462df53549d74565e2833da5acb6a67909bb32a7eca424a3cd297301e5470237

Analysis

max time kernel
123s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.1MB
Sample260802-ebzc1stenh
SHA256 462df53549d74565e2833da5acb6a67909bb32a7eca424a3cd297301e5470237
MD5 0117e7d218f5efda3d4f17f21dc11544
SHA1 812a68fe31d169820066240829235ee04b7021b2
SHA512 5d3c911d27a681aa998619e94cf007807b9d0dc30a1f13348d19f43d9f2a6915d9d5e2b4213344519b64c1828dd83711458560dcb899378bb33f7f7346523abf
SSDEEP 24576:A2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSoJlh9bD8RX5ET8:cdGXpiQSfKJip1RinDO44mEzfTTh
TLSH
T1FEE52A20B7508025D7BFD5B80A6EA168541CBD901F1691EBA1FC7BEF9B396E03D3019E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3672	base.sfx.part01.exe
5252	base.exe
5172	svchost.exe
3000	svchost.exe
3100	base.exe
2684	svchost.exe
1692	base.exe
1420	base.exe
6464	BE4C.tmp.exe
6472	BDEE.tmp.exe
8104	snotes.exe
8096	snotes.exe
6672	snotes.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InSvchost = "C:\\Windows\\IME\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svc05010_2 = "C:\\Windows\\snotes.exe"	base.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\t:	svchost.exe
File opened (read-only)	\??\g:	svchost.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\m:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\k:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\o:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\s:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\y:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\j:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\v:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\w:	svchost.exe
File opened (read-only)	\??\k:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\o:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\u:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\q:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\x:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\h:	svchost.exe
File opened (read-only)	\??\x:	svchost.exe
File opened (read-only)	\??\l:	svchost.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\d:	svchost.exe
File opened (read-only)	\??\q:	svchost.exe
File opened (read-only)	\??\d:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\p:	svchost.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\t:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\w:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\z:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\n:	svchost.exe
File opened (read-only)	\??\z:	svchost.exe
File opened (read-only)	\??\i:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\m:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\y:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\r:	svchost.exe
File opened (read-only)	\??\r:	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened (read-only)	\??\i:	svchost.exe
File opened (read-only)	\??\j:	svchost.exe

Drops file in Windows directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\base.sfx.part02.rar	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\base.exe	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240696203	base.sfx.part01.exe
File created	C:\Windows\BE4C.tmp.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\inf\svchost.exe	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part01.exe	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\snotes.exe	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	base.sfx.part01.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\snotes.exe	svchost.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File created	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\snotes.exe	base.exe
File created	C:\Windows\IME\svchost.exe	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.exe	base.sfx.part01.exe
File created	C:\Windows\snotes.exe	base.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\inf\svchost.exe	svchost.exe
File opened for modification	C:\Windows\base.exe	svchost.exe
File opened for modification	C:\Windows\IME\svchost.exe	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part03.rar	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Windows\base.sfx.part04.rar	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\IME\svchost.exe	svchost.exe
File opened for modification	C:\Windows\BE4C.tmp.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BE4C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	base.sfx.part01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5084	taskkill.exe
3468	taskkill.exe
4396	taskkill.exe
6176	taskkill.exe
6880	taskkill.exe
5360	taskkill.exe
3636	taskkill.exe
3424	taskkill.exe
1636	taskkill.exe
2920	taskkill.exe
3452	taskkill.exe
1496	taskkill.exe
2144	taskkill.exe
6772	taskkill.exe
3452	taskkill.exe
5636	taskkill.exe
2108	taskkill.exe
3132	taskkill.exe
6888	taskkill.exe
6988	taskkill.exe
2364	taskkill.exe
1980	taskkill.exe
7628	taskkill.exe
4600	taskkill.exe
7000	taskkill.exe
1552	taskkill.exe
4532	taskkill.exe
4864	taskkill.exe
5768	taskkill.exe
4952	taskkill.exe
2396	taskkill.exe
2428	taskkill.exe
5032	taskkill.exe
2076	taskkill.exe
3908	taskkill.exe
6536	taskkill.exe
1092	taskkill.exe
4516	taskkill.exe
1628	taskkill.exe
204	taskkill.exe
4840	taskkill.exe
5356	taskkill.exe
3008	taskkill.exe
5892	taskkill.exe
692	taskkill.exe
7068	taskkill.exe
5448	taskkill.exe
7396	taskkill.exe
3772	taskkill.exe
6172	taskkill.exe
7348	taskkill.exe
3216	taskkill.exe
7568	taskkill.exe
7432	taskkill.exe
8028	taskkill.exe
2672	taskkill.exe
1964	taskkill.exe
5248	taskkill.exe
3440	taskkill.exe
6312	taskkill.exe
4656	taskkill.exe
2872	taskkill.exe
5320	taskkill.exe
3676	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
5252	base.exe
5252	base.exe
5172	svchost.exe
5172	svchost.exe
3000	svchost.exe
3000	svchost.exe
5172	svchost.exe
5172	svchost.exe
5172	svchost.exe
5172	svchost.exe
3000	svchost.exe
3000	svchost.exe
3100	base.exe
3100	base.exe
3000	svchost.exe
3000	svchost.exe
2684	svchost.exe
2684	svchost.exe
1692	base.exe
1692	base.exe
2684	svchost.exe
2684	svchost.exe
2684	svchost.exe
2684	svchost.exe
1420	base.exe
1420	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe
3100	base.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeShutdownPrivilege	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	2428	taskkill.exe
Token: SeDebugPrivilege	3676	taskkill.exe
Token: SeDebugPrivilege	5024	taskkill.exe
Token: SeDebugPrivilege	3772	taskkill.exe
Token: SeDebugPrivilege	5040	taskkill.exe
Token: SeDebugPrivilege	4532	taskkill.exe
Token: SeDebugPrivilege	3468	taskkill.exe
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	5320	taskkill.exe
Token: SeDebugPrivilege	5172	svchost.exe
Token: SeShutdownPrivilege	5172	svchost.exe
Token: SeDebugPrivilege	3000	svchost.exe
Token: SeShutdownPrivilege	3000	svchost.exe
Token: SeDebugPrivilege	2684	svchost.exe
Token: SeShutdownPrivilege	2684	svchost.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	5892	taskkill.exe
Token: SeDebugPrivilege	4700	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	2076	taskkill.exe
Token: SeDebugPrivilege	4600	taskkill.exe
Token: SeDebugPrivilege	3908	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	5704	taskkill.exe
Token: SeDebugPrivilege	5768	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	3664	taskkill.exe
Token: SeDebugPrivilege	5248	taskkill.exe
Token: SeDebugPrivilege	3636	taskkill.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	5872	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	4864	taskkill.exe
Token: SeDebugPrivilege	744	taskkill.exe
Token: SeDebugPrivilege	4516	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeDebugPrivilege	3808	taskkill.exe
Token: SeDebugPrivilege	5356	taskkill.exe
Token: SeDebugPrivilege	5636	taskkill.exe
Token: SeDebugPrivilege	5360	taskkill.exe
Token: SeDebugPrivilege	8096	snotes.exe
Token: SeDebugPrivilege	8104	snotes.exe
Token: SeDebugPrivilege	6156	taskkill.exe
Token: SeDebugPrivilege	6176	taskkill.exe
Token: SeDebugPrivilege	692	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	6888	taskkill.exe
Token: SeDebugPrivilege	6172	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	3424	taskkill.exe
Token: SeDebugPrivilege	3132	taskkill.exe
Token: SeDebugPrivilege	3256	taskkill.exe
Token: SeDebugPrivilege	7000	taskkill.exe
Token: SeDebugPrivilege	7180	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 5024	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	88
PID 4612 wrote to memory of 3676	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 4612 wrote to memory of 3452	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 4612 wrote to memory of 3772	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	93
PID 4612 wrote to memory of 3468	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	94
PID 4612 wrote to memory of 5320	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 4612 wrote to memory of 5032	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 4612 wrote to memory of 5040	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 4612 wrote to memory of 4532	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 4612 wrote to memory of 3672	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 4612 wrote to memory of 2428	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	99
PID 4612 wrote to memory of 1872	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	110
PID 4612 wrote to memory of 4240	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	111
PID 4612 wrote to memory of 6084	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	112
PID 4612 wrote to memory of 2312	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	113
PID 4612 wrote to memory of 3724	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	114
PID 4612 wrote to memory of 2620	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	115
PID 4612 wrote to memory of 1136	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	116
PID 4612 wrote to memory of 2856	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	117
PID 4612 wrote to memory of 4216	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	118
PID 4612 wrote to memory of 4876	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	119
PID 4612 wrote to memory of 5252	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	132
PID 4612 wrote to memory of 3000	4612	2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe	134
PID 5172 wrote to memory of 3100	5172	svchost.exe	135
PID 5172 wrote to memory of 2684	5172	svchost.exe	136
PID 5172 wrote to memory of 5248	5172	svchost.exe	138
PID 5172 wrote to memory of 3664	5172	svchost.exe	139
PID 5172 wrote to memory of 5984	5172	svchost.exe	140
PID 5172 wrote to memory of 5136	5172	svchost.exe	141
PID 5172 wrote to memory of 1964	5172	svchost.exe	142
PID 5172 wrote to memory of 3636	5172	svchost.exe	143
PID 5172 wrote to memory of 5704	5172	svchost.exe	144
PID 5172 wrote to memory of 3808	5172	svchost.exe	145
PID 5172 wrote to memory of 3908	5172	svchost.exe	146
PID 5172 wrote to memory of 5892	5172	svchost.exe	147
PID 5172 wrote to memory of 552	5172	svchost.exe	148
PID 5172 wrote to memory of 1464	5172	svchost.exe	149
PID 5172 wrote to memory of 1732	5172	svchost.exe	150
PID 5172 wrote to memory of 5560	5172	svchost.exe	151
PID 5172 wrote to memory of 548	5172	svchost.exe	152
PID 5172 wrote to memory of 4256	5172	svchost.exe	153
PID 5172 wrote to memory of 5276	5172	svchost.exe	154
PID 5172 wrote to memory of 4520	5172	svchost.exe	155
PID 5172 wrote to memory of 3412	5172	svchost.exe	156
PID 5172 wrote to memory of 3280	5172	svchost.exe	157
PID 3000 wrote to memory of 4700	3000	svchost.exe	158
PID 3000 wrote to memory of 2672	3000	svchost.exe	159
PID 3000 wrote to memory of 4952	3000	svchost.exe	160
PID 3000 wrote to memory of 3008	3000	svchost.exe	161
PID 3000 wrote to memory of 1216	3000	svchost.exe	162
PID 3000 wrote to memory of 2076	3000	svchost.exe	163
PID 3000 wrote to memory of 4396	3000	svchost.exe	164
PID 3000 wrote to memory of 4600	3000	svchost.exe	165
PID 3000 wrote to memory of 5768	3000	svchost.exe	166
PID 3000 wrote to memory of 2144	3000	svchost.exe	167
PID 3000 wrote to memory of 3420	3000	svchost.exe	168
PID 3000 wrote to memory of 5584	3000	svchost.exe	169
PID 3000 wrote to memory of 3184	3000	svchost.exe	170
PID 3000 wrote to memory of 3268	3000	svchost.exe	171
PID 3000 wrote to memory of 2060	3000	svchost.exe	172
PID 3000 wrote to memory of 4628	3000	svchost.exe	173
PID 3000 wrote to memory of 5840	3000	svchost.exe	174
PID 3000 wrote to memory of 4792	3000	svchost.exe	175
PID 3000 wrote to memory of 5008	3000	svchost.exe	176

C:\Users\Admin\AppData\Local\Temp\2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_0117e7d218f5efda3d4f17f21dc11544_amadey_darkgate_elex_gcleaner_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3676
- C:\Windows\base.sfx.part01.exe
  "C:\\Windows\\base.sfx.part01.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3672
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3772
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3468
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5320
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4532
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2428
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:1872
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:4240
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6084
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:2312
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:3724
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2620
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:1136
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:2856
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:4216
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:4876
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5252
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:5584
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3184
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4792
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:7348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:7068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:6988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    PID:6620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    PID:4476
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3444
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6168
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6616
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:6328
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:6268
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4144
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7988
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:7296
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:6808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    PID:1552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - Kills process with taskkill
    PID:2396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    PID:7388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:7432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    PID:4656
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4688
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:7664
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:7660
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:8144
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7444
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:8024
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    PID:7636
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6688
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:1824
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:7716
- C:\Users\Admin\AppData\Local\Temp\BDEE.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\BDEE.tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:6472

C:\Windows\IME\svchost.exe
C:\Windows\IME\svchost.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\base.exe
  "C:\\Windows\\base.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- - C:\Windows\snotes.exe
    "C:\Windows\snotes.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:8096
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5872
- - C:\Windows\base.exe
    "C:\\Windows\\base.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:1420
  - - C:\Windows\snotes.exe
      "C:\Windows\snotes.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:8104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3228
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4752
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:5720
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1276
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:872
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4380
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    PID:3216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    PID:6184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    PID:1080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:1980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:5448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:2364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1636
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:5724
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:6872
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6736
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:5496
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:936
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:6904
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTMon.exe
    3⤵
    - Kills process with taskkill
    PID:204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM Ntrtscan.exe
    3⤵
    - Kills process with taskkill
    PID:5084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmListen.exe
    3⤵
    - Kills process with taskkill
    PID:7628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmPfw.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM TmProxy.exe
    3⤵
    PID:1584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM PccNTUpd.exe
    3⤵
    - Kills process with taskkill
    PID:7396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - Kills process with taskkill
    PID:8028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM osceintegrationservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM OfcCMAgent.exe
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM ofcservice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1628
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
    3⤵
    PID:3272
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:7632
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
    3⤵
    PID:7436
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
    3⤵
    PID:3928
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5700
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
    3⤵
    PID:7400
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
    3⤵
    PID:8140
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5248
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5984
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5704
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3808
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5892
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:552
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:1464
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:1732
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5560
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:548
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:4256
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:5276
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4520
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:3412
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3280
- C:\Windows\BE4C.tmp.exe
  "C:\Windows\BE4C.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6464
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:692
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6176
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6156
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3132
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6172
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6888
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  PID:6360
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7148
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:6572
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4592
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7304
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:7312
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7320
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:7328
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:6836
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:6352
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTMon.exe
  2⤵
  PID:3368
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM Ntrtscan.exe
  2⤵
  - Kills process with taskkill
  PID:6536
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmListen.exe
  2⤵
  - Kills process with taskkill
  PID:6880
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmPfw.exe
  2⤵
  - Kills process with taskkill
  PID:6312
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM TmProxy.exe
  2⤵
  PID:7280
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM PccNTUpd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:2920
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:6772
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM osceintegrationservice.exe
  2⤵
  PID:7336
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM OfcCMAgent.exe
  2⤵
  PID:7500
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /IM ofcservice.exe
  2⤵
  - Kills process with taskkill
  PID:7568
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ntrtscan" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7736
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  PID:820
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:7476
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:6416
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MiCRCScanService" /f
  2⤵
  PID:7532
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\tmlisten" /f
  2⤵
  PID:7276
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\TMLWCSService" /f
  2⤵
  PID:6096
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ofcservice" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7460
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OfficeScanCMAgent" /f
  2⤵
  PID:7852
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\OSCEIntegrationService" /f
  2⤵
  PID:7508

C:\Windows\snotes.exe
C:\Windows\snotes.exe
1⤵
- Executes dropped EXE
PID:6672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 2.3MB
SHA256 c2bd89f9e2446c1fdf1d567765f7c7545f795aa5f1a7b7859a38abc9ff02ee70
MD5 27e8e43fbe2af0b59c5f7e04d60feb96
SHA1 b2108a3e3785f79f336a5ec92d1aa4eaaaf4aba1
SHA512 a3366519a33a06270b279deaeda9e090b2e42ff0f54e97082fbb967f8e93cdaef4cfb0a21fdeec7805e6a3dafb3460822794192d455db5d483e561c5e0f6035a
SSDEEP 24576:A2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSoJlh9bD8Rv:cdGXpiQSfKJiv
TLSH
T1F8B5E720A7109115DBAFD5B90AAE612C641CAD901F0391EBD1FC77EBDB79AE03D3418E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BE4C.tmp.exe

Path C:\Windows\BE4C.tmp.exe
Size 785KB
SHA256 7d2a192dc168a7f63431827f729694c186887a6fe5be2d7cdcc49e13091a692b
MD5 a19b8f91d8c03b2dbb424ef836f82790
SHA1 548a7a038252892262ab3465a4375606d6a263d3
SHA512 6f46f4536eb6504e23132f047c0be70b7f0a06265eed2e84fd28da09b9252ce8319e2c0780d693e9f5f660870c7be4abc0f770bd74e11cf04e263f4613b5f66f
SSDEEP 24576:v5ETsfZ1zANabPMBW5QHDOX5XysRmEzfTTW:x1RinDO44mEzfTT
TLSH
T105055C22B6F1C437D1722A389C7BE6D5593ABE113D38A84B36E41F4C5F3A6812D25393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\IME\svchost.exe
Size 3.1MB
SHA256 462df53549d74565e2833da5acb6a67909bb32a7eca424a3cd297301e5470237
MD5 0117e7d218f5efda3d4f17f21dc11544
SHA1 812a68fe31d169820066240829235ee04b7021b2
SHA512 5d3c911d27a681aa998619e94cf007807b9d0dc30a1f13348d19f43d9f2a6915d9d5e2b4213344519b64c1828dd83711458560dcb899378bb33f7f7346523abf
SSDEEP 24576:A2C9uYdnMiEEvp+5nzz5QBeOllR9+pf2NDJl/aLypQHbKZnfsSoJlh9bD8RX5ET8:cdGXpiQSfKJip1RinDO44mEzfTTh
TLSH
T1FEE52A20B7508025D7BFD5B80A6EA168541CBD901F1691EBA1FC7BEF9B396E03D3019E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.exe

Path C:\Windows\base.exe
Size 115KB
SHA256 e79865cb9fc8e0e264163c2a96479f96e732ba1e9e22cc1c562761ab0c34d41b
MD5 55979fd18ae7b8562dfe77819bb97fb2
SHA1 0f9b914ddf18abc43002ec0b5ae912d72293b294
SHA512 ab8bc73fd7e9167d02c91594f398028e5089c21f27377e02f81c8d4e80d56113f1026523c1101a82e0e76b51d328ef9f09e7b4aaa5aa780286045e9dfa826b25
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4:MGrqmt41pUdHApF+Oe4
TLSH
T152C3F825E244C0F7E4A300B26DFDA9E664D4783087CF10F7B3C59B69196A3F9423999B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part01.exe

Path C:\Windows\base.sfx.part01.exe
Size 253KB
SHA256 c52b503f6669c833820c92d66dfc3fb0a8781dbf9b9065e42b5d08696932ae93
MD5 f294b8ca88754b1e2cdc02d8765b7d0e
SHA1 64620bf981a8876563aa249a1a67c41e9e75b2d7
SHA512 0f8bc0f21886f7568e01d22eb9d3a4e72893f48ef9bd2bac984ceadeb1792fea9ba2a10d2115eae68b8fa4e856dc15fb80fa37626bcfda42036e2dae99918835
SSDEEP 6144:Mc0h522p3l04ZMSmIp3Uy28uhyOtF5R3:ahxp3lZnT9bD8R3
TLSH
T1FA44BF12BAC2C8B3D53218355929EB15A97C79200F69DE9FA7D40D3EEE301D06625FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part02.rar

Path C:\Windows\base.sfx.part02.rar
Size 10KB
SHA256 216bdad3ee7908ab436d4c921f93adf52ad73be7be186da66d96bfcf89bd24d9
MD5 a30552e931d79d550df1c8f9fce7fa79
SHA1 3a8a5ceadd2c6ab7a0c565223937de74750fe934
SHA512 ae096afbdfed88b6c17361ad1313ac996ff840b2289de4b6572e35dac8a8af7d6b006f2f76a37a28a225a03ec890119edd51c96705b9cf0fd35da34c927ba0cb
SSDEEP 192:uSEQ1ZSf7O11NCBvUaNCMRu2CCLg/3xVhffdsGyCeXcDU4hSHn68mDTWeUXI9MAL:B/1ZN11kFU1MsiLg/BvZ7IcDaHnDSWdD
TLSH
T11D22CFC4985D63F9D37B0235A822D38D7D34E583321E5832B4D98C279D518A89EC4FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part03.rar

Path C:\Windows\base.sfx.part03.rar
Size 10KB
SHA256 9e2bae5cb3c26a38f38a4364cdf708121e4aaa2f5519e67f6287e4dfa311a9bf
MD5 7bf0b2c4a28ceb748c7406556a61b698
SHA1 ed6704a932053909c6eaf27b134644cf449d3fad
SHA512 a36aa329b091804a6b4af8c56fd32fb7618aafa0e133753972d4f17a940e006e698750a10ac4423ef8cd3746202a0e17b99876f5b503a9c1edaad1e10e361702
SSDEEP 192:WSHqKYN/gKVMesSovtAkNAnJUFmyU+CyqSHhAUlh+YnJ6KvLusrnqSMb:hrMrVwSWtAtJqmcES+qcYJ6KTuszrM
TLSH
T18722C03B2098758BC5912A7198CF547B5401E9FABE317B96022B9E13BAA1291D1FF1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.sfx.part04.rar

Path C:\Windows\base.sfx.part04.rar
Size 9KB
SHA256 603942cfbd2c60faa571b4fc939c334636484d9c3825910252f7b9a503a4b020
MD5 d3a9c4f54c9d223227a5f19f80061c1b
SHA1 4a36584282dcb34201ff47f5c1ae291ad381a4e6
SHA512 c45ab824955a2c2efd67fa1c0b09bf4c233fe41d7f5dd2aaca584e742fc2be18b37f650f88b1b70ab2b4de8a35eebaf79a624c470d475277902dace10af1c018
SSDEEP 192:ttzpJJUdDREaz0lpH8DJw7EhzE+EH2Q1HfVkztVSihKRGgCp+qB8BdL1zZ/:npJKdDRSlNUf4RNfVOhiG5Qqav1zZ/
TLSH
T19712AF40656F5F2285BB3220EEACB390C72505BDC9DA6C2DE83976943311DDEE460765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 2.4MB
SHA256 724c082d5326fdd762b707cc4e0f851c301de095a280d1bfb9cab733e3a9cedc
MD5 27361ab41c7071fb802403f43513f795
SHA1 e21af7670491674c4d0b710c211e4f54a583b5ce
SHA512 e6da182bd0bf0cf1bca870a1ba7a71d37a8acf238efdfdcc9cdf9145529aaf94644f0cfb6b60a97508aa182769d5feed15a6ec0c7723ca7de72f4c58f4aab626
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4:MGrqmt41pUdHApF+Oe4
TLSH
T1DAB5F825E244C0F7E4A300B26DFDA9E664D4783087CF10F7B3C59B69196A3F9423999B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 1.8MB
SHA256 f003e25041096c4280ea5b902f237a593bca1bb3ea30a08f531c1e9b4a311178
MD5 deec8a889f860324cca0449a28347f70
SHA1 d0d3f9959bdafa568085cdc3132990f2b89c8b27
SHA512 5eb93a885e5b7cde9b7a556ccc91c32447793e3b35cd895198ed001f4b7b80136930a371730ad4f95bc75d1661473ffafd5e4883e2ce0e3fffa6b77b9af20d2d
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4:MGrqmt41pUdHApF+Oe4
TLSH
T16595F825E244C0F7E4A300B26DFDA9E664D4783087CF10F7B3C59B69196A3F9423999B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 70.9MB
SHA256 2165cbab45b00571333d4c492d743f8f478b4a8efaa0b9fb88ca8522f5a42bbb
MD5 a8852c21ad1feaac4f89250836e446e0
SHA1 bf5d8817a64eea1b4da0898854510208b493461c
SHA512 980d7b1aaeb7e70cad84b4c71702364733ecb2abd729cb02ea76da7f34f4f3dcf6cdb9b25c3e5661942a718185678b8fbb19cc4b032356268d18ed2e02f6888f
SSDEEP 98304:3vJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ0:q
TLSH
T192F7F148235D7CE4C2816BF4B34B9DC4702AFEB937D88DAA2DAC5E122C940D93575E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 320KB
SHA256 9030bbfe883fa3852430d19e7875b0e5f99983cb7a062d21fd1fbbca466b96bd
MD5 f6463422c50ddf7c5c693990fe5df977
SHA1 712c0fbf27cf4210cb33d6a1766c4e601783de10
SHA512 d1b7aa14423e82ea86ed57129128feb1aa10582c0745adfd209c0f4ec19107beb3b335ba4b8af364aa58e6f74df6b5270a175b2c7c33479a712cf086bb96a6cd
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4:MGrqmt41pUdHApF+Oe4
TLSH
T18D640A30A83135E0C02090B9275D48DE90F6F87A6F6D0DE3F1A19FDA95A79DC8474BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 256KB
SHA256 dc3d32b6d7f15d1456400905a1a4c3dfcf0e528216fcbc65900ff13a314ebf2a
MD5 6f19be21afc8766171b89fc24ae02e6b
SHA1 07033f25a4096d5ba5c24f96fe51a5f097c2fe81
SHA512 e83d7924a918c7d9c45541a0df1de655c96676873f83ad7c2d4f26a98ba939615977474f9063ed208fed707b88d18a1cc004d0b9db1a32aab02842d7669af99a
SSDEEP 1536:kNM4932ArSdqoHZLR11CcKfKuV2J45aupUdHApF+Oe4:MGrqmt41pUdHApF+Oe4
TLSH
T12C442B30A43120E1D06150B5375D88DA90F5F8756F6E0CE3F2A19FEA95A7AEC8074ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snotes.exe

Path C:\Windows\snotes.exe
Size 70.9MB
SHA256 784958347caa727dd3e2b75fc04c1c3e1c72945560a934844661d61811a40a89
MD5 2b4dc45e7423102705a3f4f8cc2be10b
SHA1 4c4609606ace016f33c30c1e871598c92e6072b0
SHA512 c5a09f41f0f75533832cac5eef25ec5effed2e21b877c38ce148b6a19b84074c04e22d786c0dd5f0d5055f9bdd20b1d9919d0bc4451165050be827daea548431
SSDEEP 98304:3BJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ0:c
TLSH
T10CF7F148235D38F4C2917BF5B34BDCC8602AFEBC3BD889EA2DA85E121C944D93565D6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1420-72-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1692-71-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2684-70-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/3000-67-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/3100-69-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4612-51-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/4612-59-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/4612-0-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/4612-1-0x0000000000676000-0x0000000000678000-memory.dmp

Download

memory/5172-66-0x0000000000400000-0x000000000070B000-memory.dmp

Download

memory/5252-62-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5252-18-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/6464-73-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/6472-53-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/6672-78-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/8096-77-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/8104-80-0x0000000000400000-0x0000000000431000-memory.dmp

Download