03b49ecfa19a76d34242d50849ec222cfbea1d7bf67e7bcf44dcc29d3619e894

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Size 4.1MB
Sample260930-d7estathqc
SHA256 03b49ecfa19a76d34242d50849ec222cfbea1d7bf67e7bcf44dcc29d3619e894
MD5 2e888e097907790ecb7ba2d0cdf59aa9
SHA1 e802802c1a6190ab72813cb6c8ebb5595ee78b96
SHA512 2581f42b526cb735d95048b33dfddeeb14a15b0a3528bec15ef9d5baf142e4c7aa78e9825cee0c1da0681fe7956129ad8dae71f65212bfe71087d008828cad69
SSDEEP 98304:RI42NLqv74CnJYE/RYIsfJ4kWrGvwb5/rn:YNEnJYE/RYIsfJ4FVD
TLSH
T1BD16E081B18580F7D472F67058E96BB64E78AE30577400C7B3B43D184A721E6F63BB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro ransomware spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 5 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x000700000001e6bd-583.dat
behavioral1/files/0x000a0000000243b0-588.dat
behavioral1/files/0x000800000001e6c0-589.dat
behavioral1/files/0x000900000002418a-590.dat
behavioral1/files/0x000c000000022af4-591.dat

Executes dropped EXE 19 IoCs

pid	Process
2624	elevation_service.exe
1840	elevation_service.exe
2604	maintenanceservice.exe
4320	msdtc.exe
4672	OSE.EXE
4004	PerceptionSimulationService.exe
1696	perfhost.exe
1200	locator.exe
1032	SensorDataService.exe
2592	snmptrap.exe
1900	spectrum.exe
4904	ssh-agent.exe
2868	TieringEngineService.exe
1856	AgentService.exe
2996	vds.exe
2372	vssvc.exe
1096	wbengine.exe
4420	WmiApSrv.exe
5040	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4a987065a26b1277.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000001700e-595.dat	upx
behavioral1/files/0x000100000001704d-596.dat	upx
behavioral1/files/0x0001000000017bd4-597.dat	upx
behavioral1/files/0x0001000000017431-598.dat	upx
behavioral1/files/0x0001000000016795-604.dat	upx
behavioral1/files/0x0001000000017039-603.dat	upx
behavioral1/files/0x0001000000017816-602.dat	upx
behavioral1/files/0x00010000000177f0-601.dat	upx
behavioral1/files/0x000100000000c534-600.dat	upx
behavioral1/files/0x0001000000023365-599.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0d3fe5b8d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8c2725d8d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ac7505b8d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd4f795b8d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045c48e5b8d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff998a5d8d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f05fca5b8d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeRestorePrivilege	2868	TieringEngineService.exe
Token: SeManageVolumePrivilege	2868	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1856	AgentService.exe
Token: SeBackupPrivilege	2372	vssvc.exe
Token: SeRestorePrivilege	2372	vssvc.exe
Token: SeAuditPrivilege	2372	vssvc.exe
Token: SeBackupPrivilege	1096	wbengine.exe
Token: SeRestorePrivilege	1096	wbengine.exe
Token: SeSecurityPrivilege	1096	wbengine.exe
Token: 33	5040	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeDebugPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1112	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	2624	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 1032	5040	SearchIndexer.exe	121
PID 5040 wrote to memory of 3548	5040	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1840

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2604

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4672

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4004

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1200

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1032

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2592

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1900

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4420

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1032
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f57cac299e14148e69daa435cccd954585d1e8bc39a259c79e40af9c3a49939f
MD5 e992b4bb717abfb615a13b4a8cb7d1db
SHA1 a5249c07faba50e43725a05aa3431525680c927a
SHA512 0718ed41d2bebb145e61e2ce839f1a8a645ba810dc480a4dd9978dff51a96835aef505faf19109453dc897a7d3121570c282b6d9a54a67bbec3d6d2f0cd94e06
SSDEEP 49152:yb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnzfJ4klKXn8:U3q6mjBIfJ4k
TLSH
T1B7D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 d4076fa6438203c5b12be130903db6eccbdd6cd1b705514c2d12d919eab6496b
MD5 dff149c22697dc9d21e16cd5aab0c8c0
SHA1 ec9c0e0a5a4ef7f352a9d47508c11af42754a7de
SHA512 49ea6ec24627c5db7bbf1035403413ab4b21a8b829d9801d15a5f636d1943dc8e6f54c541eacdd84f221600dde98ada878f897518cb925bfdab2d5fae6a053fb
SSDEEP 24576:kXY7DvczAMfJ4yL/tNCJPXUQrPcNTBt3byAUHWreGf+jY+JqRp5fl9NJn:HvcJfJ4klKXnUNltLyvH88YzRp5/NJn
TLSH
T1B775126963E004F9ED6B823C8DA1C101EA32BC854BB5E79B07E095656F733C92E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b02b26f0e5afa57e9e4546008924e15733113149454df9fd544b31febf4a1028
MD5 593e44f4aca9407c0c98184d06ff3e24
SHA1 22a5e64a80e99aa21490bd3843b6df606e5364c5
SHA512 75a3408843fac2842a0fca7fedc6a8a5b2e94f802fb124c3eca0d7965a0d947ef0a24dbbd58b157cf162538c762d60dd225cd7f1b8cb16eb5ac4866b3c4a4026
SSDEEP 12288:21XLsswWkxy2lRq2czAMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:0XYfDtczAMfJ4yL/tNCJPXUQrPc
TLSH
T1F205F12973D008F9ED67827CC9A1C101EB32BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ca35acd4022d1612ac91e6fe772cf0bc4c065475d79fadff2c4e60904e0c33e5
MD5 41fecb48ecb76bf1d2fddd248f62a038
SHA1 7b5c82e3b40f443b8918448ba9d7046a0f29fce3
SHA512 bca342eab1f904a67d4b781bb608131cfbe3ad7c0bd701594d7f3f50a2db8430382fad373969816513a571653d0c069bf5f299b600ec8c205a12b40896f944cc
SSDEEP 12288:Fmw5HEjsChNEBFgl0WDm+CZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTX:gwuROW6fJ4yL/tNCJPXUQrPr
TLSH
T16405014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5cb0a44b32dca8c9c17855d625c1c423e6f93863ae7194c264f8b20371d659ce
MD5 852b0a2d38aa47c3b7fa2a44b97b66d1
SHA1 c57bb4acc6844b22538ba921bcfd52446c5202f6
SHA512 aaeb88f523f43eca28d8d4df0097b97b54a1df0eeb9fe5181410a70e8d7f05df73b846026e098357a29e801cb865bed30bf6268f3f31056fe1ec6051c03cee0e
SSDEEP 49152:UB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glcfJ4klKXnG:Ou6JmIxd2dcfJ4k
TLSH
T124D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 c632013976c1be3755ea165b8423b430d471b4e379afa6ac069b8328c92c3c33
MD5 d2cb9388aed9b857d8a201b132854b49
SHA1 3eaf7f58554cc9a26b2c8ac5e2483519f064fa2c
SHA512 a59c149fbf160f65fa2c6e6409a32d7f366713c140b044904110c5f3b5fd80d216a424fd5e58529c02a90bb8e7aac7a0eac23560820d969c89936de3f0c157ab
SSDEEP 49152:4P4m4IpOO6708KpfJ4klKXnaultLyvH88YzRp5/NJn:QppOO13fJ4kgrGvwb5/rn
TLSH
T1E1B5D02DA7DC0096D0BA917886658A09FAB1742E2F3286CB1160933C7F77EE54F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportGet.docm

Path C:\Users\Admin\Desktop\ImportGet.docm
Size 775KB
SHA256 f2686df425ca1d29b0b237ed2aa8700c5b260b640c85b5bb53d3ab2ff90c15f9
MD5 e81f8a470770e9a186fe7e731db42b6f
SHA1 61b019b647b28db3ba8b166d6dc662b7b1bbafc3
SHA512 3a1ccea6d08a11c1d70112beffb26d1348939c415514bf61cee50d68b2bb8d14e291a0a5ac8550cf3d6ad094399fe9d986b0d4aff772030259a55bb0e10b988f
SSDEEP 24576:EYdZlj5wZvulTpSBa0o0azsxSzblm5xN67g:EYdZ1aZITpSBNo3KSzAzN6E
TLSH
T107F423B8CF1661E4C9957336ECB696E3896A1F5C0C87908681B5B39C15CAD2C2131FED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RenameRequest.docm

Path C:\Users\Admin\Desktop\RenameRequest.docm
Size 779KB
SHA256 73f7eb64370c6417454980ad94e61118aa753cdbb2311d4252c2fcfa7b5a5af6
MD5 d72a47a364470ea144c342ae72d7646e
SHA1 440255b1e3274c8c079d11de85c0aa45e62b5587
SHA512 7f908826bda045f80f44dcfc77f4260bd28ea7f3f49616e2a8eadccfd6eb46771d14c0bf7c0a95ac5ff30b0c14970390a15304b99b8d61297cf0db957ada9a23
SSDEEP 24576:5hweJ7jn6kPDMDag5gdCpdISrsDyxvXJYHzPAk:5J5j6SMZqdujADyNXJSL
TLSH
T16005335C2E92ADE4E51557B4B0FDA64891BF0B3309D7DAA0B315A3631EB90A70733227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartFormat.docm

Path C:\Users\Admin\Desktop\StartFormat.docm
Size 771KB
SHA256 a2ca79981abad4a73445faa630545931688ee1ea1c27761257ce926352e649ce
MD5 2588f91dd9d17d6a6fc0c523f6c24ee1
SHA1 a7bce0cb35a32ae754eea85c4611d6b8e409a73b
SHA512 4c14f12942c5357b7c58c0404a28fb27e71b64054252a7319c436b14b8d85906f1aa7e1b40c0a8743d1b6126355d75b262b767c69d7987a1658139c793d60a72
SSDEEP 24576:aqz6Y4sKuZTOSWrSxnwLKrFL7OSBSJA3V:aqz6uOsxwL+FLaSMJAF
TLSH
T1E6F43360DD3156B4F7715AF3416E2443690F189AACB7C6B142BA313D9D9AFAF20CF808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopGrant.docm

Path C:\Users\Admin\Documents\PopGrant.docm
Size 774KB
SHA256 a57715bc4f3aefd73cbef520a0a84f28b8b2769aef03ca12746c60d66c28fe16
MD5 e1b8be7cf55804668087bc3ddfbabf60
SHA1 56987652f7f705a452ba577719141e927019c088
SHA512 4ec22e9758a7dc7a89a743c339f8bdd10fc7048195548c5d777298ca732829502399ae69d573ec5eca3a37755878dcfa5f4631044ac3c9f5aa3734ffb1673a47
SSDEEP 24576:rYz6Y4sKuZTOSWrSxnwLKrFL7OSBSJA3a:rYz6uOsxwL+FLaSMJAq
TLSH
T1C0F43360DD3156B4F7715AF3416E1442690F18AA6CA7C6B242BE313DDD9AFAF60CF808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetSplit.docm

Path C:\Users\Admin\Documents\ResetSplit.docm
Size 772KB
SHA256 e4407d9d4328c12f133f0467a5be4582b65ca7d25abaf2f7fb1b4f4a23807dfd
MD5 b1f72d6be3106abb84eb06116e336bef
SHA1 6be52eedc74767d49cacbc446e370d887da0febc
SHA512 8e4c0111ab429be1a995248cbfc666f4ab6b75224cf7b8ba2a0a1c4be7238654f09d45c75290260d8e79c60ce74a8f2c3331c09cd587413084a034a7a83e5c5d
SSDEEP 24576:+c17meSWNlFG6kPDzDac8sUSh+GSYfkRXzTU:+cNFl1S77UShZpgXzg
TLSH
T14FF4236422DB1294F1EF8B79D0D6C26370FCE1D386693A37A66C471A2F46D3FA2050D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d3038f8f6ea650f7d00dc393842d9f49a6bc529965348359c5ac5c9dd104c225
MD5 004a824928926f5c63b84f803e09c396
SHA1 06bfc3b21c8677cf42fa56bb563706e74b7787f2
SHA512 1d54686bee9e16a5860ab902e3c85afec736a69fa141e663a59a857b2e655068e47317afd3a47fafc5f7ac950918742990969e3a3c7b1a51ae0c9bf5dcdcacf0
SSDEEP 12288:qDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:qDfJ4yL/tNCJPXUQrPq
TLSH
T1F2D423AB61D8D446EE7687F81648E00093097FD55B2BA2E7EE42B4853FFC9161DAC313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6ef83642dddd113b4e8053db3a04c9ec5e1ddf668cc93a31c75cab7d4c81236a
MD5 1cd02b742777f4f65a370577b1f8e0dc
SHA1 25e9e12ec5c2ceb20a247573ad244ae84db0221c
SHA512 82b04e6693a2839064900abb6c72bcc522363ded58321efcbd7a19102cb0a9a9f37337a63d89c0c3922ea78f03bdc9449161e47da2c22a8a76117593d80be2cf
SSDEEP 49152:Wa0h2GEkuAe73q3pp46zwwQVfJ4klKXn6:Wa0hNYG4JwOfJ4k
TLSH
T1B5859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 1abf1100613bc569668b6c1291e305ecc61955ba43aa9222108170059f015e20
MD5 080d43bb601d33c794761b5feece9b6d
SHA1 1ce6be71dd3a0382c9b8c7be0971c7dc0f0340fc
SHA512 c8a650ec3a1e8adaa0a5254d6c5b8feaa3d0b5cb68f9ca209e67e5c32ecc997af2d4bddb010be7ddc961eb3b2d0c2b05ce3d356f2971587adbae139d6efcdd15
SSDEEP 12288:cXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:cXfJ4yL/tNCJPXUQrPs
TLSH
T11DC423EB6084948ADE6587F81A48E001D3047FC5272F62E7ED42B4867FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 57e526240453fe97b5aae7cd6f44cd5abbe8c91210ee30cd36bcf6172383d631
MD5 86cf956116a3d147f8a4b643ca0c2da2
SHA1 189d9123fbc7bb95903826b03b701f36c3638ccd
SHA512 93d1551d2ffbefdbce478fbbaa5c32e7307bc8c40173d90ec7a79cf50e7d51411fd1c3928e2898ee92954c8dde999907a4cd473ccd0e1b4e01f0b576f3e2a725
SSDEEP 12288:oObIA4LWOsvAYFTMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sj:FAL3UTMfJ4yL/tNCJPXUQrPA
TLSH
T12125F155E29400F9ED6BC27C89A5D512D372B89D0324E3EF07A88A652F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 d1851feab0f054d75b80fe028bef198be4b0e661e420e55cf5b698b2ea288562
MD5 7f976ff68eebab9ed40582cc704072c1
SHA1 4e6e634a9ee4195aca48be29fabae128cf6deb77
SHA512 0aa3f6e600a1225dfdd7534c11dcf3241cd279f31977bb8df5808059d73e3b65cd698a51261a029861ecaa5509b0011b86d883f5914e887b93557bc5a0633977
SSDEEP 12288:KpFtvOAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:uOAfJ4yL/tNCJPXUQrPA
TLSH
T16EE4026A32DC10E5E576927C4A85D209D331BCA6172653EF46D080AE2FF7EE82C3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 545d83ce8c46634231ef77398af03e53a32b1c2fb7d1e99cebaae4fb55202296
MD5 ac8c0f2b65be6b0c2d495b63104ace7a
SHA1 24987b2ff17c57c2ecd52f3e973e1fd32f77ff01
SHA512 883d0abf2658f46ab242827c6a612dddf236e68b9c0957a40bf1957ceb254349fa3a5c09aadec98031f1c1063c70369810fcba6dbb34b890c904fb098a663d1b
SSDEEP 24576:77NM9YqZqmWMUkPjZM48Mv6bEhsTfJ4yL/tNCJPXUQrPA:77cBWMpPjN8DbEhifJ4klKXnY
TLSH
T1B865AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ba91c8993a9463cb77cd1e1bb38ae16f737167a14f16a25ef14a372bbdf14d50
MD5 ca3ed4e7bbdbc02eb973ec3613eaf6dc
SHA1 8ec89123ed1a50b1324612c18b39e9edc77dabf8
SHA512 9bf2bd3d25cf853c28c029cbc8d389d0031ce1dc3308efd8f5d5266634a6609caa4a0834b5fdfe9a5c291deebe5bed238f0db3474ee333a5462d3c452f8f1656
SSDEEP 24576:pW6BApg2YuyuNDYTabvcdvNYf8km1RfJ4yL/tNCJPXUQrP0:pF2YuHNETovAvNYf8kmzfJ4klKXnc
TLSH
T1AD858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.5MB
SHA256 fdddeac80bcb3b99011ed25483142eed88d994222e9916061e1f259b05d55c94
MD5 e5d1c34d119c2efc2b8cd4174fc72735
SHA1 4e7cfcca5465f0e39034dfcb0c7982cc0ce5c96e
SHA512 f1149718184c6c13e0f92c928155bdbf5ab900a86692777670e90f87cb4ae9e7d5ccb0fb62ec36edf46c4d482cb97df6c45cd35cd61c1b980f4492790fba86b4
SSDEEP 49152:AF2YuHNETovevNYf8kmzfJ4klKXncVHltLyvH88YzRp5/NJn:V6jCf8kAfJ4k1rGvwb5/rn
TLSH
T17AC5B06A27ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ddba04ea0e2224edf1f9428421016a1379f68f4d8aa7686f71d4de0ac692a1c0
MD5 5f2dce3f7d680d4cfb741f0df1196dcc
SHA1 f1f6b9be72b1a4215ae779e071351458996aee30
SHA512 d5305c1b32f702e544afcda3d682c246f03ee973d9654d2414c3db9121d21f5359d5c6d08478a0b78f7b2bb25782c3358270c1bfff95594f6c192148652d4e78
SSDEEP 24576:RAFs06+Omlf8NXEbTo0fJ4yL/tNCJPXUQrPS:mFs060loXu1fJ4klKXnq
TLSH
T18165AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 80bbd28714bbd3b996787e0a96abb9470b46a39ea85c80e5a6770ce06c32cdfe
MD5 8cfbc58ab3fcbd78b81e69e4a4f97ec7
SHA1 00ca7884cb55d8d16960eab7688e45bbed2ab135
SHA512 5f52e0e4d45bc0df9241b95efab21983c7356b826d732b75b27640688ca91330794a683366557fe5a29862808e7baed499ef3d813f02918f44bdc88086e22091
SSDEEP 12288:QCJnJ5D3VkrDzxzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:lJnJ5D3WX1fJ4yL/tNCJPXUQrPT
TLSH
T1B915D02DD2A810E8D4B7C3B482496746FF72386D2F226AC768B4D4353F16EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7f36ca693817af2a722af729d0c77724571566e623dd1c7bde16d58e6640ef04
MD5 be30306dddf3818802387899a1068d23
SHA1 1a094c1702af5a40912854ce17069ab72156b048
SHA512 67bb6024203f5285b68c726480229e5f4b03fa5174aeb73c5dbdf3438ed64d534fc7954c68c4c9317ede9498c8a71dc351b3eefff01f3a34f1af6d7a644c0865
SSDEEP 24576:pEPghm6/7IIXdwcXrif7qQncjlP65i3Vu6fJ4yL/tNCJPXUQrPm:Og06DIKdwc+eQnSt65aVffJ4klKXnu
TLSH
T1B0955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 fdbd484ba056db8de3e758627f0d29dd9b46e5c2a4cbdf27050ff2b25c08dfa5
MD5 2c72ea77b8d8d6b8dc8673b504effc39
SHA1 ce29755e732a79f3537cbaddc023bd57762cb41e
SHA512 d47e3012cae8eacbface482f74043bcddc8bd1ce81c53e8b7e4397c5c64184d6b462399d99310aa5d2a8b1faf8d35b5da4cf0b55a65fdd994de405c06c4de652
SSDEEP 12288:TEP3RiRrgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd55:YiBTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T1BB05125E13EC20E5E17AA23945A14205D7B2F0652F6627EF18E0C27D9E737E62E3CB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 13695b05365be6498e5c845f05f16b0f11fc1487560ac10eab5734dc80b7069b
MD5 ef33217cab8b706ec049516b3d1a527f
SHA1 e19c4b60677bb474c501075b19a571aaa1777279
SHA512 6e44bfe2c654f3843b9a185a54b13a13fddf6cdeae4ce05ffc0f16165a5323b5dd01715df385bdc8dfefe383acd77bb03efe029572bbe06e20a46142595220ff
SSDEEP 12288:LjkyyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S/:LIyyfJ4yL/tNCJPXUQrPY
TLSH
T11FF4224A23D4A085DAB647BC4A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 d2c1120d5e5fd1788f1c1c7127c0865357ab2d5fcb54cec84e47d4b7cd68b6d2
MD5 82ea689fcab9a78378f97358cbf94cd5
SHA1 a4023f967def00e9231ac3af907213f8b0ec7ece
SHA512 a11135587588877bdadbece2c104dad7301bd89812a597e6dabc1a95a7fd5659f558d42e1878d8d710cac53d8e089e4b46cd8d8ec1f4fba865f71ef23f530213
SSDEEP 12288:mywfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:PwfJ4yL/tNCJPXUQrPi
TLSH
T1C1D423AF2095A08ADE2587F80648E100C3147ED5272B62FBADC2F4A17FFD99615BC791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2452f28e5fe7723ccb549acf01dabd8044c41083dc90dd39286077880e8cd4a5
MD5 d4c930eb25ce7c56dd3dfe6ee353be76
SHA1 5b444d958fa08f0f72f3bca68a3e39edbbe0c21f
SHA512 4151d8016f68773b2d3ab339bfab6468e7d3d7105dd1a1d53be1853b9432b05af9b6d4df6b0c754b4943131f0dff4e1fbc48af5eea2d0df8a43299732e51b031
SSDEEP 24576:iQ9MxZKdcz9dw3bfJ4yL/tNCJPXUQrPj:iVKZbfJ4klKXnL
TLSH
T18E558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 ebbfec0e695a09dd5df640ae4a3a7ac6a4b1afa6c49362ee3809297a95c517eb
MD5 7b3600271e497b5ab855d8ec82894a0d
SHA1 ec5fdd70585c2165f15c77cb3e8808927e68a4ff
SHA512 f91fa9a48547d83ed276135b3206f82a86d7d5f9050dd64a1f5a888fb5e9ad89f79c0147672148cf9a4167676e6d883d1ef5b6644ac8c298252fc24bbcf93d2b
SSDEEP 12288:syoKo2JRple9pWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:syocDApWfJ4yL/tNCJPXUQrP4
TLSH
T16FF4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2f8f4fbc36bbe0627bea5414e69e7c233bb23f5c48739e0252b8c8399148b47c
MD5 aaa2b2c7823e02aabba33d99985c11bd
SHA1 8ca7f966f3233713a8afca1322edbda13c683bff
SHA512 5383baf95342608923ce9eee67ae3ad24a58abf30e1c10660f49e8d3a000b6b65eb42ea6aac0633a39ce4c179533d25fbaf21c67da90355b95ec39be44fcdad7
SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKWfJ4klKXnm:i0zuNIMfJ4k
TLSH
T15DA57B3DA2F800A8D9AAC379C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 5a6034433df351df52caed00480a6ca3b5d2e1e139241ea51233a9e1eec770f2
MD5 f1a766159ab8f4a6bab0df8f45b1e42b
SHA1 ce3608c8d3015106c8d60e23450afe57cd155e88
SHA512 33b4f6f7105022e34c4682217ea4a2117a34005ea99623b1b10cb4805b53cc9fca203f6bd58e0a4abdc897f6340424442a396598a06abdcfdc5cd3b8b081efdd
SSDEEP 49152:ga0h2GEkuAe73q3ppj6zwwQVfJ4klKXn6BltLyvH88YzRp5/NJn:ga0hNYGjJwOfJ4kPrGvwb5/rn
TLSH
T1B0C5D01E67EC82B5D0BAD278C9A6814BE6B2B4160B3156CF1191853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 852b0da73796fb10a428fcdfc601692ec839813ff8ae268436e85cce36a300c7
MD5 ae18e02c2ad853a12cc2323625921277
SHA1 88ea7b306ec08c8bc59b3c28b44ef82ce16e7dad
SHA512 99e5e3ff0d38f724b4cd9278cfc87966e90a80ee9950aca65c8c0d284f2213c8e81cd9bc47abd4c158cf51506968c6596fdd5528f80954d5a450db7edf21f2da
SSDEEP 24576:31QT7EcpfxR+N5AWAz3ooiYhjMqbcTBt3byAUHWreGf+jY+JqRp5fl9NJn:KTDxR+N5YzTTjMNltLyvH88YzRp5/NJn
TLSH
T18B75C02EA7F805E9D1BE86799B23C512FA727821073193CF42A0C17E1E675D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 716d129107b48e0505410df77bcc7c716235cb40f81b07102a6280e6dd6b0157
MD5 4557a41fae197a483b3becf05bf71389
SHA1 e4784b2db1a394579341c09b4711723c5bd48dba
SHA512 2732e3770c94050ac3491c5edf781b83f3fc6e653624acb90a5fe7892e72293efd87416bfdfe2dec97b84f9aaf68e389153bf007802aec41a8c8806d17ed386c
SSDEEP 24576:IhbHjPSTBt3byAUHWreGf+jY+JqRp5fl9NJn:IhbHjqltLyvH88YzRp5/NJn
TLSH
T1720512AE12FC10E9F175A23C46A24206D771F8161B2297EF25D1827A9F33BD22D39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 357a88f3e2a207e3a39871e304c715331e874ddf0d3d746bc10c3dec93b89116
MD5 0cd9b11c14dbd712015c4f455c4ecd69
SHA1 413ea51c5b6d1552f7bccd8ae0e3f3a8c2f247da
SHA512 cf35697276a0470fda62e759b9698f1d5f9cc0d59d0be441bbd620631d76291bd957f7e4eda98148e97224a52357e7d66f24d15936cd4f2d7024447717527677
SSDEEP 49152:b0K+7mSL9fJ4klKXntQltLyvH88YzRp5/NJn:UNfJ4kTrGvwb5/rn
TLSH
T18175127E63AD10E5E47BC27C9A42D506E67278A6072266DB09D0C0797FABFD4393DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 c2386a18e91e3c2918e66e45dde29d65d33dc83706290ced1da1f0ffa42e903b
MD5 b7f246a0dd1faaaaf39bb410c78d5536
SHA1 58cd3574b7071ada744854627ada239093f0820e
SHA512 3b1418de9d09182ce7b6c088b9aa5f8f8498b2ecc8f0517ccc9a4deb9713209edb06ae340104936af7ab92698f45046aae691893789f90000815095c03f30af0
SSDEEP 24576:pBYgnJcRTk4yti+R5dUR/ETBt3byAUHWreGf+jY+JqRp5fl9NJn:pygnaTk46pUR/EltLyvH88YzRp5/NJn
TLSH
T1C565C02EF2B910B9D8AAD236450147B5BB71782D1F219ACB0170C538AF16FE85E39F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 655404832b1e55afb89e3199706098955ed2bf36d004118865220b5bfe52c280
MD5 8d30f247982a95e035056ab558dc82cf
SHA1 28730e0a4657d65b1d53d36644b040f99e5ba04d
SHA512 aae8b6f8c9215a0f04adcedbb8c8ff0c7dd9f79c8460396018986ce56b60ed5f33ea9d607c2ac8e0111729ab892c3fc26f2b3f627fb1ebea0a7ba5278b31044d
SSDEEP 24576:XMfJ4yL/tNCJPXUQrPWlTBt3byAUHWreGf+jY+JqRp5fl9NJn:XMfJ4klKXnulltLyvH88YzRp5/NJn
TLSH
T17765238A12E82095E876A7780B6491018630FC962B7B62FF2CD0D47AFFB67D7253C715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-126-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1032-357-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1032-181-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1096-454-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1096-174-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1112-13-0x00000000039D0000-0x0000000003A37000-memory.dmp

Download

memory/1112-20-0x00000000039D0000-0x0000000003A37000-memory.dmp

Download

memory/1112-76-0x0000000000400000-0x0000000000EFB000-memory.dmp

Download

memory/1112-0-0x0000000002B20000-0x0000000002CD0000-memory.dmp

Download

memory/1112-1-0x0000000002EA0000-0x0000000002F25000-memory.dmp

Download

memory/1112-8-0x0000000000400000-0x0000000000EFB000-memory.dmp

Download

memory/1112-6-0x0000000002EA0000-0x0000000002F25000-memory.dmp

Download

memory/1200-177-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1200-122-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1696-173-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1696-110-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/1696-115-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/1696-118-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1840-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1840-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1840-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1840-63-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1856-160-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1856-162-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1900-138-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1900-401-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1900-132-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1900-141-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2372-452-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2372-169-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2592-356-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2592-129-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2604-72-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/2604-66-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/2604-77-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2604-78-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/2604-80-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2624-51-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2624-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2624-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2624-41-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2868-157-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2868-450-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2996-166-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2996-451-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3548-474-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-493-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-501-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-502-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-503-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-504-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-463-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-464-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-465-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-466-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-468-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-467-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-478-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-477-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-476-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-475-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-497-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-473-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-472-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-470-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-471-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-469-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-479-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-480-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-481-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-482-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-484-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-483-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-485-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-492-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-494-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-499-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-491-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-490-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-489-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-488-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-487-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-486-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-495-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-496-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-498-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/3548-500-0x00000248EB410000-0x00000248EB420000-memory.dmp

Download

memory/4004-106-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4004-103-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4004-97-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4004-168-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4320-159-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4320-82-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4420-455-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4420-178-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4672-92-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4672-95-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4672-86-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4672-165-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4904-431-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4904-151-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4904-154-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5040-235-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5040-216-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5040-182-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5040-200-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5040-456-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5040-461-0x000000000CE90000-0x000000000CE98000-memory.dmp

Download