xred | 187979252bdf6e932753613b86202ce215132ccca8236215321c5c67b1de7875

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Size 2.7MB
Sample260803-deex4sxclf
SHA256 187979252bdf6e932753613b86202ce215132ccca8236215321c5c67b1de7875
MD5 1eb409f068e4d3393e323c00909679a1
SHA1 2009b35fd5ccf0d51e0808c3a18fc9a3e74b74f0
SHA512 67ffc2bb6f4d73cdaece2945164b2078b5f893a2b261c866fb653cb707f9ae2e624b9ee9e2433b66b1b42816b4c4342cd314240c3b9cdc08b7ea324af54ae36e
SSDEEP 49152:MnsHyjtk2MYC5GhOAnEilpQJSPYGlEilpQJSPYG:Mnsmtk2azAnEilnlEiln
TLSH
T147D5E032B2928476D1235A38CD5AE3B4482A7E142D34794F3BF43E4F6F3E6816D152A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery xred persistence spyware stealer

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Executes dropped EXE 13 IoCs

pid	Process
3384	elevation_service.exe
1424	elevation_service.exe
4120	maintenanceservice.exe
5580	OSE.EXE
960	._cache_2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
252	PerceptionSimulationService.exe
1888	perfhost.exe
5400	Synaptics.exe
5924	SensorDataService.exe
4976	ssh-agent.exe
3748	Synaptics.exe
1612	AgentService.exe
3712	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d758cb288f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1332	5400	WerFault.exe
2112	3748	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1d5e2c9f322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2571589f322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009eb7388f322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3c5b087f322dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f84bfc9f322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035895bc9f322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070de0889f322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
3384	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4624	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Token: SeTakeOwnershipPrivilege	3384	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1612	AgentService.exe
Token: 33	3712	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3712	SearchIndexer.exe
Token: SeDebugPrivilege	3384	elevation_service.exe
Token: SeDebugPrivilege	1424	elevation_service.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 960	4624	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe	93
PID 4624 wrote to memory of 5400	4624	2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe	96
PID 3712 wrote to memory of 4252	3712	SearchIndexer.exe	108
PID 3712 wrote to memory of 2804	3712	SearchIndexer.exe	109
PID 3712 wrote to memory of 1296	3712	SearchIndexer.exe	110
PID 3712 wrote to memory of 1316	3712	SearchIndexer.exe	111
PID 3712 wrote to memory of 4736	3712	SearchIndexer.exe	117
PID 3712 wrote to memory of 4772	3712	SearchIndexer.exe	118
PID 3712 wrote to memory of 3088	3712	SearchIndexer.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:960
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 520
    3⤵
    - Program crash
    PID:1332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4120

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5580

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1888

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5400 -ip 5400
1⤵
PID:4928

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4976

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 492
  2⤵
  - Program crash
  PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3748 -ip 3748
1⤵
PID:3896

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ef96a3ec99e2e558ae06acb405e2e152de1fd0d968c75dc27e842dc15e831f13
MD5 3ae4ff70fad0ff6ebe283a0365d1ba51
SHA1 21e118d66707895258c92b00fa9090af87fb16d2
SHA512 c366d473137d71d0ebea10b0cee136c2b3aed83cf3f4a2ae20b905a8d2919f8a38d94e779da3b978d455e046cf8eb3f783cb20f943c12ca3356b716a3f7e9467
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxngEilpQJSPYG:h3q6HjBrEiln
TLSH
T1EBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 802d0e9a099c8df10c8550985224ea082137f14294fe02ec8b8b932eeb88521b
MD5 e71b63b80fd2d21656edf70fc18aa2d8
SHA1 c0f9ac8d75e6ea17b27a1cacfb775e95f4ea3602
SHA512 0f47f6074b23ee52dc4ead68e79a3b9f70d84013930e3fc77a2370f8d061c8dcfdf86b09b914161614e226a541fa6a4941239903eaef1e2984a6a9598ec976fa
SSDEEP 12288:+1XLsswWkxy2lRq2czAl8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:MXYfDtczAl8qZ5xpHEilpQJSPYT8L
TLSH
T1BA65F12877E404F9ED678278C9A2C115EA73BC1547A0E78B03E499261F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 317bc13a7662dedbc62378eb49d1ac2e1ff575cf36e590b5febd0b9705d797e0
MD5 36c1d48326001a1a75d33bc25d865185
SHA1 cf50cf38c6ba2fa71399cf4f7bddf67d35f8cf80
SHA512 f6ecae979ee55c3364e81e71a33d2c4280cccc86a481ef1e984448a0db1af0f9425df21839a34b70199c7561e98c699314738ecd4ba680d1617724ac4fdf2d9e
SSDEEP 24576:w0Le5ji0hmxMrMD8qZ5xpHEilpQJSPYT8L:wPji0AyQEilpQJSPYG
TLSH
T16D85AE15F6748335D073C0B9C5D2A68EE97130861B308ACB5286D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 44292031b549a2e3fe4489e36c1433b36afb91248166a28680fc223f8b3dd3f7
MD5 5ed35aa184432f73733b1f2d762807ab
SHA1 827bf69a15e0ee4a69db2b06535c288133f66887
SHA512 5b32f335c82d02fd93b841b922ae07d5ff182f5e005ace5c895936a7a8db4594999166d29adb9685dd8a8817bc318863f7c0f6f9a5508b3f65740dedee4cd928
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuF8qZ5xpHEilpQJSPYT8L:R/ezSC6vUzPvxHjysEilpQJSPYG
TLSH
T1F4755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b2b6e6094093c47f0901cbeb88b8e3ead767b275cee74152cfd2853079b9f72b
MD5 bac9d41a67eeb9a3eba44422d1172826
SHA1 7f0201cb9fb5906992993328f757a8858cda089b
SHA512 d2d4dd545be303f625be31560dfe58c8e80537e8a0cc199f3dd9580edd792637379c5ccb3744fd5c756f1e3d862247b83c7c956aae54ec47f7ee0c99782b2f95
SSDEEP 24576:zVbqPb88hv/l+6g8qZ5xpHEilpQJSPYT8L:zVO88hXl+lEilpQJSPYG
TLSH
T1D2559E66F5748331D073C0BAC5D2AA9AEE3234414B31CACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f5a8bf440260363d2fa04087fc679a57cb1b3e8863a9117b6734fbd0aea53703
MD5 56dfde7a968f5cacd6be4bfa78b57a71
SHA1 40acc67c0829e30dfa5be97dde46330af7ce5c33
SHA512 0bf0981de48de3989683ce72754cc049331e03334402a9b003c0949180ee7e26aae40ddd380f0d5d8aadd804260c65e2e7bcdeebcf7bf6c1c12d13f915b137cf
SSDEEP 12288:RuH8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:RuH8qZ5xpHEilpQJSPYT8L
TLSH
T1794523485A64C0D5F79B6BB0A3C5F1DEA8B89E1844D89B0FB4B07C0B493D678DC9C863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 eb816ad969b02b6e575d1b11b1a3fca9b6b773644cbbf0c6115bb74469ff0939
MD5 3e8f26669a741d69bf9ac2e35531c268
SHA1 ae6c31e7d0b5e746f7d9b8c0222809c4de45756d
SHA512 c2a9b32322aee41add3f45b8bbf4c5eb64ed97df9d3c79295e76637016d35d6fc42581f6dd30986ea5a5cab7855d40bcd3ae956b4334dda4d7b879f45f5a563f
SSDEEP 12288:IeBNUbTVO86UI8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:IJIUI8qZ5xpHEilpQJSPYT8L
TLSH
T1FA65CF3BAE28FCD2D27A9DB85791C240E77278304B6193CBE174820EDE235E45E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 81f00c5df74955472bd7d448d667aee7124fe2783454b69f707bf65bef2478f4
MD5 114012901dbac9bc2a0c621c7154fd12
SHA1 9c23b78016bb31248cf8894dbe16e41e2e933c04
SHA512 4f89b87ebe2930f98882272bced2b55c7f67a43f2fc133ad0ebbb93273f77b3ab03f151dab4aa8c887a14a7183e86e51a1631699744900cd733ede3507fc67d6
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:GQvGAdlCEL8c/yRNw5C/Eiln
TLSH
T11B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 71770ea186ba49c14187cf1f6c50467c2446e6e86192219231cc1c977887c2da
MD5 33735b0e81a2911801fddd5d31e63be6
SHA1 abf27e0f7827198796e88b94c84fd87d54831ec8
SHA512 118418b90c774d73498919a8c8d1ef2a7ab67ba4817cbc7eb93c39e562cebed48ad913657b1d9205eafe472aa5a08df5b1c5470d8483364de37d3a44d4d50a72
SSDEEP 12288:hAwSfxL/2Dc3uDLLmt0LDQewsAjS8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFEa:CnewsAjS8qZ5xpHEilpQJSPYT8L
TLSH
T16175E030FE74E036D3BB0DB21B26D71A547CAA204B911AC3F3E85D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9b442b678c87b7d8eb4722e8b295327e56a125f65ffedbebc5d12986fae9f9be
MD5 dd74bc70bb3651b76a2045053f541462
SHA1 67d7a8c52c54a740f6541a4301c439de2ebcc63c
SHA512 72c3544b77c2d7ac811604a5e1a37f5006330bee509d658ca01b89534848baaec56319725bff3642c8c10acfe062f0ab2fa0f70d91bf5a4a55e381e527ba0266
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH7iln:BUEtQevvqc2W1cpV2EI327
TLSH
T15F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 850f1c5a95709c0f1e489fde94777d90f2f497aeed2c4a10f54611d92f626f53
MD5 1d4df4ab8e43962db1a3cd5b9db3e36a
SHA1 28019cd0e00b16b3f1b906713d1c54b2929c8fcb
SHA512 b7761cdced7233d6d3eff1a4b081eacecbc56f4e5bc412f2e6e56ee3e09cfa72cba583c69a6ca446b2cd13dd548cbacacf8763f57bf9c1596793c2dc6edd3750
SSDEEP 49152:SCbRquA/m2yL5zLfFiV+XenmE3/zAEilpQJSPYG:3oq2VjnmbEiln
TLSH
T180D58D0976B8C1E4D1F6C77886A2C647F37178154B30ABEF5265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 731a8604578f76009b2a7495ae3e178a5f750aad2c035d728c0f18a2fcdda773
MD5 0e007d103209985af386151ef29f4ba5
SHA1 c1553aecd25c51b2b007460b47f4ae08c3feedee
SHA512 9e17d838efe982d84b865ea4fda5e27beb740c1decf12de17d1465d64752f12342b6ee91e52342b0f5e14390658d7f45e25f5f81f36cbbfb5f71e0e79c43cb77
SSDEEP 24576:IAhGLJIFoiwtA5l7S53B8qZ5xpHEilpQJSPYT8L:IAMyFoiq5rEilpQJSPYG
TLSH
T121359D80E7F951D4F5B3AAB899B69171EA76BCA95E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 235d5e1e231dc899346f98bb6097ed49140e41d89ba11969b0d82ad008fa81fb
MD5 78cd690b9e653cc76f26dd7afe015c27
SHA1 c29d9a2b8a68c6ac2338764c0cca1882022232d0
SHA512 73ee995580bcfc446255bfb7b6e465d772c4188ec4aed6ee9cb4924060fb006f2db66a6f8d506e830fd9c0eb2ef1087076f15f9c117f68163efc9f1ff06f75a3
SSDEEP 12288:Kmw5HEjsChNHBFgl0WDm+Ck8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:DwueOW38qZ5xpHEilpQJSPYT8L
TLSH
T12265F14976A408F9FA6792388687D136F7F2BC012A65DB1F1760C61B5F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 070fb651fd73fd4797551e3bc61462fb62900160bc12a9044c9f72869edffa06
MD5 fd4a90b8ac5a72fe8c86035f1b53c867
SHA1 710af2900c1cbb938e332c93cc130fe4d3649d17
SHA512 c92c326c26cb2c06bd567402ea80a644a114e80f140b1cda85b5d0b3732d6e68b296ecbd368fe1b106fd533ef02ec25e844a3afbf99c6318d2d85520946456b7
SSDEEP 12288:8XZ1IyC8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:cZur8qZ5xpHEilpQJSPYT8L
TLSH
T14455124933A460F9F2A76278CAD19249E7B27C1613B583CF21A0552B1F37AE55D3C732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b9f1ba692be154ba02c0ff7cc4c7b4fa0672baafb8993b7b04f4d18cd47bcdc3
MD5 d4a4d9da2a28d314f46567eebeaf4ada
SHA1 17b1221c4a8fcdb9fbd2f1b066c3accf048eb78d
SHA512 47042fd5af052c80a7cafcf27d56a32c5273772001588685cbd8568d7c0ab8b97ac5f48fcbb5a01761889e9efaad84387862af7b0bb8583c7e049644ae23b74d
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UO:xQRQyi36YOcPQLvw2gAf+PN3uEiln
TLSH
T1C5667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 69a1d276182f554c27badab8385e9925e3d984f26be3702dbfdbe30bed3e4dc6
MD5 93936211b74e8fbb3f362e299fd67efb
SHA1 40dd62a89d424ab8899c10dcafdcd6e1f2b0ab49
SHA512 7ed9945143737c49fbc54e0aec7e5c66fb91efd3db03ded4b0efed69eb9c03497e4a84e224e3b8fcfdd3165d49b18d08bf8cdfc50d4d0f84560836cc6de52e95
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UO:5QRQyi36YOcPQLvw2gAf+PN3uEiln
TLSH
T14D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1dbc6cf438c305500227d6c6f6fba8192c236263fb3b7a6c6590111078bd5f17
MD5 c53b5023d41b0e932e7b5c8610b7ab66
SHA1 cdfad3f515510ea9fda22941813453135bee79a1
SHA512 2e9cfd1a1d0cd9a7bbfde49409486433139f25baac54ed2033b0b8629764e2a38b8cabbf32e019d10f531470b64cdffba0f398c5bbe7636aad8f0044ca975fec
SSDEEP 24576:UwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL078qZ5xpHEilpQJ:a68Qg55nhheWu7PNU3/QEilpQJSPYG
TLSH
T1D7B55933B2F200A9D44DE1769F4A973196D17C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 222589a3354acc39c5d4ab449f510151303a9bcd887f48dcc681681a08ac5e3e
MD5 caa833a41e12150abc282ec00413140b
SHA1 0ec7a0ac016307f41594879ff042a68257838feb
SHA512 8fd699f9e97c7444fcc340ac6df2fe28942d884779c5e0c0d7835b2c1a626bb9c7a614396239069bc01c3775e8b290e28313566ed6ac8735c38aa9897c9c8a56
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99k:Oy5112gYy5azzVvL69nLKnhZNEiln
TLSH
T1D0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 85f9f78c754dfaa91e06efae292e3f15ebd332ca09169dea4abde512085225d8
MD5 5a87549db13a96b97b5fc0a6cd63fab5
SHA1 19d8006b34d0c19da8d386f9bb93b6fd42369498
SHA512 dd3ef74ca8d8136edc607dfe273f3905027484894ab6ec0c2ce865982d54faf53f4b7684181ce9cd0703e3ef7f0e3e7b6bb401173112fcd124d005538b89eda4
SSDEEP 49152:MB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/EilpQJSPYG:Gu6JmVxd2d/Eiln
TLSH
T120D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d08780b54208f4ca72bed338f416cc3b00c967c72000e8b11c63e83ec3abdabd
MD5 e9abdb0ce27a185ac9bf1c245746710f
SHA1 3c3cfbea0dc79b639edb0df53565644fd55e11cb
SHA512 a56f06ac18753faa9d37be2aa647b3fe18c7252b1c25bb5d0643dd8a7377ea74f0aac99ff4979e398476e827b387ac73e6cb4b051bf6eca4d0e76bb786c71756
SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xSEilpQJSPYG:mmifPbRbEiln
TLSH
T15DB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B6961F7BBE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4e6d34ba30433010ac5850ca594d7bb767c76947af8f65ba2da20729b81494f6
MD5 62e12146b20209d23c6adf8c0ca7cc27
SHA1 e45b43511baf4f7a99fb2f0f0ed31c54f5cd4348
SHA512 ec08b63cfd13ce9cf26ecc91655f8e06910feeee1274820b0dcdedf505df460c43a60e20674ab83f63b192fc97f07e11c7ff16a94e039e4f4ffe986731602909
SSDEEP 49152:iSuZQIY0Be2KRRVtOnks6NMHqREilpQJSPYG:85dKTi61REiln
TLSH
T1CAC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d3df6d88a69e09f784b63fe62d7687b44610036650be024a9f640fd2faa318c6
MD5 01306468fa70bd70cac737dce2a6a2d3
SHA1 b788a424e1519cedcab77d5bba9dd6eb9eb901c8
SHA512 bd81b7b7a746088e338891b5697f0587ee37f2d57554bc583c31aebe56bd56a8d9a8ec9f70b96dd388721ac798eb7a846566fdf97e3eaba0cd030e792cdf08b2
SSDEEP 49152:UhtSn8EApI0figngiDn0AP5w2EilpQJSPYG:1X2iyphHEiln
TLSH
T16595BE13F2D900E8D05ED178C7468632E962BC150B39BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3203e8fa1d23198b696be1a973274717d81a81a3350d7108dcdd85d364c5662c
MD5 d90570625bbe98f6e297d507afbbe881
SHA1 b440d91287db8ebd85bac0509d151e4a89d72d4a
SHA512 a1e0341185706964a2d273f71136bbc962ba8813b7327180ab130aadeeed279d31c53cfdd86864915f127023f9556e4f347720211709ca90e81dfd07877d37d5
SSDEEP 12288:1v8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:1v8qZ5xpHEilpQJSPYT8L
TLSH
T1AD45234C6964C1DAF74BA7F0D3C2E1DDA8AC5E1C54D8860FB5A438175A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8d13466a1ffbaa2e169f7d09bfdbd6f7361fef0b5f4fd3e62170401cfb027f6e
MD5 f50f1204d4cf7fe01c1c1868ce7cf351
SHA1 9e6233a8a8d724123d59b937dd69de0f397b73b3
SHA512 c6612b4c8898d900080e4f9e6c60a3b1a41037bfc083faedd91ef8cd7ad0972bf56be995d9ea61173ffa23f184f256b4db3c0b2eccd59b4cbab93aef6996b215
SSDEEP 12288:8G8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:8G8qZ5xpHEilpQJSPYT8L
TLSH
T15B45234C6964C1DAF34BA7F0D382E1DDE8B85E1C54D8870FB5A478075A3EA781D9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 25f1a7501835a315036405f03f6bb6f0f01e77603adbde37d5345d709619c20e
MD5 133b25651f79a8578152b49737b218fc
SHA1 b5a97d63ce198b0b8af3e0a06d725e6ab7d5a1b6
SHA512 1850faff4ee7b8d07166d244650c1cfecf0410e78d765366abdee4689a05f99750353a4f354c7ed03155eb67caf16c546630de49ab48154a272b2110101768ba
SSDEEP 12288:Tw8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:Tw8qZ5xpHEilpQJSPYT8L
TLSH
T1A545234C6964C1CAF34B67F0D382E1DDE8B85E1C54D89B0FB5E438075A3EA785D9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2d32abfb0f459191e1b8997fe4d405aec7e4dd5ebae827293aaf456bff9b677e
MD5 b41420f3e6cc9b144ad4868827b98af2
SHA1 3d919466cfa51455fb66a4797594cb166f8c02fe
SHA512 b0cc5690021b28593597ef3388927359306279a73811a3d95a6a0b46a46de6752f52fbba47d9fe98095fbceca95659a6cc8e9163eb438772b1393e62c4877d5b
SSDEEP 12288:nVh8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:/8qZ5xpHEilpQJSPYT8L
TLSH
T14C4523082B6880C5F657E3B4C782E19DF5B8BD1895F5974FB5A0280B0E3A7B85C7CD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 718ef8dcfd7f55626f1017ca98499e146540060b0650e593e88b2ca22a695f09
MD5 00457d2816358cef43372e67fc08d6fd
SHA1 fe2b8bd4885568e7a8d869ecdc9b90ef6112749b
SHA512 8ae7274e8f6867f3b1a8bc99362f47000801975a2803740897f0bd2f5f2f86a9ca60c63679de3dbe10e6bc03f63a1cdd3a95692ec783f8f7832217138812c07c
SSDEEP 12288:GZ8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:GZ8qZ5xpHEilpQJSPYT8L
TLSH
T11E45234C6964C1CAF34B67F0D382E1DDE8B85E1C54D89B4FB5E438075A3EA781D9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4594f2a851e64ec8b3b65691561a05210babe1fe0594ca82ddcbab4d80fed51d
MD5 50c7bc1dd480fb20363bbd5d8c263047
SHA1 6ec4fe73200e2dbb16698476f720f7c03399e12d
SHA512 cc0cc7f49a2d9a36b60fa4ebe15b01db7c3f5126e3181d829435643759fce6b2c35fb10fd43cd84e1fca0d12eb921ef8105c2f2f461c0738cc116882793d7bb0
SSDEEP 12288:Fa8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:Fa8qZ5xpHEilpQJSPYT8L
TLSH
T1B945234C6964C1DAF34BA7F0D382E1DDE8B85E1C54D8870FB5A478075A3EA781D9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d5420750de59294e6b29aa6bf47daa99b22bdf1645524dfa76ead79630ff080f
MD5 0b7941540ab4ec7ac40382659a62b585
SHA1 1200a22aa524dcb05792a771a1afd956a9a2ce77
SHA512 cd79ff2f1bc4c47fbc5d132d6b7052c6414d78778f94b8ed6f9e1693d9fb0510ec4e5cd0fcaf0c388bbb54a9363ec628c5a11ad42214be3cd40f259a4a531294
SSDEEP 12288:qe8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:qe8qZ5xpHEilpQJSPYT8L
TLSH
T17445234CA964C1DAF34BA7F0D381E1DDA8BC5E1C54D8870FB5A478075A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 81b8ae24fd748c8371fb477242c9980099183c252f0f546aea840ed20a335ccb
MD5 8eb5f2977e0de7119f79e7e016442973
SHA1 08beb340ee25b61af30078aa0628b7d59d7a0321
SHA512 a62ffb61d81dcc720856b03d3f9d054c56f6a399fdff67ee56865e576e19e861c6db380ccb0ea617ab3fbe151ba7edb15aed95ccaac7979978f93a49f7563b53
SSDEEP 12288:aiZwbQzzFEoS2cPvym8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:9ZM4zFVSOm8qZ5xpHEilpQJSPYT8L
TLSH
T185650198B39048F8ED67827ECA55994AD6B27C1906A0C60F13F436275F373A11C3DFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 84d8f1f0dabf898b2db4b397a0ac75b16f4612e72ae4013c6cdd140cb5c64271
MD5 1c4e98e7fc4cf9756d319533576d639e
SHA1 a468f1c071702e8dc61984176ee05184e79b4901
SHA512 ad93761516614ad8401c72c31daa0f2be80146a68dea6655ac35f7b7433434fd3a15a60494d88ba572fd2048dad254c5699fc2a587921c175e12132bfa211fbd
SSDEEP 12288:6b8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:6b8qZ5xpHEilpQJSPYT8L
TLSH
T14745234C6964C1CAF34B67F0D382E1DDA8BC5E1C54D8974FB5A438075A3EA781D9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ea76729c0785b9ae59876b2c29a04432d2ae17a2029203887bdefc3ec35d99a4
MD5 b8f35b878b5757ac77961447aa6cc2c9
SHA1 c9b5f2cc75c57eeb8f47eeaffbc71dd02161e3b4
SHA512 a6ec7c2d8e5938363e8c9bd7d4bae750dcf99e45310ad3aaf1966e8080db6b05ccd18daea0220733d4b5df5bbfe98f6ad96dc9e3299ca851b69405d079a6aff6
SSDEEP 12288:Z38kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:Z38qZ5xpHEilpQJSPYT8L
TLSH
T12545234C6964C1CAF74B67F0D382E1DDA8BC9E1C54D8970FB5A438075A3EA781D9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d604708511b9d85f68cef5feb0d30e0629e6d2ee1ce207bd7a9342bafcb5b57f
MD5 afefb21d5f43e257b5e9ba20a4653d78
SHA1 a45028c88e742856c6dd817f639eaf720f12a099
SHA512 a7419de9ae15f569fa4ebf032e13e03fefe3469a3e39ffb1fa73f916108227de3b60c6ccf8743df9ad2a3e552217fdc3c00344ccba0ef39cfe88603009b35155
SSDEEP 12288:IyPz5L8C8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:JzyC8qZ5xpHEilpQJSPYT8L
TLSH
T19D55120B73A020F9E2679274CA925646F775BC3507608B9F63A016372F376A09D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d4f8ec8c830794027cd02615fa8b56df1d368f3fb57c0d05520725e32475f4d2
MD5 dfacf735f44ae27d8969e77ca599b366
SHA1 d87144ebc2c256488db014b789b63f551626f415
SHA512 5e04e533e04f10a581c0b2a7dc8afc798e8ecc81561613190394fb0dbbbcae5148aef01b4972a5caa40503bfdf258cd97fc7a505039b3e3e485d0d9c151f84fd
SSDEEP 12288:Sb8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:Sb8qZ5xpHEilpQJSPYT8L
TLSH
T1EB45234C6964C1CAF34B67F0D382E1DDE8BC5E1C54D89B4FB5A438075A3EA781D9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 822af510ebbd5eb886beeaf68c16285caf19be50862e10cf2593a080f18c44da
MD5 48de59cdbce0d055a7563f09acd6b90b
SHA1 0eac50e484409a5a7999cf02714c6bd8d70db485
SHA512 3709e9c9f98037a6aa8bb6e7dc9533d6a11be976e67cbe7312fe53a2d7c4301612c01f3cec1f1190ef4730ba29668ce106dc46bec82d8ad20b5bfbca1435d391
SSDEEP 12288:nb8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:nb8qZ5xpHEilpQJSPYT8L
TLSH
T18445234C6964C1C9F34B67F0D382E1DDE8BC9E1C54D89B4FB5A438075A3EA781D9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8665cc06a09db88ce65696196536c523ddaf0ce6230345773452774e275ed5d0
MD5 e28110b36e3db281403f83a9e553cfbb
SHA1 2627fde0d5d6482974879771a04f6f7c19524a39
SHA512 95bb8614625f53da98f83938af2880a06c5a5f42d8069b1729b37bdd396d0669a5b0fb7a1e0c89fe119ded278d54962b9a401430524a3bd44a84c1d0e4223235
SSDEEP 12288:4yPz5L8C8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:ZzyC8qZ5xpHEilpQJSPYT8L
TLSH
T11F55120B73A020F9E2679274CA925646F775BC3507608B9F63A016372F376A09D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c49de6238e7f2543478d8c5fe304992cb273a4ff4d7ad1d0669686023798e1c2
MD5 a6884c89ac88420e1e9ef0e6fbb7ee9d
SHA1 bc94b1fa4cc0f45b9713a76ed1eb8f7f0486a1fb
SHA512 bc5df299af5bc68308a6f23aee66a13312b18a90ff1dfdc8612e2a9e8de720da0fdacb75cd8951bd7df6b91cc87bc8ed43f08a0e13340d2d9b51224eb6d28b13
SSDEEP 12288:xCd9wWYoaLHF3z0z04PDvhA8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:MTpaLl3z0zDA8qZ5xpHEilpQJSPYT8L
TLSH
T166650198B35058F8ED67827EC955994AD6B27C1A07B0C60F13F4362B5F373A01C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 388cf9c3268c98c5223d8535c57bcc80a40b78674cdb652e329a2bd37f02ef3e
MD5 59f09f30cdbaa42bb59c7651b4bb30a6
SHA1 1fb162a5be72bb45d2400c4f441fd73a73736d41
SHA512 ba1a5c9f99532fbb617315ae30ec5b83faa31191a84dd8115f09cfb8af916b365302a6a4ea1640769c5402c842e3ab6d354b824cbe9b91d85c3fb8c1f25e82a8
SSDEEP 24576:A31d9CHKy7GZk8qZ5xpHEilpQJSPYT8L:K1d9CHKyaoEilpQJSPYG
TLSH
T11975CF90F3E410E8F1B79A35C9669512DAB67C591B71CE8F13A4251A1F33BE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 88cc357692e84a73a9f92d2115e4863f2b81eed480baaddb9f5539911a0b29a6
MD5 cc8ec8d851d906eaf296a0f3eedb601f
SHA1 ad3d11200d09dc057bf5cd785611a7ad588966f6
SHA512 f60df9d15d7916379ab96ba50cadeebd961b534ab6420268a156215621c550bebfac80be2f2addc6871fbac986398572217b3e407a8633bc4407db085f6456e7
SSDEEP 12288:zQ8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:zQ8qZ5xpHEilpQJSPYT8L
TLSH
T1A045234C6964C1CAF34B67F0D382E1DDE8B85E1C54D88B0FB5E438075A3EA781D9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 397c7462131b32aa534dee972d379cca0029f5d306c9d77f73025e418295183a
MD5 3f2471c82ef241564acb0acb6474ce53
SHA1 3fbe22e43d4cf835811121bd574aaedd98a645f6
SHA512 8efaf1862589857cd5f3b5f126929d1e9a81d4fef94fc318816ca1bff26b3835e6d6d48b33884b6aee861b28e16ccc56cbf954c8c02eab8a99f6a3106b18151d
SSDEEP 12288:ui8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:ui8qZ5xpHEilpQJSPYT8L
TLSH
T11845234C6964C1DAF74B67F093C2E1DDA8AC5E1C54D88B0FB5E038175A3EA785C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 dfe2d7acd26361080fdb376465237c4a3d49b95fd3e370e4f4944992f9802617
MD5 57fb9b36b65ec127921fb69c343c89c7
SHA1 11a3c0c971b42c341667fdac15b4dcae72111a30
SHA512 6d325498269f31cd6f9332a1a823e4e4f7f3e70e718e1d30cf1027e301a992e6435d29b8e8946942d61d433c208b60554ec85b7394964f307ef2385b35a5ed35
SSDEEP 12288:kd8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:kd8qZ5xpHEilpQJSPYT8L
TLSH
T14B45234C6964C1CAF74B67F0D382E2DDE8B85E1C54D8970FB5A438075A3EA781D9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 91b51a9c28424e0e904a99399663c317daa683d367cdbffa615cb651a1c7954b
MD5 6304e5b8c0e2c12fc40e607a335ca02b
SHA1 c9fefdd6c1139543aebd407e83824433014a4684
SHA512 ff1d39ae43b7c94b22cf44c819212480b6649d0ad5e3381ede6eeb5c4b60073171dd2f017d394590b9cf2d578f2ff0622a85ca187a03284de41d832ca6054f1c
SSDEEP 24576:Ffwvak9RX6wkyAIn8qZ5xpHEilpQJSPYT8L:ZMnYItEilpQJSPYG
TLSH
T13685D02DEBDC44E5E1B7923C89A3460AF6B178281B71C6CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 578e431e2bceb0d9bd7111190923a99dacf12c58f818f6e9c6e3e970045abfde
MD5 985d57ed2421b02dfc65f3baf1bbeed0
SHA1 5254a7a4e56f15c431081fce293745555e630e09
SHA512 5cbe8f42c3024afe2003ce26e13a1c24afb6c3b42a462dcac63535c797363f9424633ffb36e2829e3543d95206f503c6f46780f138932ed254a42dffc6ee24a2
SSDEEP 49152:VYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WEilpQJSPYG:VySzPOEiln
TLSH
T167066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9821f88f0895ceb3d7a798cabb44da0249a66249994d2ec2b7e1244de430d64b
MD5 7b5acb9ab2c60d0f6bbc454b186e5936
SHA1 a30bc93128e258001ca7f717b1c352d8afa733aa
SHA512 2f8c5db5b72c7cdbdca5d2719e64793f495aacc507db398cb150281c108cf4a2ba4d70719fcc2aad2839e0af26f0f6fe5b3d3f3b0bc52fdf46c13118cc293cff
SSDEEP 24576:d47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYW8qZ5xpHEilpQJSPYT8L:d47JUQj1irIhCnDHUPfF/mEilpQJSPYG
TLSH
T16565AE1DA3EC01E5E1BA927885158A5AEA71782D1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 98c222e795fc37d91b52c74faf086448314b5d05edb32281dd07f5b8f731b4f8
MD5 8b7141d3cfa300455d2207a8199753a1
SHA1 2ab7d811d178dff3228eed2b94a395770122f3d1
SHA512 b36071f3c3a182afbc8797456b9c38f57c925683deea417d2cbfcdb8def91d306b6ab9782f63046b0b0865fd90487cbcfbe7bcc3ee4ec02687f6227ca1e1df2f
SSDEEP 12288:hnsfr8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:cr8qZ5xpHEilpQJSPYT8L
TLSH
T1CB55F109D29842E8E16E6275C7829645F3777C2483E1D3CB62D0F83F1F3A6A45DE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 664f3bdfd5bbfb9d723cb15e1ddd639ef17886a9e52fcb3f332d4578572b3f9a
MD5 a73e3ecdde8f3df328a1877a0948f27f
SHA1 40911a7f79c22a427c735ad0d12c1d9421f62385
SHA512 9a1ec62c93e7c73375fe0daa75de001c71088f87037faba0244f2f01a75f3f989e6fb94bbcba532decd648acc84f757efff3c31b56c5dfca5ec56240268a7b6c
SSDEEP 12288:HDl0LU3fpr/EVULZL9izJ62SyuyFgXW2Ix/XeNIwl:jl+UPR7LCuyete/XCIwl
TLSH
T16E3529007666C74FC66D40325E32D2CCABB07D51EE456F0373C89B3F9476A59BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 48e450080ad50c9e1c86b738d3282db91db41dfd9883ac61da4d811167c293b8
MD5 a0680ca0773be757a7172e4aa9c56f7f
SHA1 bc687198c4541d3f45fdc26a42047fb4d8166782
SHA512 f08fd093cc562321c4c85a19936ea74682e9c87a4c501140d38d83cb9a1fd90ba73ce17fc55d3580e85087ca277029c3a57103fa83b141a508eec73042bbb264
SSDEEP 12288:uvU3IZKeY9lObgNJeyKXzi4uBURmzLxhs4Uui:aKenbgN1UP
TLSH
T15975F8405137D28FC1BB603247265B8C77A4EC56BB496F23B388853AD86AB55B0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 753KB
SHA256 fee4d5afd13dfc40f9166c2b08e676fac19af9b543da25c3ca679f13ecd19cd0
MD5 ff1378dd35ec47deb8623d723fb6cfd6
SHA1 16be5d98cfc36a8592a43aaab25f510471ae3c0d
SHA512 68a4f680e220ef4ed68c63cd29404c9ee2b0c632be4377add1e381fc940b0b06dab7c01ed133ddda581d633e105df237d30af1c6be30a4c7c0d2b611e66826a6
SSDEEP 12288:dMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75n9Ior:dnsJ39LyjbJkQFMhmC+6Gh97
TLSH
T118F47D32F2D19437D1721A3D9C5BA3A5982ABE512E38794E3BF81E4C5F3D68138252D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-03_1eb409f068e4d3393e323c00909679a1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Size 1.4MB
SHA256 a0f9e07017a9e7e5815aa5fc8b671aa56bcaddf7c474ad129f934f1793e90cc3
MD5 428aa198638ffe8a59e2b988b7c02eba
SHA1 d5e8dca10fdc77648baad650fa6f4cbc4770b7d4
SHA512 e7d0e99259ceaf450096ec6f40ec453a9215c31293b55d4e7f05f29545d388042a058e62391e1d3635f366f42eaabb7215dd4e00f934b04affdbd5cd260c97a0
SSDEEP 12288:lrP+t1L8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:lAN8qZ5xpHEilpQJSPYT8L
TLSH
T13465E0646343CC99D2478830CA58E2F144265C28A5A56AEF37A53F1F7B3E9828F11D7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 da9e05a0776744a4457ef2d438ce75a3376bddfb73e34299ce02ee107f4b0436
MD5 619c7e9b8d7f4d7c9f04e0fbea5999d3
SHA1 1096bfad9432be34fe934e2a1561eaa968395b73
SHA512 5b8262beee808afe2f1bba5bae5493f105127995f25c50d19e8857cd09efd0997d6e1d134f8ac0a32ea1ee359c1e9f572a0594b31754e645e735281bf42f32ba
SSDEEP 12288:zH7q8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:nq8qZ5xpHEilpQJSPYT8L
TLSH
T1A74523089758C189F76B67B09386E16DB46DBE284BD4C6CFF450380B593EAE84DBC853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 867255c12601ebd2148f105b452d67041d26256b731f1dd87c81e2db93f7fd09
MD5 651400400b928463c91d327812f03abf
SHA1 109c586a71741ed5f7300ef72ff11ae8a421c0ae
SHA512 2e80fbc383cbbf087a407c5e70920e5f5b8530d17bad1cda7a8820f08d83546b74357424e0594127fe7fc3b0dd63fbad9c8131651949eff635fc4bb812c4d7b2
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYF8qZ5xpHEilpQJSPYT8L:ogb4mBIBhGFkEilpQJSPYG
TLSH
T1FE65AE1E22EC02F5E1FAE2B8DDA64417D6B278160731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 81fd41ffa98d75f6c5fe5f4adf54dc6fe11f4f34da47c658bf0e8c50d7950810
MD5 91c6f010a6e69ebfb6cf1e079f7d7aed
SHA1 f9816bbed206efa4ac5ab9d24d85ee75ffe7295c
SHA512 482b0aab3a06db25df9008f634d3fd46cbf886368280826194fefe8e10dc0b0da787e76dc7c63fe8989aa9fd606020379b70a980660c35b6b5a68cc0646d04d3
SSDEEP 24576:FG88u8FpJqH1Nzria7/mm8qZ5xpHEilpQJSPYT8L:o7ZFPqV0a7/3EilpQJSPYG
TLSH
T1DC85F26577E001F0E477D1388A824667F6B1B8250364EFDF06A88A561F23BE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b0e3806fe4a16ca81ca7c08a5e28a1ce962d05022bc4e171c7310e522cd054af
MD5 5f630bef66b46261a65ecd0a5dd1e7c6
SHA1 c0d1d5088865e1699217a4d7c61333a85fbaaf33
SHA512 2deb0ed7bbfd81ad98ee5cf7e8f4e82b570eced7ce012bce6bcdd4651e468d6c9ad4eb4c0b17c7bbad201c0aaf9325fd04d0e53a80da1d83dab8ef9f17eab229
SSDEEP 12288:xHvUrBFrEjwaQr8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:xPUr+NQr8qZ5xpHEilpQJSPYT8L
TLSH
T1ED65E11E26A818E5F676A17D8682861DF771B8660751D2CF02E0813F4F27EE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c2b087db7a8dadcf1908c0b7a3ffb390feb22ba788efbd73a2600df8591a64e9
MD5 3831f219cd662b43e98364811387be5a
SHA1 655ae98d4887ca43f240224d62a293918ee73cee
SHA512 4e15fc88250667d5663823a1e654d9941dca09ec79855825c1b880c85bcfe1047c52f7ca1d1c1802b7854fa11ffc9bcd7168d70e3971a8e78ac3baeba1935f2b
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBEilpQJSPYG:MG05lO43b8Eiln
TLSH
T130D5CF6E62EC11F9D1BBD17CDAC6460BEBB23815032456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ae2a14049b1a53b2d4a2d96fd2dc6698d2ed6ff7323a4ce3e0999d64f5b86fdc
MD5 d118aed1b113371a3d0602b0614b3f83
SHA1 7dcac6b023ea6c2bac7836697c2da5c634ad1226
SHA512 564e2bc633426b0c33c2aa186667e2201c9c2e2d4796c3072ee75171dceb85efed974b98c561ecc0687f2387eaf7255f6d9f458d51ddb02accfe5603e5d810b3
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn88qZ5xpHEilpQJSPYT8L:Ca5POZ3+Jt2pasx2+mQEilpQJSPYG
TLSH
T18B65AF5DA6F801D5E1B9D17CC683861AF5B1342553319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ee5201e2bf5981ee837fc89929fbbc0b6f2185a38f66ef75fd6686c5b418af14
MD5 59d19e9063576ccccc019730551c65b6
SHA1 c985945e9d13e7297ddcda5c8c9a2f009ccf058b
SHA512 fe7a670ca92d7014f04268fb64bcb96c657f7a4eb51b3cc4a4ec0548b60c5ddc06ba1dc7c9e91760ec2a947eb6b08486cbc4c9926924d7e35049fa4d521c9424
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7Fku8qZ5xpHEilpQJSPYT8L:mNc/zEOVHFXEilpQJSPYG
TLSH
T17A858C1623E901E4F5BBE1BE89679546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b6fc27febfc45002a1af6d217a17e80fe152938b81ba88d8fa2201060b8dcd64
MD5 57b905815f4785a655fe0fa8991b938a
SHA1 f1b632bbfa1e63902f1baae9303064488686cbb0
SHA512 fc5b32a4874cbf8013e2a3c10d0fd9a59e18c91591a92a804af2d46e82557f6b420fa541bbe997a14a800eaefa6a30dad86f0ef77b32c83d68aefb0a181ba9b6
SSDEEP 24576:b8kNvNnaFeYhJNtmZBmJ8qZ5xpHEilpQJSPYT8L:b8MwBtOmzEilpQJSPYG
TLSH
T10D55AF6EB6B845E4E1FEC6B4CE238516E6727861073293CB5290C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fa576ba98112d038baacb2134635a9fc06f4f185bb5fff90885687ec3778044c
MD5 5599ba1a1edff2db816c2095746ea455
SHA1 f1a836e3a9595f4155a13a07bb023baa213012af
SHA512 4c500518f5bc9c949d3a73931428a1a2c9950f41f55f624487c19bcdd4fcf141725fd22b48f93e9dfdf12e457f02590756cd9404f06f0e6d9a4956fac60d2305
SSDEEP 24576:SD3FHshBIYQgAP8qZ5xpHEilpQJSPYT8L:SDVHeBIAAFEilpQJSPYG
TLSH
T13B75E17DEA9C00E4E57BD2BCD6938606E67138AD036156CB12D481BA1F2BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-135-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/252-129-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/252-410-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/252-127-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/960-120-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/960-394-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/1424-78-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1424-77-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1424-86-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1424-239-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1612-251-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1612-249-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1612-240-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1612-241-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1612-247-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1888-194-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/1888-193-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1888-424-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1888-199-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/3384-24-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3384-16-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3384-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3384-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3384-214-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3712-430-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3712-264-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3712-258-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3712-257-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3748-271-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4120-104-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4120-106-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4120-89-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4120-90-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4120-96-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4624-5-0x0000000002570000-0x00000000025D7000-memory.dmp

Download

memory/4624-209-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/4624-10-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/4624-9-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Download

memory/4624-192-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Download

memory/4624-6-0x0000000002570000-0x00000000025D7000-memory.dmp

Download

memory/4624-0-0x0000000002570000-0x00000000025D7000-memory.dmp

Download

memory/4976-234-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4976-429-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/4976-226-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/4976-228-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5400-266-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/5580-339-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5580-110-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5580-116-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5580-109-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5924-213-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5924-425-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5924-427-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5924-428-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5924-221-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5924-215-0x0000000000800000-0x0000000000860000-memory.dmp

Download