Overview

overview

10

Static

static

10

2026-09-14...lo.exe

windows10-2004-x64

10

2026-09-14...lo.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/09/2026, 06:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-14_e8f2514893193d832bf5a02f5a204307_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hello.exe
  • Size 2.1MB
  • Sample260915-hqnrlsdp81
  • SHA256 d66706774b42094814148e82ca9d2aae4f289acefb7ef8a48fc20a06c1bf15ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryxredpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 51 IoCs
  • Loads dropped DLL 62 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-14_e8f2514893193d832bf5a02f5a204307_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hello.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-14_e8f2514893193d832bf5a02f5a204307_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hello.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5108
    • \??\c:\users\admin\appdata\local\temp\2026-09-14_e8f2514893193d832bf5a02f5a204307_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hello.exe 
      c:\users\admin\appdata\local\temp\2026-09-14_e8f2514893193d832bf5a02f5a204307_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hello.exe 
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5056
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2428
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\Program Files (x86)\Google\Temp\GUM9E9C.tmp\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Temp\GUM9E9C.tmp\GoogleUpdate.exe" InjUpdate "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={D4759F38-3EC2-CF22-15D7-F70BCBED8D4C}&lang=es&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=ALOY&installdataindex=empty"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4452
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3744
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1784
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4136
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4404
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1836
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Windows\SysWOW64\._cache_Synaptics.exe
      "C:\Windows\system32\._cache_Synaptics.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4792
      • C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={D4759F38-3EC2-CF22-15D7-F70BCBED8D4C}&lang=es&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=ALOY&installdataindex=empty"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4720
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2096
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3028
          • C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:1116
          • C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:4772
          • C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:2008
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi44MiIgc2hlbGxfdmVyc2lvbj0iMS4zLjM2LjgxIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezZENUY1NDk4LTlGRTMtNDMyNS1CMkVBLTY3RTg3QzQxMzVDQn0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntFNUVDMzE4Mi1BRUY0LTREM0MtQTc3MC0xRjAwNDU4RTc1MEZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxNDEuMC43MzQwLjAiIG5leHR2ZXJzaW9uPSIxLjMuMzYuODIiIGxhbmc9ImVzIiBicmFuZD0iQUxPWSIgY2xpZW50PSIiIGlpZD0ie0Q0NzU5RjM4LTNFQzItQ0YyMi0xNUQ3LUY3MEJDQkVEOEQ0Q30iPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTE3MiIvPjwvYXBwPjwvcmVxdWVzdD4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:964
        • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={D4759F38-3EC2-CF22-15D7-F70BCBED8D4C}&lang=es&browser=5&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=ALOY&installdataindex=empty" /installsource taggedmi /sessionid "{6D5F5498-9FE3-4325-B2EA-67E87C4135CB}"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1724
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2736
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    PID:2172
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4524
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\153.0.8010.37_chrome_installer_uncompressed.exe
      "C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\153.0.8010.37_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\guiEA27.tmp"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\CR_94283.tmp\setup.exe
        "C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\CR_94283.tmp\setup.exe" --uncompressed-archive="C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\CR_94283.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\guiEA27.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1036
        • C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\CR_94283.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\CR_94283.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=153.0.8010.37 "--attachment=C:\Program Files\chrome_installer.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff652f68f58,0x7ff652f68f68,0x7ff652f68f78
          4⤵
          • Executes dropped EXE
          PID:1612
        • C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\CR_94283.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\CR_94283.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4052
          • C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\CR_94283.tmp\setup.exe
            "C:\Program Files (x86)\Google\Update\Install\{668BA958-0CE4-4634-ABCC-77A20D6E0F23}\CR_94283.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=153.0.8010.37 "--attachment=C:\Program Files\chrome_installer.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff652f68f58,0x7ff652f68f68,0x7ff652f68f78
            5⤵
            • Executes dropped EXE
            PID:4868
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi44MiIgc2hlbGxfdmVyc2lvbj0iMS4zLjM2LjgxIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezZENUY1NDk4LTlGRTMtNDMyNS1CMkVBLTY3RTg3QzQxMzVDQn0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins3ODMxMjNFNi1CQzc2LTRBNDktQUVBOS1DREE4RjI0RUM5NzZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxNTMuMC44MDEwLjM3IiBhcD0ieDY0LXN0YWJsZS1zdGF0c2RlZl8xIiBsYW5nPSJlcyIgYnJhbmQ9IkFMT1kiIGNsaWVudD0iIiBpaWQ9IntENDc1OUYzOC0zRUMyLUNGMjItMTVENy1GNzBCQ0JFRDhENEN9IiBjb2hvcnQ9IjE6Z3UvaTE5OiIgY29ob3J0bmFtZT0iU3RhYmxlIEluc3RhbGxzICZhbXA7IFZlcnNpb24gUGlucyI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAxMjg5NCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvZ2sybnB2bnVoNDZudDY2Y3ltZXA2eWk1cXFfMTUzLjAuODAxMC4zNy8xNTMuMC44MDEwLjM3X2Nocm9tZV9pbnN0YWxsZXJfdW5jb21wcmVzc2VkLmV4ZSIgZG93bmxvYWRlZD0iMCIgdG90YWw9Ii0xIiBkb3dubG9hZF90aW1lX21zPSIyMTExMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9Indpbmh0dHAiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2drMm5wdm51aDQ2bnQ2NmN5bWVwNnlpNXFxXzE1My4wLjgwMTAuMzcvMTUzLjAuODAxMC4zN19jaHJvbWVfaW5zdGFsbGVyX3VuY29tcHJlc3NlZC5leGUiIGRvd25sb2FkZWQ9IjQ5Mjk4MTAwIiB0b3RhbD0iNTE3ODMzMTI4IiBkb3dubG9hZF90aW1lX21zPSIzNTMyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvZ2sybnB2bnVoNDZudDY2Y3ltZXA2eWk1cXFfMTUzLjAuODAxMC4zNy8xNTMuMC44MDEwLjM3X2Nocm9tZV9pbnN0YWxsZXJfdW5jb21wcmVzc2VkLmV4ZSIgZG93bmxvYWRlZD0iNTE3ODMzMTI4IiB0b3RhbD0iNTE3ODMzMTI4IiBkb3dubG9hZF90aW1lX21zPSI0MjM5MSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNDg1IiBkb3dubG9hZF90aW1lX21zPSI3MTU3OCIgZG93bmxvYWRlZD0iNTE3ODMzMTI4IiB0b3RhbD0iNTE3ODMzMTI4IiBpbnN0YWxsX3RpbWVfbXM9IjMzNTQ3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
  • C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateOnDemand.exe
    "C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateOnDemand.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1852
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:636
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=153.0.8010.37 --initial-client-data=0xfc,0x100,0x104,0xf8,0xc8,0x7ffa7837fe80,0x7ffa7837fe90,0x7ffa7837fea0
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4568
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1732,i,631815662870577393,13898160747741762848,262144 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1896 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1500
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,18284603651733925924,18035528065046550974,524288 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2220 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Time Discovery
          PID:2860
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2500,i,17455813979739367351,3980185250655553456,524288 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2512 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3916
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3440,i,15084079806353649274,14129648057516828017,1572864 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3520 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4316
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3784,i,147103503900932160,8940144085536107136,1572864 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3800 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3496
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3824,i,15192280994248341918,3944345332652723665,1572864 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3864 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4448
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4080,i,12062337333859600221,5309751323035936038,1572864 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4084 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1776
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4308,i,15647033748333474003,11266862403130280228,1572864 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4328 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2004
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4456,i,17598816039073074548,9697755651288288952,1572864 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4472 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1828
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5212,i,11877264302640588804,16233983080471054244,1572864 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5236 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2220
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5420,i,1719019974407973231,16829651150030980111,1572864 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3916 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2092
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,1373250962202142454,4483899158031065171,524288 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6004 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4292
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6204,i,2087220581934457900,7892980095798289496,1572864 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6220 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5328
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6248,i,9904216027130438946,16881527169627366092,1572864 --field-trial-handle=1900,i,5683008632397634415,12194491242530406464,262144 --variations-seed-version=20260911-010032.103000-production --pseudonymization-salt-handle=1928,i,892305335656333973,555555131012078385,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6260 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5336
  • C:\Program Files\Google\Chrome\Application\153.0.8010.37\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\153.0.8010.37\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4244
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:4588
    • C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateBroker.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateBroker.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /broker
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2664
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5132
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5204

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Modify Registry

          3
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          4
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          System Time Discovery

          1
          T1124

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          GoogleUpdate.exe
          • Path C:\Program Files (x86)\Google\Temp\GUM9E9C.tmp\GoogleUpdate.exe
          • Size 150KB
          • SHA256 a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdate.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM9E9C.tmp\goopdate.dll
          • Size 1.8MB
          • SHA256 ac655d1723ac9835c05ec9271388ac23d7981b954b1f0375b02d3d9614676cb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en.dll
          • Path C:\Program Files (x86)\Google\Temp\GUM9E9C.tmp\goopdateres_en.dll
          • Size 45KB
          • SHA256 72ecc90cf005dd570bcc1588162e6ea090834ec269264e0bb774e1e6f9eabef7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleCrashHandler.exe
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\GoogleCrashHandler.exe
          • Size 286KB
          • SHA256 6d67fc790835b85e7b14def65958d9b30e0f6e6bc6d4ead40960a3ca993353ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleCrashHandler64.exe
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\GoogleCrashHandler64.exe
          • Size 365KB
          • SHA256 af0d678cf5d4bdd7a364e95460eb46e94f67a5037f4e4ad28580282c22f17812
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleUpdateComRegisterShell64.exe
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\GoogleUpdateComRegisterShell64.exe
          • Size 177KB
          • SHA256 eadaf98f6e10eddd93a5ae75f06016cb28c2c26d59a33c2db9c1a3324246dbb1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoogleUpdateCore.exe
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\GoogleUpdateCore.exe
          • Size 212KB
          • SHA256 ec41c9b58f78bf2c564b3c9c291b62c94d983e33cec34102a206a1d859ab619f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_am.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_am.dll
          • Size 45KB
          • SHA256 f9785f026af490e2fccb492568f525f0fec19aa7154dd356607dd3f017271a87
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ar.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_ar.dll
          • Size 44KB
          • SHA256 86eead46a325521737024d0d5a98627123ff2483ab28dba3003adb0a9357a389
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bg.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_bg.dll
          • Size 47KB
          • SHA256 8c4c5ad521fe7622741ee56df47c5816c972f101ad7b4a10d68eadcab4d23c1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_bn.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_bn.dll
          • Size 47KB
          • SHA256 bba11848ad429873da1a3d32dc64b39bfbf2204217b37d3a951b8d4b71d8a1b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ca.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_ca.dll
          • Size 47KB
          • SHA256 15b2834475621f43969f8cb40f84150dc508ced9bb57d1efc48b075c38419d6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_cs.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_cs.dll
          • Size 46KB
          • SHA256 0b6c449ea5e2f32fb297b39eec297d60ea5d85bf4dea7963bd7f981c0b9b6a3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_da.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_da.dll
          • Size 46KB
          • SHA256 c65fabb92fa027943f2d555b807ff34e816c0738fe920ea70d72a8d1efd280d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_de.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_de.dll
          • Size 48KB
          • SHA256 14b5f6c69c33c45246307609645a9400aeec8a4e4ddb8bf5cfc8cccc2621e5c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_el.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_el.dll
          • Size 47KB
          • SHA256 b5f08551eb3171596224b4e198f1c884dd3f6b25634b87d7727ec84b1179c8f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_en-GB.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_en-GB.dll
          • Size 45KB
          • SHA256 5f6e4ded5c15af9bab11794575c68992d2416d8cadfd584bf574dd949a6f1916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es-419.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_es-419.dll
          • Size 46KB
          • SHA256 369267a8613331fac8f4142f348e36ca74612342f79c787bdf1b7d075321a37c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_es.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_es.dll
          • Size 48KB
          • SHA256 a73f0498e5fdfd99add448debf2a6018ba638851acd72279b31394be4c15bdf7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_et.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_et.dll
          • Size 45KB
          • SHA256 3b6db8fc9849acd2f7bef58e02b5bf3389610a6b80160d9524aa858130bcde1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fa.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_fa.dll
          • Size 45KB
          • SHA256 eecb88f50af6fb8a8d1cfdc9634f51daa19bd2043ede11155f3aca0498002f08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fi.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_fi.dll
          • Size 46KB
          • SHA256 bd68a0cfd99ad7bbc0113c402ce8496b12deed64cb70dceaf07f463bcfb4d1f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fil.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_fil.dll
          • Size 47KB
          • SHA256 1ab0025299074334b74000134698678f1baa1a5411aff2a7cf8e24bf55012794
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_fr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_fr.dll
          • Size 47KB
          • SHA256 a1433572f2663564e78afd08b30c3b4d54e665de686472822dac9418f1c86f6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_gu.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_gu.dll
          • Size 47KB
          • SHA256 6849d9f5d4071a721f50f710b0368b9bdb3c11c8ca7af3ec20159c8cbbc7b080
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hi.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_hi.dll
          • Size 46KB
          • SHA256 5680d48172727c09337bf989a3dee0f3d208d50051da680e21e119ca638719ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_hr.dll
          • Size 46KB
          • SHA256 d900010dcdaf794e4f9860095444098d333670e7f5b9fbf43d3c509ba00a0310
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_hu.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_hu.dll
          • Size 46KB
          • SHA256 9cb66703c17e759ba375918802d7024e464dc0b6ff27508e55134f6e175f4098
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_id.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_id.dll
          • Size 45KB
          • SHA256 bd072d16830d713928202f4724efcad43ba7c6ac13054845325fb5b5b078cc32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_is.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_is.dll
          • Size 46KB
          • SHA256 807c80aa1100a7c40b8e1cf8f94ad3b3d677e1fb34d0ed297c6d26197b9afd19
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_it.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_it.dll
          • Size 47KB
          • SHA256 76c6d0757ab872f7e4b7511ca560954807ab54a9b79c7f4dc09eeb7ab7aada22
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_iw.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_iw.dll
          • Size 43KB
          • SHA256 0e4577ee3dab91f4146b7adc930db6f5a6196b15088eaf85165f3cd3d5acc767
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ja.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_ja.dll
          • Size 42KB
          • SHA256 e7194d8bf9f6f2a0e91a3614e189e664f18a4d3708efe247accc41a999ce1ea2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_kn.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_kn.dll
          • Size 47KB
          • SHA256 b03327ef6b5ede5ab75c2f38c8d21253220c9a97d3e678930f574bfdad37abf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ko.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_ko.dll
          • Size 41KB
          • SHA256 f70bc35a85e9a17387dfb54990ff7fde87469b8b955d4a27d191f10bf09bdc73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lt.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_lt.dll
          • Size 45KB
          • SHA256 55a3cc193d9be9e066bd8d79e194fcef5a0b47e1fcfc66e1ae861f509cfddb8e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_lv.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_lv.dll
          • Size 46KB
          • SHA256 0f6d852fbaa2f379a119f82c9f73e1797515357ab84fd758d31f96f0700b44cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_ml.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_ml.dll
          • Size 49KB
          • SHA256 003a2deb8fd80cf3133e9b885c3c5e193eca49357c6b184cdd459268a4ae5bab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goopdateres_mr.dll
          • Path C:\Program Files (x86)\Google\Temp\GUMA35F.tmp\goopdateres_mr.dll
          • Size 47KB
          • SHA256 ec1cf480fa641e4dd357e9ba40dbda77cd2308290d3a1352c9276e0238bbc879
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrmstp.exe
          • Path C:\Program Files\Google\Chrome\Application\153.0.8010.37\Installer\chrmstp.exe
          • Size 7.6MB
          • SHA256 c23ec8d10b964a7c5c449dbced1cc6feab7d3ff9d33ae5b56e6eec97c41115e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          am_MASCULINE.pak
          • Path C:\Program Files\Google\Chrome\Temp\source1036_815865339\Chrome-bin\153.0.8010.37\Locales\am_MASCULINE.pak
          • Size 18B
          • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
          • MD5 SHA1 SHA512
          Submit Download

          9313ad89-8347-443c-9fb9-58ceabd40bea.tmp
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9313ad89-8347-443c-9fb9-58ceabd40bea.tmp
          • Size 19B
          • SHA256 1560b22b2264f7cb6b7f6910164813f76c5e8a06fb1acf85b375e687ee49c1ad
          • MD5 SHA1 SHA512
          Submit Download

          BookmarkMergedSurfaceOrdering
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
          • Size 6B
          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
          • MD5 SHA1 SHA512
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
          • Size 72B
          • SHA256 fe14703be22471537e3ab3bd331d834ccb511c3d858b98e49584b0f2997b348e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
          • Size 13KB
          • SHA256 d099a049886e743f5c7779d96656d8fb2a1bea92c26946d4b4f6687418650529
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Secure Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
          • Size 21KB
          • SHA256 c4c284649985ff003b33614c38c50255cd74ee0697e68e3a6d799c8e125b6323
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          9649f9b9-4bfb-4ac6-8bca-ab0b77439ffe.tmp
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\9649f9b9-4bfb-4ac6-8bca-ab0b77439ffe.tmp
          • Size 96B
          • SHA256 a297a846e397fb48c3e2b90d163a196c22000d402907b7c366bba0800589ef73
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
          • Size 120B
          • SHA256 a9a69cd346af7a99529070d367f4f937ddfcdc0f7a83b9d3a2f1ecff0e641b50
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          192.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir636_721219510\Trusted Icons\Icons\192.png
          • Size 6KB
          • SHA256 b76aa025f0516496f80008232c3f1e9584cd74090ac50c0d67c89d619595e58d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          256.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir636_721219510\Trusted Icons\Icons\256.png
          • Size 22KB
          • SHA256 b989f789c07c6d8f103d42c1adbd90a2152e54ac006a4db4956be29e5b292e94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          32.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir636_721219510\Trusted Icons\Icons\32.png
          • Size 1KB
          • SHA256 d036530ce6b5320532f359ee4b96e5b2338f78640e91bcab10e7f2e637574240
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          48.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir636_721219510\Trusted Icons\Icons\48.png
          • Size 2KB
          • SHA256 04ab9b9bb94719dffe4487c44a9b5d2386b56e5d34f4b26e0c6c9c0505d78f22
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          64.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir636_721219510\Trusted Icons\Icons\64.png
          • Size 3KB
          • SHA256 09a66a69d37f7e99b104f442f878fd72e8fb3637eefba61987aaaa7a2a1cb185
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          96.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir636_721219510\Trusted Icons\Icons\96.png
          • Size 6KB
          • SHA256 2561ac539473f6175a4387169cdf3237a7ac46dfa7de354b60d8f2c03e081e74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          128.png
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir636_967678496\Icons\128.png
          • Size 8KB
          • SHA256 c4d6a0f6c263a4d611fd6ec65643b9844f6eb0c1c9c0ec64b2fa9fcaad149170
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 5KB
          • SHA256 a3f90430dae3b9b6ec06892037ad8475ac188eb49744d27d16af5eb71550cd40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 130KB
          • SHA256 163292cdc934a77d576ec680a3b600765a666c90cc1814188e49d567d74d7f65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VariationsSafeSeedV2
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSafeSeedV2
          • Size 86KB
          • SHA256 1ad0cf4d26ed47dab5193bd0e910632f9c0997ace25216787db86204d99b781d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VariationsSeedV2
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSeedV2
          • Size 40KB
          • SHA256 f4ba06c53b6c3fc25abda5e5607060f697d5683a7749d7a6f85a06e1e75e410d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VariationsSeedV233509614-08ef-40c2-8cf8-34b6ec9be83d.tmp
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSeedV233509614-08ef-40c2-8cf8-34b6ec9be83d.tmp
          • Size 86KB
          • SHA256 3bb4a2979fa12b22dc0a33c7d8575838c0a92ab5502009cca40d0819e779af73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ._cache_Synaptics.exe
          • Path C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          • Size 1.3MB
          • SHA256 c53da2e394691c68b6ed9e86c6686665ead97ab6dab8e874d809c9f3f8d5a786
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-09-14_e8f2514893193d832bf5a02f5a204307_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hello.exe 
          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-14_e8f2514893193d832bf5a02f5a204307_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hello.exe 
          • Size 2.0MB
          • SHA256 09585ea6da33522504e61953c7d75b1b21240a2442b77e36b72ee11efdc82ccd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7EA85E00
          • Path C:\Users\Admin\AppData\Local\Temp\7EA85E00
          • Size 21KB
          • SHA256 f6bd41c0658bdf2dd0e27fa4df9455ba2c69ae14081007baa181c70d6c423afa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          explorer.exe
          • Path C:\Windows\Resources\Themes\explorer.exe
          • Size 135KB
          • SHA256 8e0aed227e1eff30593900c37bafce664ff7e97be69c9db96f4e3cf736857386
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icsys.icn.exe
          • Path C:\Windows\Resources\Themes\icsys.icn.exe
          • Size 135KB
          • SHA256 37ae43c1948a80aef94572db17cd2f289f25640434244c06c71cf9a4a167cda0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spoolsv.exe
          • Path C:\Windows\Resources\spoolsv.exe
          • Size 135KB
          • SHA256 bc908113c9e9ebd2f0117d0a2b71f2df8c025f6597afefd6ae430ec1938785bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          svchost.exe
          • Path C:\Windows\Resources\svchost.exe
          • Size 135KB
          • SHA256 63cb4d3f0ed758bae1254952059593550f700a1bdc8ef215ca1159978689e1f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1612-1816-0x00007FF652860000-0x00007FF653034000-memory.dmp
          Download

          memory/1784-1658-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/1836-47-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/2428-645-0x0000000000400000-0x0000000000602000-memory.dmp
          Download

          memory/2428-630-0x0000000000400000-0x0000000000602000-memory.dmp
          Download

          memory/2428-624-0x0000000000400000-0x0000000000602000-memory.dmp
          Download

          memory/2736-190-0x00007FFA5EEB0000-0x00007FFA5EEC0000-memory.dmp
          Download

          memory/2736-201-0x00007FFA5EEB0000-0x00007FFA5EEC0000-memory.dmp
          Download

          memory/2736-308-0x00007FFA5C820000-0x00007FFA5C830000-memory.dmp
          Download

          memory/2736-306-0x00007FFA5C820000-0x00007FFA5C830000-memory.dmp
          Download

          memory/2736-185-0x00007FFA5EEB0000-0x00007FFA5EEC0000-memory.dmp
          Download

          memory/2736-189-0x00007FFA5EEB0000-0x00007FFA5EEC0000-memory.dmp
          Download

          memory/2736-203-0x00007FFA5EEB0000-0x00007FFA5EEC0000-memory.dmp
          Download

          memory/3744-57-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4136-56-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4404-1660-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4868-1814-0x00007FF652860000-0x00007FF653034000-memory.dmp
          Download

          memory/4984-318-0x0000000000400000-0x0000000000602000-memory.dmp
          Download

          memory/5056-117-0x0000000000400000-0x0000000000602000-memory.dmp
          Download

          memory/5056-10-0x00000000004A0000-0x00000000004A1000-memory.dmp
          Download

          memory/5056-9-0x0000000002390000-0x0000000002391000-memory.dmp
          Download

          memory/5108-58-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/5108-0-0x0000000000400000-0x000000000041F000-memory.dmp
          Download