf7e2e4cff9a9001d
SHA512 a34814518158c072009e8d7d5d4331a3b527f505459a5c2cc24f0007332d8667dd4d788a0444e7ac00b5274f69e8f706dae26646fd0bd6e55932052569b0334e
SSDEEP 12288:rw8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:rw8qZ5xpHEilpQJSPYT8L
TLSH
T1B045234C6964C1C9F74B67F0D382E2DDA8BC5E1C54D89B4FF5A438075A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8de3e10532fb715d2b6d0c3acff903d859980ed8afe6cf48b2d54ef2bf2f2dbf
MD5 066445128467bf79e551f8d86f96c955
SHA1 152939088011ed5e66826b4b95f3c39781164fb2
SHA512 822920e76b1222a49282ca9954a325e6350cad4d5241d07b79ac661850bb4accfd17535030e835e64fc647e9c512d917ab17def50890d94cdcf1960a710ad516
SSDEEP 12288:myPz5L8Z8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:bzyZ8qZ5xpHEilpQJSPYT8L
TLSH
T12B55120B73A020F9E2679274CA925646F775BC3507608B9F63A016372F376A09D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b5084260e379c826403ed0d2ed855eb17dab78d5389ee07dc52466eaa76380b1
MD5 6a305a4e4e638b5c33fdf165fa01069c
SHA1 2f1a03074392ee50da343183410ed1c40ba1c0ac
SHA512 205003e2250ded244f76ef306a5f787787a45fb31f711d4bddfb9b257989f5c0a9288b1fd9cc788fd2e5ec34de3e647bc977fe70914d6dc2418cf4f1c6e30ee7
SSDEEP 12288:nCd9wWYoaLHF3z0z04PDvh/8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:CTpaLl3z0zD/8qZ5xpHEilpQJSPYT8L
TLSH
T1C0650198B35058F8ED67827EC955994AD6B27C1A07B0C60F13F4362B5F373A01C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 aef465412b0b1a3d8dbb6944b50f40169472931d1b615eae9b832875e5872875
MD5 73d80e8161b61388fd026c6061f3bb72
SHA1 a2bb5c43185fa020d851d57e1cf758409914a19c
SHA512 2e1739b148eb50fd76df153bb8cc2b657454666eb0d7e7533ebad5cb2c133906cd4fe369bb8b46b97ea4cc93371a994784271b1735a9f2dec0e783d1350b01b4
SSDEEP 24576:+31d9CHKy7GZb8qZ5xpHEilpQJSPYT8L:A1d9CHKyabEilpQJSPYG
TLSH
T1F475CF90F3E410E8F1B79A35C9669512DAB67C591B71CE8F13A4251A1F33BE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 efa1a0b3b93943370aacb157772fff22a5a610939a6a73046e49a3a75a564da0
MD5 8022e5e9666cbe207e1a54a62315ed09
SHA1 9982cfaa0ab3daad282608f15fd47910f7be1b1a
SHA512 289a2594fd193faf236550948d3d6f4c24c7f3e0cd0e69af29ff7e59ed96c1c79fd61f76a77899d156352793a18c476dd6fbd331fb8fe85f18fbf483b37fdee9
SSDEEP 12288:6v8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:6v8qZ5xpHEilpQJSPYT8L
TLSH
T15C45234C6964C1CAF74B67F0D3C2E2DDE8B85E1D54D8960FB5A438075A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e01cf26397567a57fa55044610ad64b08c6cc1c1d12973b48e89f758d6f8e247
MD5 85633b2a615d5f3138dcd2ab2a801f08
SHA1 645592400200518c9d93cc64cc8eab9cfb184f5f
SHA512 47a9e99fc84451f02b9ad815bc65f062821580b68f90c34e06c3e08f710e10a24b516a24bddd7d2199aab3bbef4ebbb5174a29cfa8891b770c5dfcf79b548372
SSDEEP 12288:w58kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:w58qZ5xpHEilpQJSPYT8L
TLSH
T17C45234C6964C1DAF74B67F093C2E2DDA8A85E1C54D8874FB5E038075A3EA785C5C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 121b49c268fde15dcb6fcc51f53cd82225f2209775c0a5dc8813322a68b3de03
MD5 5ad1358febf3dfb1ac1c99f76e8125ce
SHA1 5aa30263869566160c839811d58d180723f802a4
SHA512 4e03e745455e2c92fd23cc96bf2ba3b873035ac1b2d5823fc4a62f504c857257b92ea8e8cb7e1c50f12954b4de8b013c02f580e11400f6744ea10cce9909bcd2
SSDEEP 24576:zfwvak9RX6wkyAI08qZ5xpHEilpQJSPYT8L:HMnYI+EilpQJSPYG
TLSH
T1A885D02DEBDC44E5E1B7923C89A3460AF6B178281B71C6CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 efebf5c0057f189ea2e0529dcaf6fd3323e723d40c7ec204fa16b908eb751eaa
MD5 ab692f465d79d148a5a4443a86df16b8
SHA1 71e2edd99182840baf4d7ccd5a26a03938888fea
SHA512 a1e02d0ac0d22e7f88541fd518f1356754d4bb293191a431b12218530b7bd06fa43bfabe5c968027789c1aedcbf942e6e8fc265279f5d425361db2147113fea4
SSDEEP 49152:+YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JEilpQJSPYG:wySzPhEiln
TLSH
T1D9066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4fe241f381ab41c1313967188fdb2554704a5e54623399593a7e8984bf3e7639
MD5 1fc81f52baeda63c460cda1919a288bd
SHA1 9eb2bd49c797af3c4a6241634e5225765887d966
SHA512 3cf0e31e3ea863ddc1ff7c6245dfeaf333db9a4ba6550f61b83c3cc9d0726243f9a76612b5ec2c0982f0b7d8f9b4d544620b2b68d9a5f33bba9b794d12d56247
SSDEEP 24576:N47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYV8qZ5xpHEilpQJSPYT8L:N47JUQj1irIhCnDHUPfF/5EilpQJSPYG
TLSH
T1CD65AE1DA3EC01E5E1BA927885158A5AEA71782D1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6673a9cf1f7e692b090e1f81c85113b4f73971fef5ae9dd21ebca991d6a0d563
MD5 965104c23e1cb39686a302706feaf79b
SHA1 cfa6300c40af64f74e854b1c43e7775c60f07af5
SHA512 4d7046d41a777ec5bdee94621bd5110940055845ff46904507387d9d081fe4ba4c84652ed09ffa5d8cbbe5df298c672280fdf6ca31d7fdaba65aa059843a14d3
SSDEEP 12288:4nsfg8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:Dg8qZ5xpHEilpQJSPYT8L
TLSH
T19E55F109D29842E8E16E6275C7829645F3377C2583E1D3CB62D0F83F1F3A6A45DE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6fdd120c88e0b60dc36c5e4673101e84ca68c37e4323853e2203d225cf180843
MD5 bbfd650e2ecd5afa9cfaf76511a3519f
SHA1 6dfb24eea4b155b8fd67f3885ca90bcb2bb01473
SHA512 c3da7e706f60246d40a3798484c45ca1a09e10a19a696e1ce05eb0aecf37e7f2efb9167372bbe0a4f3a2a49abe0802d7f1aeb4a28b772f4fe91a0a660f9055dd
SSDEEP 12288:nwBJDU3frhaggq7oJ3ao1+WZAmEaPXC7v9ZDlYAn69hhh:nwzDUP0H3ZrWmEaPXSv9ZD+An69hh
TLSH
T109451840766AC75FC69940321E32D2CCAB707D41EE446E0773C99B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 48a4ada30581b1305465984689f32550f0ceb2b3dbadfc50e33189a7c14ce5aa
MD5 bc7b206d3d68be8ce05f6604bdea849c
SHA1 7b121d0f67100f6226b13596db1bb51334423488
SHA512 352c4c01d0dcf64ced49c6f3dac68c08f2857abdaa10f6b59326b23f4c998476be94a3c5ea2e613767a97ba532349403b6166f77c52d68bd524725197135e77a
SSDEEP 6144:rrj9LhDulLH/h8iDDZ3PptMxcBglepPptMxUH+3GWKIT9IxniSk:Jel8iDDZUT6ir
TLSH
T1A365F9415537E3CFD1F66032072A5B4CAB64EC0677496F22B388497AD82AB25B4F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 753KB
SHA256 13fc4bbe1f728f74516b3d9b98b689e64a158131c4163297acbd5bffd14a031b
MD5 908842ed1486fa0cd42b3ee1361ead90
SHA1 e095f3e4926e44ec84658031b9e4df6a04c43efe
SHA512 a4eaae6cdc2d935498e1928e8e0e4c003d74154304ece2e5a78875090ca8d50832d92e15b52a8bebe7640bfd1410ab605b34774a847a461843807984daef89c0
SSDEEP 12288:/MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75n9Ior:/nsJ39LyjbJkQFMhmC+6Gh97
TLSH
T19AF47D32F2D19437D1721A3D9C5BA3A5982ABE512E38794E3BF81E4C5F3D68138252D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Size 1.4MB
SHA256 8ff0af33f72d0dfa3b4ce10bed5cc95c548dac6624b758bf445b30706139d741
MD5 d868bda87812c370e1a6054f378461a1
SHA1 0203cb4941baff2ec8d6bfcac08e4eee9b76e77e
SHA512 4ad9909e0b5f543f5629fa5d2c1ca18085e19534860926276f936f85aed3b5e9b9bbc1396c6c21d14b75b733711f533f196b6af0ced178f501a76d1a227d9e1a
SSDEEP 12288:mnP+t1b8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:m898qZ5xpHEilpQJSPYT8L
TLSH
T1E565E0646343CC99D2478830CA58E2F144265C28A5A56AEF37A53F1F7B3E9828F11D7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fb38d48dcfed6559b4679ddf6f6e1bad302869963f9a6b2d96d799e2707b4259
MD5 9ead7e475bdd510d577b2ba95b79fbdf
SHA1 3a99546e2617b418c216b07030376c4e8db2bfe3
SHA512 5291c716b4c984bd7e7c2d0adf42edbf7b3c4f34a46678b24bf84dfa3616af8b78343204048c6b4abf845e82f82dc74732ab28c09159bce87df6a7e007f50627
SSDEEP 12288:VH7Q8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:1Q8qZ5xpHEilpQJSPYT8L
TLSH
T1334523089758C189F76B67B08386E16DB56DBE284BD4C6CFF450380B593EAE84CBC813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 32af3ae3e9f194d64707cda141dc0333f80a3c7cdb6175a06b9689f1e7412349
MD5 a860fc5a89dfc63efe88281d41bcef12
SHA1 1c96aef4d05df5a97c2912ff5bd505ce2a5ee3fa
SHA512 659601fc94f34cac85a7a6246eb27e4012f77cf1df17ff771e0eeb2792f902c6a37b17c0d9609414198089b43dcf0f77e943fff26acfabfac90ba9e8f57e89a0
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYa8qZ5xpHEilpQJSPYT8L:xgb4mBIBhGFfEilpQJSPYG
TLSH
T1B165AE1E22EC02F5E1FAE2B8DDA64417D6B278160731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 79a41b7180efce8150022540c868ec3ba863ed326f692d60fbf28843e93d59d4
MD5 11da5b1375eb500c8055d575300163ba
SHA1 3659be1b28ecbedb36c8bf147d1ca52fe57b7ccd
SHA512 358edbbe3c19f0083affd7fbed143cfe273a3d49fd8eb285d6859c52cafa1319410df962a0cb56693c7f7787e5614b7ceddfe991b213a707ef5e9ce9b2e0ce0a
SSDEEP 24576:+G88u8FpJqH1Nzria7/mF8qZ5xpHEilpQJSPYT8L:V7ZFPqV0a7/gEilpQJSPYG
TLSH
T10285F26577E001F0E477D1388A824667F6B1B8250364EFDF06A88A561F23BE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 0e8da56ca0eec4bcc4e02e3aaf9056b0b8e062532fbc31bd71bfa82d204bcd52
MD5 f18cbb19a3fd15ff41109a96e00408ef
SHA1 27fc9a11c6dd1b21764e90d6f278629f19d06aa4
SHA512 13d163018643e202473b1c6d526448c906cd19b8aa6932e0bf7f3fc60c9f38bbb81801dab98d90e2e106c485da906c6dfddc7193bc93fb90763c1ffa4f9c1b84
SSDEEP 12288:YHvUrBFrEjwaQR8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:YPUr+NQR8qZ5xpHEilpQJSPYT8L
TLSH
T16865E11E26A818E5F676A17D8682861DF771B8660751D2CF02E0813F4F27EE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ab2e721cc3a5aadb9ed7b54c3406b6f68def9f2dc68a420cd82526ac75371a49
MD5 c714a5f0f9585ba679ec1a0990a135fd
SHA1 0e3f95be0d589557a830172c85d87f29d1edab4a
SHA512 557267671de2042f55720dcd09228ea1c12fecfd2ebe87444bef22a81a10d400f986167870048337546d60506968dd03e00c8a49a17bb5f77696f7d93d2ba978
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7EilpQJSPYG:2G05lO43bmEiln
TLSH
T1B6D5CF6E62EC11F9D1BBD17CDAC6460BEBB23815032456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 65223534af0218bac0e44fa4181a1cbc2ce0167b54fbfb3d9464ac24a713fa88
MD5 519c724627126ad33432c55e30ace8b5
SHA1 7306267aa12ef7ee7afcd2c4314aa06d42507c48
SHA512 ba781af7c7462e2b6f11d3b5925a104c66760d03af6e652daded02b77c3e5e580d8c83d65027edc1dea7efcdf34849d2f34e04429953ef6d4239e845c043831b
SSDEEP 24576:afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnT8qZ5xpHEilpQJSPYT8L:ya5POZ3+Jt2pasx2+mDEilpQJSPYG
TLSH
T19765AF5DA6F801D5E1B9D17CC683861AF5B1342553319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c3462b81e08c34689d2be4e3c9bb573ed6a515195f612c9ee18a1dc5854cab8a
MD5 91a6ad9abbf2a579fb410b2a790a6e84
SHA1 8d5e123ccd90b8c123a16c3c1aa69f4b51cfcaa5
SHA512 344743d260ca560b783d1812a5f903dbebacb171befcd43aa73750fa626ba44fabdb68edb63d42dae8c545e7b96d193f23594e21d0981f00f67fdae5ec6f5ef4
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7Fkt8qZ5xpHEilpQJSPYT8L:PNc/zEOVHFAEilpQJSPYG
TLSH
T125858C1623E901E4F5BBE1BE89679546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 94c340ef00655ca04a78f3328cbdc35bf64873641a4321d8e0e3497f29e1d886
MD5 007768a5f4ddb34be586d4e935f676f3
SHA1 f99003f2af635bf28fa003e5e5370594f87eb7fd
SHA512 8cde8671c78c1e0ca3338de2de40da0b4344a5d324c53b8f7d737c0a25ce13a9cdf81af52433e96fd64811cc4e07a59d7ac00f4e21f65675c14e817c6df25bfc
SSDEEP 24576:v8kNvNnaFeYhJNtmZBmH8qZ5xpHEilpQJSPYT8L:v8MwBtOmNEilpQJSPYG
TLSH
T1D855AF6EB6B845E4E1FEC6B4CE238516E6727861073293CB5290C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 eeab8361ce31664a6ddd5ca0b361fc7416745ae401def0cdfbf130375ad4ff18
MD5 484593b4f8546b90e7f5da73c1080e2d
SHA1 09c700f96edd7aeb9349013f9bfb2913b6fcb155
SHA512 fd8f45218c0e368fe1200854cd359b001b2c7e01e9205e3eae9e185d63447c607f9f913a963998cab53bf1a0e5436843afe07443d0921181ed4844cb895d2da3
SSDEEP 24576:1D3FHshBIYQgA88qZ5xpHEilpQJSPYT8L:1DVHeBIAAWEilpQJSPYG
TLSH
T17875E17DEA9C00E4E57BD2BCD6938606E67138AD036156CB12D481BA1F2BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-250-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/244-251-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/244-259-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/244-261-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/244-257-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/828-129-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/828-126-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/828-120-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/828-420-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1104-134-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/1104-433-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1104-143-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/1104-133-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1396-291-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1568-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1568-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1568-17-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1568-25-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1568-203-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1964-90-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1964-102-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1964-89-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1964-100-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1964-96-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2408-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2408-249-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2408-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2408-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3296-11-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/3296-145-0x00000000038C0000-0x00000000038C1000-memory.dmp

Download

memory/3296-10-0x00000000038C0000-0x00000000038C1000-memory.dmp

Download

memory/3296-0-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/3296-220-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/3296-7-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/4376-224-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4376-231-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4376-440-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4376-438-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4376-437-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4376-225-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5036-244-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5036-238-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5036-441-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5036-236-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5156-516-0x000001775A970000-0x000001775AFF0000-memory.dmp

Download

memory/5156-453-0x000001775A970000-0x000001775AFF0000-memory.dmp

Download

memory/5388-274-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5388-442-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5388-267-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5984-204-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5984-211-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5984-205-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5984-457-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5984-455-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5984-436-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6212-435-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/6212-146-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/6576-289-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/6880-105-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6880-111-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6880-104-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/6880-390-0x0000000140000000-0x000000014016E000-memory.dmp

Download