63c21f810e6f20652741ca91cbf6d127d815fed9ad963dff3fbbf21ddfc145bd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Size 6.7MB
Sample261012-vcvdfst16m
SHA256 63c21f810e6f20652741ca91cbf6d127d815fed9ad963dff3fbbf21ddfc145bd
MD5 8916c1401868bfcf2c383f12e1b3e5ab
SHA1 f0eeca298a61a0c763bd42779442bdc481291641
SHA512 1c4652c8d20012a2c154ce6e48343dbf63d0efa52c179c45dd5ab95f3f5a99edd4eac334111f8255f0e267a21251e6bff9379a57f75c8f89b9bfa6c087b3b912
SSDEEP 98304:EB4BjfY7QDgILVjVoqcBjQ3JyxkCJqe8+tGfTlzNgaPJ:EBMBxrokCfazOax
TLSH
T11D667D207786C4BEE49202F05F2DEFBF445DAE250B6440D7A3D4BA5D2971AC31A32B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
3696	alg.exe
3304	DiagnosticsHub.StandardCollector.Service.exe
2580	fxssvc.exe
756	elevation_service.exe
3552	elevation_service.exe
1928	maintenanceservice.exe
4308	msdtc.exe
3984	OSE.EXE
2208	PerceptionSimulationService.exe
2492	perfhost.exe
1460	locator.exe
2892	SensorDataService.exe
4700	snmptrap.exe
1968	spectrum.exe
3112	ssh-agent.exe
2384	TieringEngineService.exe
1100	AgentService.exe
3536	vds.exe
1828	wbengine.exe
1680	WmiApSrv.exe
2348	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c4ec1d93862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4360_689100145\nav_config.json	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4360_689100145\manifest.json	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe
File opened (read-only)	\??\PhysicalDrive0	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5132	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009023e7f8695add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000915d26f9695add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003e810f9695add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f834cf9695add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052a953f9695add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e15964f9695add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002468a8f8695add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e61b6f8695add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003651f0f8695add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{A9D6F20C-2FAB-42D8-AAA0-10E4DFEBA694}	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
3304	DiagnosticsHub.StandardCollector.Service.exe
3304	DiagnosticsHub.StandardCollector.Service.exe
3304	DiagnosticsHub.StandardCollector.Service.exe
3304	DiagnosticsHub.StandardCollector.Service.exe
3304	DiagnosticsHub.StandardCollector.Service.exe
3304	DiagnosticsHub.StandardCollector.Service.exe
3304	DiagnosticsHub.StandardCollector.Service.exe
6104	msedge.exe
6104	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeAuditPrivilege	2580	fxssvc.exe
Token: SeBackupPrivilege	2052	vssvc.exe
Token: SeRestorePrivilege	2052	vssvc.exe
Token: SeAuditPrivilege	2052	vssvc.exe
Token: SeRestorePrivilege	2384	TieringEngineService.exe
Token: SeManageVolumePrivilege	2384	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1100	AgentService.exe
Token: SeBackupPrivilege	1828	wbengine.exe
Token: SeRestorePrivilege	1828	wbengine.exe
Token: SeSecurityPrivilege	1828	wbengine.exe
Token: 33	2348	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2348	SearchIndexer.exe
Token: SeDebugPrivilege	1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	3304	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 4460	2348	SearchIndexer.exe	114
PID 2348 wrote to memory of 1160	2348	SearchIndexer.exe	115
PID 1104 wrote to memory of 4360	1104	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe	120
PID 4360 wrote to memory of 1372	4360	msedge.exe	121
PID 4360 wrote to memory of 5132	4360	msedge.exe	122
PID 4360 wrote to memory of 5148	4360	msedge.exe	124
PID 4360 wrote to memory of 5140	4360	msedge.exe	123
PID 4360 wrote to memory of 5148	4360	msedge.exe	124
PID 4360 wrote to memory of 5140	4360	msedge.exe	123
PID 4360 wrote to memory of 5140	4360	msedge.exe	123
PID 4360 wrote to memory of 5312	4360	msedge.exe	126
PID 4360 wrote to memory of 5320	4360	msedge.exe	127
PID 4360 wrote to memory of 5312	4360	msedge.exe	126
PID 4360 wrote to memory of 5312	4360	msedge.exe	126
PID 4360 wrote to memory of 5320	4360	msedge.exe	127
PID 4360 wrote to memory of 5320	4360	msedge.exe	127
PID 4360 wrote to memory of 5472	4360	msedge.exe	128
PID 4360 wrote to memory of 5472	4360	msedge.exe	128
PID 4360 wrote to memory of 5472	4360	msedge.exe	128
PID 4360 wrote to memory of 5480	4360	msedge.exe	129
PID 4360 wrote to memory of 5480	4360	msedge.exe	129
PID 4360 wrote to memory of 5480	4360	msedge.exe	129
PID 4360 wrote to memory of 5756	4360	msedge.exe	131
PID 4360 wrote to memory of 5756	4360	msedge.exe	131
PID 4360 wrote to memory of 5840	4360	msedge.exe	132
PID 4360 wrote to memory of 5840	4360	msedge.exe	132
PID 4360 wrote to memory of 6024	4360	msedge.exe	134
PID 4360 wrote to memory of 6024	4360	msedge.exe	134
PID 4360 wrote to memory of 6024	4360	msedge.exe	134
PID 4360 wrote to memory of 5232	4360	msedge.exe	138
PID 4360 wrote to memory of 5164	4360	msedge.exe	137
PID 4360 wrote to memory of 5232	4360	msedge.exe	138
PID 4360 wrote to memory of 5164	4360	msedge.exe	137
PID 4360 wrote to memory of 5748	4360	msedge.exe	139
PID 4360 wrote to memory of 5748	4360	msedge.exe	139
PID 4360 wrote to memory of 5748	4360	msedge.exe	139
PID 4360 wrote to memory of 5800	4360	msedge.exe	141
PID 4360 wrote to memory of 4812	4360	msedge.exe	142
PID 4360 wrote to memory of 4812	4360	msedge.exe	142
PID 4360 wrote to memory of 5956	4360	msedge.exe	143
PID 4360 wrote to memory of 5956	4360	msedge.exe	143
PID 4360 wrote to memory of 5928	4360	msedge.exe	144
PID 4360 wrote to memory of 5940	4360	msedge.exe	145
PID 4360 wrote to memory of 5928	4360	msedge.exe	144
PID 4360 wrote to memory of 5940	4360	msedge.exe	145
PID 4360 wrote to memory of 6184	4360	msedge.exe	146
PID 4360 wrote to memory of 6184	4360	msedge.exe	146
PID 4360 wrote to memory of 2728	4360	msedge.exe	149
PID 4360 wrote to memory of 2688	4360	msedge.exe	150
PID 4360 wrote to memory of 2364	4360	msedge.exe	151
PID 4360 wrote to memory of 7004	4360	msedge.exe	159
PID 4360 wrote to memory of 7004	4360	msedge.exe	159
PID 2348 wrote to memory of 7132	2348	SearchIndexer.exe	160
PID 4360 wrote to memory of 1840	4360	msedge.exe	163
PID 4360 wrote to memory of 1840	4360	msedge.exe	163
PID 4360 wrote to memory of 6656	4360	msedge.exe	166
PID 4360 wrote to memory of 6656	4360	msedge.exe	166
PID 4360 wrote to memory of 6560	4360	msedge.exe	167
PID 4360 wrote to memory of 6560	4360	msedge.exe	167
PID 4360 wrote to memory of 6972	4360	msedge.exe	168
PID 4360 wrote to memory of 6972	4360	msedge.exe	168
PID 4360 wrote to memory of 6104	4360	msedge.exe	172

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ccleaner.com/recuva/update?v=1.53.2083&l=1033&a=0&lk=&mk=F37G-N6IR-IZ76-52V2-YICT-5F82-JRDS-9BFI-9C3M&o=10.0W6
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffa189cc188,0x7ffa189cc194,0x7ffa189cc1a0
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1844,i,13208143650930221540,14232291538766789362,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,3719171298136376069,10494963685626609507,262144 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2288,i,652207064260014097,13116142081177669161,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=276 /prefetch:8
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,1097125458887374318,7448925214806603254,2097152 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,15826872612620160710,1335617999651842625,2097152 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,3747876140395018784,2724102924043645914,2097152 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,387555277040910450,7863926324910977242,2097152 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3608,i,8466094279681128824,6090704236868673795,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5248,i,9197924386324657267,1279871394826513247,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5396,i,14532349463953430409,13636221681217626762,2097152 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5564,i,12286681238443242110,5929042332962607510,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5560,i,7248748547333380995,16046918609289967231,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6156,i,11645800321578321862,9482545654007361680,2097152 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5352,i,17899872856754146356,11748144681596695350,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5352,i,17899872856754146356,11748144681596695350,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6404,i,9743086330392938783,6987057519899817163,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6548,i,12475423579834133208,6800539743862960152,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6620,i,13086310860752697176,18242206982789541868,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6412,i,4427596965474910427,8673868963174272843,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6692,i,6897250074624971112,10429534639420852135,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
    3⤵
    PID:6184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4204,i,3749694317951349430,2554393916147162175,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5352,i,5023490794050768584,15078831368023419678,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5152,i,6117392983539903031,14207876282921439757,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5700,i,5199630893006776304,3746264673176843838,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:7004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3724,i,12577706131022663989,17922894213172262975,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=864,i,13208680458832048893,4033389456963830492,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
    3⤵
    PID:6656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5612,i,15356456873364265474,8209567687389817746,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
    3⤵
    PID:6560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3524,i,12883657990521901485,12680978813798348890,524288 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
    3⤵
    PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5836,i,14419021400546379044,15299398263107299703,262144 --field-trial-handle=2348,i,13466050744210348965,10155009348395962434,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6104

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3696

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3356

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3552

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2208

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1460

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2892

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4700

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1968

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3112

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2236

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3536

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1680

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4460
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1160
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-747854149-4118156852-591593384-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-747854149-4118156852-591593384-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:7132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 390eef1de3c49304fb649628e6f9fe2c6c892c03e5baa1a21cce5cb1f8b25b2f
MD5 9d608117e378206565194e4e2c076389
SHA1 678e93bfb08fd19336a9a3bc825fcde4c60b3512
SHA512 2778fa6fed8067b3377a1fd3651048efbbab2ae5330447daaa79ae99b1b49640ad5232b977aa54e767ea611ab5048221c581799b84aac66a7ddde50ea21c1c05
SSDEEP 49152:wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnb+tgauhwbR3P8wT8:a3q6mjBDgaPJ
TLSH
T1C4D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 62a6a6dbac5e76d955b4cad7a9412f79514d7d0222bcc7ea5f5dbab65cd7dc0b
MD5 ca55f2ad7be1fdde0596830933e729b5
SHA1 994910005f787e433b6fc635d033a7365ec27555
SHA512 159f01aeb3bf3dd526bd2fc11e212da145a9c3e2d64206b99b51b22cae03ad75a1e5274d0fa7920d80bd5d2aec1e32595c6033f2aca3c586721f05a2d5708d0d
SSDEEP 24576:FXYfDtczA0+4ZAgayjhwbmY3MaReFeDvSP3b:Qtcx+tgauhwbR3P8wT8
TLSH
T1C575F128B3D408F9DD67823CC9A28511E673BC954760E78B03E4AA655F337D84E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 d256fe129301d3e7bfaebdbcedf4098e71c516a052e1b7033b386f6e0bbdd86a
MD5 dc56793fc830586daa410850c54fc3b1
SHA1 5de4d09ff1d2c765b94f79c8d69b07e93e8f7bad
SHA512 14a5837492f9931c59a72bbc0b4e842207254640786381f2730850cbab5fb36db3250e805334f96a87d28b53ec46fdd6753c48b100311d20b37c4e31d2747f6b
SSDEEP 24576:D0Le5ji0hmxSrMj+4ZAgayjhwbmY3MaReFeDvSP3b:DPji0Aoe+tgauhwbR3P8wT8
TLSH
T11A95AE15F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a0be2b7e0245f7730b9d2145683c8d6099e4b55ed7c476aa8e9a3d2f09ee9e3c
MD5 594878c9ed971e285befa58c585b795d
SHA1 ceee567db51307197fa9c8fd05cdb5efdf19c95c
SHA512 2ad9011792e5d6cf80f703ad12a48f3a0b4783c60c8a4b6c90687c3d7cab926fe590165a66eba5af3087363ce2861732279b5108a84096368ba74111ee5b0fea
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWj6q8wyuB+4ZAgayjhwbmY3MaReFeDvSP3b:g/ezSC6vUzPv+Hjyi+tgauhwbR3P8wT8
TLSH
T16A756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d0ff2a59f4c8982dbc137ad3325da66b451babfd7a1190cb5ba2023b4e8c2cc6
MD5 9dc4086578a9870aecfb14fef1d195f9
SHA1 559d6d357eec7c237a32233388e4967d39142618
SHA512 600753b8452a9930d8784121e1d1a0be30f77e3fb796a9c58778d38439b66aefae2148703949a3008a8b1d3871b4738f74aed41ef950e23dd6cc3a462459446f
SSDEEP 24576:vVbqPb88hv/l+Bg+4ZAgayjhwbmY3MaReFeDvSP3b:vVO88hXl+++tgauhwbR3P8wT8
TLSH
T129559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 3e292ef339a429bc7d9b797a52c07701433e0f2e2eb8ad60ba2725c9a9c85ef7
MD5 02a6c6757289fd4026259521340ffa6b
SHA1 2deb006faa0e0f44acfc5af206e715248bbf228b
SHA512 1a56e200b1c107710616fa80bf8783c2c316c255ad31c4815e6d448dd9c3f13acd6f999ed92bb3e4de063fcd938a3c75c3f45e99ab0b85322a626d4f86440532
SSDEEP 12288:wqKeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:wqf+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T13C552381D34C98CAC77B0B308BBA09607699EFC61E85A504E4C97BD9CCB0DADC6B5395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 dd00c1435f8366633541fc7c3899d61e1daf50f42d635f026186ce73987a371f
MD5 edad2ca9f1db5c89ee7bc0ee3a84ae45
SHA1 09f863bbc128324f5d4a19077d217ee267221a35
SHA512 ef2500f77d436e26bf2817f6aa7d40ed15731206efbd2e23195cab6078a0b6bdb08db0e5c65fc259b5ba60d339ebe4de35d956b26b2a93ba134e9497c60ee601
SSDEEP 12288:qeBNUbTVO86UteH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:qJIUo+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19975CF3BEE28FCD2C27E4DB85B918600A76278704F52A3CBD165830EDE235E54E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 aa27f799285468ef768bc7f5374608c9da3a781f9facebf9a3d8590d13496083
MD5 2e717d7649a6d266fafba05cd19154d5
SHA1 e553363a4205f3d81644acf2987674ae35e82022
SHA512 9e129b5237f3779fc8b56eb548ee1ead32742ffed7195dca307aeacb008c531a412995ecc66c94cc1ca544d00983a743f5fa972d84ac9b076c2aacbbca715c09
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH:hQvGAdlCEL8c/WRNw5C0gaPJ
TLSH
T1EB266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 73c1f54255ba3a3e5b72555ead8431fd8600dbba31df672f66118456ab9c6902
MD5 61f130a97d3ed20fc093d2a4dd376ce0
SHA1 07df267d1bedb024d6a083e4a8362d1b84e6bd7c
SHA512 69ef5799cefce42c07edff649569327064a8053d0fd7145865cf8a2a51809e08a7f5aabace9ea8210a99175a9d3d35a7c5f4f601adb242f910595cfdd653602c
SSDEEP 24576:4uewsAju+4ZAgayjhwbmY3MaReFeDvSP3b:Llju+tgauhwbR3P8wT8
TLSH
T12485E031FA74E436C27B0DB21B36C712246CBE604F511AC3E3E89E9D99706D21776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c1970b6218adabc3d2f2e9de03567a1a0e121a73eb12398326ece6d70de6ba6d
MD5 abdb350e8d80b51ab86634d6a48ee99b
SHA1 3fc4ac786464d9f78e57d6570cba98ec5aaf2f74
SHA512 2fcd010a94781d67df7c5a1596f2ae644c1784738ad94185d17e51fc069a3d647317100976abed5e48a5f54b6eadb3ac4f2bdddd7d2e49e9b13d9a93116252ae
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHSax:wUEtQevvqc2W1cpV20I32x
TLSH
T1F1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d9c2def21ff00f60c542d6faf5a89af0a154451b9438a05932b894bdccd15e22
MD5 4ba435d1ba7c739977eceb8cea9c0a82
SHA1 7ea25067a1c0a0afb866f9092927b6bd3771c3e8
SHA512 3ee43344bee60006ec250ddc573ecfdda752450cf13fd9b84f9ff7bf3d0e16d02592319e5cfe460f9f94d430b696d92de83476dee7eb8fafa3e045b11d2796da
SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/zO+tgauhwbR3P8wT8:soqtVjnmIgaPJ
TLSH
T1C1D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e229044377261f87c8ce83dfcd7e67a554954a5667e27bdb11af5f903a818eed
MD5 1182987e0ae2db99c46c2fe05461a72d
SHA1 0d9ee5767871b059f733f740494dd410b661315c
SHA512 3e95aa2a133a8789b8f4fe5480fa1b0232bf075e2a36f0dcaea867fb622cb096575735e617d3de241675c57225881cbf02796c5224c47d84fdbf0db6073c7439
SSDEEP 24576:/AhGL6IFoiwtA5l7S53F+4ZAgayjhwbmY3MaReFeDvSP3b:/AM5Foiq51+tgauhwbR3P8wT8
TLSH
T179359D80E7F955D4F5B3AAB899B68570EA76BCA65E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 ba28362226fb82dcc62ff2699ec566da94a5f0081dd8c990451d3bcb667d895d
MD5 469071a9084d301f6ae4253f50084b87
SHA1 19e570170859bcc0ed47c51336fed861005f42b3
SHA512 448d8a29d4b5782e393ff2f70af43f9491c8a829a651225bbcdb5d26cc2d332091b19dc7651b72553a372ddac21574db56fdde4398e40e3f1189f086f5f66fda
SSDEEP 24576:DwutOWC+4ZAgayjhwbmY3MaReFeDvSP3b:DwmOJ+tgauhwbR3P8wT8
TLSH
T1CC75F14573A80CF9E967463886978532F7F2BC422A21DB1F57A0C75B5F33361AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 4c2eddcd57c3d1ce423b68332c338965dafbc7e6901eeab4c2548e517f2c7c87
MD5 e0c5e8799f93bf56c4b686f0a936811c
SHA1 ed000bae52021fe5324b62e6a345a5485ff49ab9
SHA512 1e6faf43bea0e09781a08d00d88fc13f28920576cebbc8dc912a6b977720ccfab55482b99ee51052e91004e4df69b309ce5dd5676ecfcf3da387a5fc211381d3
SSDEEP 12288:6+Z1IyHeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:/Zur+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T177651285239860F9D1A7033CCEF60A00E7B1BC922B7253CF9594679A5F72ED54E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b3f68f454cd6de2d2516dc8d131e65e21e0eb26a57abf8d9b5243dd276f979c0
MD5 a198f92399cfd4dc524262dc1da5dedf
SHA1 cbdbd75145ff5fd8fc600e345e718c6a961fe347
SHA512 1ced0f781d853862bedfd4ca6bfa3ff78a4b79779aec52a84b52c5468552b25b9264bd622fcee20097d5b15fac1ad6bd53b0f7c7f9cd5d7bcc3c392fc18c8b92
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glk+tgauhwbR3P8wT8:0u6JmIxd2dHgaPJ
TLSH
T144D59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d2d8a4cc7d779cdd0057c6416a97604c5064399bd88665efbad1dea2aa929ef6
MD5 435c235284a7770162281b2e19682b03
SHA1 9bbac9ff236c8680bea35443aefe6226bf0e209e
SHA512 1e47980c7c93eb46747a00655754d903dd11256f4aea14e303a97b0091db303229cefd38dd153e20eba5cdfdb41a9092759256499225be41a09d420aa763764e
SSDEEP 24576:JcP4mcvIjkGOxhKP2l71nNKbrh/8KBT+4ZAgayjhwbmY3MaReFeDvSP3b:+P4m4IpOO67W8KR+tgauhwbR3P8wT8
TLSH
T1C465BE2DABDC0096D0BB917486658A49FAB1782A1F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4360_1648319653\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4360_689100145\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 fa11d37af3f3e501395c3de8a17743533ff9628ebdc54e45519c6934a9e8bff4
MD5 8dae4ba1ae3735637aadd7490bcfca10
SHA1 4e61c67caa927c091bae7528c074545aa8deb5b8
SHA512 3b70f8b4254a3b4489691f1bbdae7733c16553ca02a621a36d9ca40cd6d956e333129f87b99da2f24921488a0a35794b11c0d7dfb59816f08fabf67d2042afdd
SSDEEP 12288:wNsfGeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Nr+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1EE65F149D29801D8C06E1275CB564A40B3777C6657E2E3CBA6C0F67E0F71AD48EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

062cbe61-ff0f-4914-aa87-e843cc3f5690.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\062cbe61-ff0f-4914-aa87-e843cc3f5690.tmp
Size 8KB
SHA256 1840a899f69fe09f4f7bc2dd2fe4a0f369df370b7977127d09926b2d5a83f997
MD5 515503e74f215649d9d54810a0c52cf2
SHA1 e8e864333267886f33f646d7e23c60d0ea07fc38
SHA512 eeeabcee239d30ed7cb310bd484882c51e6762022f41b286825cc30cfe78fde563574c7207a97843c62443872cfb1c7786c98f9eff38d2c6242f4ce658aacf9d
SSDEEP 192:FONO6DphbqQmiUy4NnlwGYX59ezDCIRY6O/eeFHkIIVMq5p4U6:FONO618bRlwGYX5EKKO/vwVeU6
TLSH
T1B412F975A8BCEC7B4DD7A551B48B2A535F942137EE816F44D6E81E1C00DB28C270B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74c713a2-b2e6-48fa-a996-14cf38874d31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74c713a2-b2e6-48fa-a996-14cf38874d31.tmp
Size 28KB
SHA256 d4ac2b267288babae2141e892f0a38ce2c2e357accd7286245a3c00dd61b06be
MD5 edba312630ed8f94ae2e5aaad1c84879
SHA1 b59fca2e0796fcb5716b94945ef32e3fd2076dab
SHA512 eed5ff1f92a4ef648cf55396f37b9cf91d8d3d32c838be2b7c908049f2d71067a32724d6ea7a5db51505e0a98b9df50c46d6b511c1ae230f817597ac1c77ee7b
SSDEEP 384:n3iFiZcIBzsNF8TUNTUlIlAL5Aoi1XBtDfYmYX5EKKO/vWVei4/uANEbEeU4w:yFQxUwgW0xSmYuKKOGVeLJCbETD
TLSH
T1EBD2A3F198E79936D8AE5783A77E2D428EBCD063B5845A84F7D85D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55e4f75e-02ab-407f-a4bd-50747923bac9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\55e4f75e-02ab-407f-a4bd-50747923bac9.tmp
Size 105KB
SHA256 c43cdac343629dd02c753c69bd2d3d68f6a680941595b5b24e7a4c0e9af0a92f
MD5 512d6bb5eb68161105e73a7d201bcd46
SHA1 3f8132f698803f82d145294d3019bcea70f3c08d
SHA512 e38ff3ffe44f85efe82044549aaabda9821a1dcd1cc60d7c374e5a927da058dab823cdcc8869ae493cfe1f07dceeb7c09d2d0fc8d0e02bd13f3b122b9b61425d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T191B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

01b6e0a6-b75c-4b3f-9535-cbbf46f44f06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01b6e0a6-b75c-4b3f-9535-cbbf46f44f06.tmp
Size 11KB
SHA256 bc3f2bbd4f0b5ed8e11ecb0ec8b816490b851a9d19a934d03f39c00b0a457eb9
MD5 1fc6518994d98a98d837998b3acbdf42
SHA1 7b3d9ac815b85025e215f10e5c5602edb4037dc1
SHA512 767e20939ea7e3dd7f1c3ccf57a0bfa59529347b45022329d9a444fa0854808ffa968f837f8cf5b631185a6c66ede59a291fa223b68f3495ebbfb268698efb2b
SSDEEP 192:sxZJRQsw/ftsI6jLy8IdpZcjHW6+WNhVB/qTFqk6+DjWwgE52++Ig5TJ:sxZJvw/ftsIUylWHb9/7hr
TLSH
T1E442B852A9786A7B4CC7E619FA58BB13D7F60421A5802E84EAFCC51C05E76DD6207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

372f1d0a-6968-4231-93fb-7a615c85b929.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\372f1d0a-6968-4231-93fb-7a615c85b929.tmp
Size 12KB
SHA256 92cdcfccce2cc79941601f8983426eef84cb352e1dc6dd6e516d57082ac29640
MD5 e433767c77a84fe7ab32a4971afc6924
SHA1 6c1d72947cdb8e2104abac7f24af3f7cc8b6a536
SHA512 48e1f74e181837b9e116051bb21a345f16a7c143657181e3ce539d0bce1f2885f8ffe0f10245dfb2dfdc4b32abd18145fa0295c67ba7ab31b46a95c3115347d9
SSDEEP 192:sxZJRQsw/ftsd6jLy8IdpZcjHW6+WNhVB/qTFqk6+DjWwgF72++Ig5tJ:sxZJvw/ftsdUylWHb9/Uhx
TLSH
T18E42C852A9786A7B4CC7E619F658BB13D7F60422A5801F44AAFCC61C05E76DD6207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

488ea6f1-3ac4-40d8-a5d4-c584df9a1971.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\488ea6f1-3ac4-40d8-a5d4-c584df9a1971.tmp
Size 11KB
SHA256 cda979c559d5244eeacbd7a6f7b64b37d057f89177993e25ebee195a6e89e384
MD5 4d9e902488c030cb904476da55add482
SHA1 06918d04eae55dd7256a59ac82d2d56871c8cad3
SHA512 aa53b2a7ed61d6eebc1157b2e702d507f08b502c4b80d80bac3c7ea164ed0644d2aedbe2a0c10e7ad6e9803ae76897176a5abc9069081ce0a69a58e1b6a3a54f
SSDEEP 192:sxZJRQsw/ftsx6jLy8IdpZcjHW6+WNhVB/qTFqk6+DjWwgE52++Ig4J:sxZJvw/ftsxUylWHb9/7hc
TLSH
T1D932C852AD786A7B4CC7E619FA58BB13D7F60422A5802E84EAFCC51C05E76DD6207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f408e5a-fa8e-4ba3-a4b5-25e81620629b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f408e5a-fa8e-4ba3-a4b5-25e81620629b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

54fb1d0b-d2ad-42c2-b256-8c773fd458ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54fb1d0b-d2ad-42c2-b256-8c773fd458ee.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76b66fa9-e63d-46d0-b8c1-6097ce503663.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76b66fa9-e63d-46d0-b8c1-6097ce503663.tmp
Size 32KB
SHA256 150399df7486220a433aea4662ddede70462812751a36c873ef491cb96b9789a
MD5 28a15548dcd130006d01b921e56a279d
SHA1 b66a30217d66fbc177d0a72370c9767b418efa2f
SHA512 36c9e181b8db6f72ff63288bf99fae7d839ab1c0cd5d7b0b671870a95372f8b65de2c7fbf778b7958a0bbf9fd2c621fe62afb560714e3bfd0c371fe66a2321eb
SSDEEP 768:JBabichoz7pLuLbrPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXcy+LlEKXza0:JBabicholEbrPWvPZplu1jaKcy+LKgzB
TLSH
T122E2FA7B780CCE7E4FC04E9DDD1A7F9E6EA8028B9698C94047FA945C02C67EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ad304b3a2b21e73d7e0652fe57bab2338341d2bd281d64b504cf64e94e06c7ec
MD5 167b7de03f2ef95507ec24475b33b8a6
SHA1 973be31e84744d64a8773ca4464fbbb385f935be
SHA512 86c399ccfad48325adf892663a5cd1fd562bfafa2272e25ddaf55f98996e950b5aa46d132b075f655319d4dfd3842f4a57a402df564cb85e12fcf4d0f573f5ee
TLSH
T184E07DC404E8C22EA34C66578268530CC381361FD7C0E95E6F20CDC67047E84B3E66D0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 92KB
SHA256 e8ba6dbfe1674e37d49c15ff69f239633bd0199ed689a64ab74988499122fca1
MD5 adbd75258da980f57858894cc5334d23
SHA1 11702cc430c861061fcd116e53735f60dca5778c
SHA512 35baafcd46c2a10e9d46d477da75485f0538296ba0ae70a4bca5967907e3fcf51666c0335e6421f3174d95a44e56e25a1c12e68f3e81f5298dab9a7d73e79740
SSDEEP 1536:5mIyd8ba1W/BAbaveqcAq8kXn6i0zfPLksVcpgUo4EgmugnF4+CfI5g+KU6QZClf:Xydcak8aveq/r5zfPHegUo4Eju+F4HfN
TLSH
T17293120D13758A6C574DF888C1AEA7AB24C3F7B77011C86E646633C6BE2C97C85E40A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ff3808b3511f7562770626ce4c362e35dbf4d3d18fa2009d51b0e6e990aaabb2
MD5 4dba18ddc7bc71d50ffbe9557981bcea
SHA1 72ff90c4f3028d555d8517b4c1bb8d22f89fc278
SHA512 bd90a4d7b3939093b52627e5299353a184bb2417bacdfc284abf1bf4bcc27e9c03d2f97def6ac60ce6b62c36e96030ad50fb78fca4416c3592f760cc02889688
TLSH
T16E71854562868D4EEF74707CBBC5CCCB33F055B6E1C38D2A1164EAE8DB62FAB94400A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2670c04e4f6beae29ac2895dca7388c05bda07786dd582e504297b14af5b16a3
MD5 2393a940952c041580ba718506d0562d
SHA1 83f10c5c0b70f63d01ec39f3b63e0d81b3798691
SHA512 ac9083b198ffefd6aa3ceb7b862d134bed7d71d405db37a298b36a87ff70cac146eb0ad069151b2269cb2a1016cc883b8c4a78cc3d73e081fed3c78f00abf28b
TLSH
T19E614E8526968C5AEF7470BCA3D5CDCB33F055B6E5C39D1A0168CAF8EB62F2B90050D4
MD5 SHA1 SHA512 TLSH

Submit Download

031b62c0-e2d8-415c-a859-de9fe2cad93a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\031b62c0-e2d8-415c-a859-de9fe2cad93a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.ccleaner.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

1c374176-87d5-4b6f-8eb2-21ceac065f7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1c374176-87d5-4b6f-8eb2-21ceac065f7e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

2fbc0d46-58cd-4e50-b4d9-bf56b764c7c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2fbc0d46-58cd-4e50-b4d9-bf56b764c7c2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

eab75839-b37d-4db9-8446-ee4f533dc4d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\eab75839-b37d-4db9-8446-ee4f533dc4d5.tmp
Size 7KB
SHA256 368172fe68f321c07dd295e0d6c2c762ac56efb6c84fc43480d8212e61ff7624
MD5 9a430f1f16f4178554f7f1234dcddaec
SHA1 5ea7460fe7d75f5c168e77428131335a48c3b062
SHA512 a84444057369d986d88c580c8f10abcde6477e861906312c2513a28eb14887cd5f9c06ff6fef0ccdc81b709ffb75316f26933de0535312f3bf4b50302d0f5466
SSDEEP 192:DLHUBcSnZlPeeTalWF/d41ENbkShbG3BTUMWZeAu/xm6xlFULZ4iNCx:DoBcSnZFe4alWF/CSNoSpEBoMWZeAu/R
TLSH
T185E17AB787F59A6DCF2153F0AA156E1FCE190814936C3C6B84D89F17A7E1470E140B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 001279c3295bbc3fe06ec8e4c50e77348bc27dc675eab10245727e0ea71070db
MD5 190772c307869f139e70b1f0e24744a2
SHA1 97b3a491e3beafaccb07e1af124d81ad920841e9
SHA512 3759a0a6988245edbe2dfa59391c09bb43cdb92b4e41b39670ebfa3f543f1070b011c598d1561fa4bb48d358640cfce0f3e9fd0bc0522ea6ca2fecca42ad19f3
SSDEEP 96:KkKEKT6qSsoKJi1sf4cq+aA+GlTEkAK8VECAoUk1iMNBxkTnxy:S//Csf4cq+aBGl4kAVECZUk1iMNBxkTw
TLSH
T105914F04747B125538FE7A8841A5862A464231B73728E97FBFEC41A34A7EE041DFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe21e21f-29e0-47a3-9220-9f445066565d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe21e21f-29e0-47a3-9220-9f445066565d.tmp
Size 12KB
SHA256 d2ae6b98a3f26f0edb2fee9ed9577fbd45b7bbdb7c309f3db68429a5062a22d9
MD5 fbe4c5c97149425c315230d1f535fcb5
SHA1 7f9d9c764ad04a8ac0c936dc05da3a1adcb315e4
SHA512 849d092b5489224f1c9159b2135886e1135def065a4cd7c158ed006ba6b67ad47eb0382c1fc60148d81acf94e52a4d2c768d81a18448447f127c2a222c590a95
SSDEEP 192:sxZJRQsw/ftsd6jLyJKIdpXcjHW6+WNhVB/qTFqk6+DjWwg6ou++Ig5tJ:sxZJvw/ftsdUyVoHb9/Yhx
TLSH
T1C542D95269786A7B4CC7E619FA58BB13D7F60432A5802F44AAFCC61C01E7ADD6207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83195fd4-143a-44f7-8777-4faebbc60923.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\83195fd4-143a-44f7-8777-4faebbc60923.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

a283faca-147b-4af7-9759-079e9be61e68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a283faca-147b-4af7-9759-079e9be61e68.tmp
Size 8KB
SHA256 c6b61df50a3283134d440c04765f9ba01c41bbd1986bfae251723fbb55bf86ee
MD5 bf71469ff148d6601e39b3ab26212472
SHA1 d5b98388a5fff91579ae2dda91a7157a803fa71c
SHA512 0b299874466eb2dfdc0509e9dacab9e464f87ca6a75f0b51d2b1e29595b1b773793bae5d5ee48aa1aa0ad39b33baf64e49bd062feca6dc59d94197a6b5d8c529
SSDEEP 192:LJONrh6DphmqQmiUyUnq8wGYX59ezDCIRY6Kkk7VWlU6:lONrh619PRwGYX5EKKEVWU6
TLSH
T18302D935E8B87C7B4DE3AE45B58B2A135FE4112FAA916F44D6E81E1D00D768C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1370abb-7c14-45a3-a5fb-3d58f7c7738a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c1370abb-7c14-45a3-a5fb-3d58f7c7738a.tmp
Size 18KB
SHA256 7aff5baac523903bef093106efe3bda0458d0b0c3ab3ec2365e0ee5cb56f35a7
MD5 fddc2e47e8255a1cef8a052e0b3a53e9
SHA1 e62b5002e8da4aa24bdfc22d4e990a10aa5288d3
SHA512 4d925f7c3d1801bb008537c98371a73400d3b7c10f27c0e8325785d37e38916520bafa6ad67cc262516a1597ae0cabf09e166cca01b14dff5763eae71ba8e026
SSDEEP 384:nEZcIhsNEUAL5AoiPXBGYX5EKKO/vuVei4/uANEbEeU4w:ihxWxGYuKKOeVeLJCbETD
TLSH
T18C827E71A8B8AC3758EBB541F49A2A135FF86477BAC06F44D5FC8B0D00992D8170F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1d1ec80-a086-44bf-a0b4-287e8619b621.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c1d1ec80-a086-44bf-a0b4-287e8619b621.tmp
Size 18KB
SHA256 83f08477ecb586e3bbba55bfea002dfcf462700041460302bffe5f8f77e5ed59
MD5 0425a8a828fff094f5ca680e65a60d5f
SHA1 3febea73fabee639b4650b80df8e71de82b9d245
SHA512 768f09639de3d6986350a49562afb1a7f05e4ee69c542fd7dec041b482c498092c95145753b4dc094b1d1fa62d4f5748409bced5d917dc3ce9210c937c30a877
SSDEEP 384:ngZcIhsNEUhL5AoiPXBGYX5EKKO/vuVei4/uANEbEeU4w:ehCWxGYuKKOeVeLJCbETD
TLSH
T15B827E71A8B8AC3758EBB541F49B2A135FF86477BAC06F44D5FC8B0D04992D8170F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b88b320-e4ff-496a-81fb-adf5bb2a261c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4b88b320-e4ff-496a-81fb-adf5bb2a261c.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

6b6c4b46-7549-4fdb-a4f4-206a198a5f06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6b6c4b46-7549-4fdb-a4f4-206a198a5f06.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

b3608282-06a2-41ff-b844-768b83494b15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b3608282-06a2-41ff-b844-768b83494b15.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

16f9a0f5-8401-496a-81de-08853a2a5d51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\16f9a0f5-8401-496a-81de-08853a2a5d51.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e9acd8b4bd674d7a64b322ba189ec36d5afb6e2f2e36786d36037edde57a0e73
MD5 7130801a8d8efb34a55c034db32ad75f
SHA1 6f6cfe53f8dfda74a9675a09d48bbd70028cdb96
SHA512 c1993c5fa45ddef8445ed8eea2b99d5e331fd015c046eb8033a1ebb6bcad4fad0ee3c99ae456828076ef49328cccf6a9608a90d6d292194807f6159d3176e2fe
TLSH
T1E641FC58B6FD1148B3B76E1AAFF2A86D887FB9772E06945D10110E4F4A66F40CCA1733
MD5 SHA1 SHA512 TLSH

Submit Download

26c1bdf2-be13-4a15-9900-205287984e62.tmp

Path C:\Users\Admin\AppData\Local\Temp\26c1bdf2-be13-4a15-9900-205287984e62.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

338b2195-83ae-47e5-b12a-c44ea0a32dc7.tmp

Path C:\Users\Admin\AppData\Local\Temp\338b2195-83ae-47e5-b12a-c44ea0a32dc7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

49741f24-f542-48f1-af70-df7280feb979.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1629187473\49741f24-f542-48f1-af70-df7280feb979.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1629187473\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_3751350\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 a2047989a212ba2ebede96e16a6114ca677ef93a805b0c118babf0ae908bed67
MD5 239797d6b6aec98bf06172d858dd16b3
SHA1 94cf19a120f26bb3445457f45d882a9d643ec7c3
SHA512 a2264b1fb0a6e1abb14936b5fc9cbf1706dfb9accf0515a2999efd3924f85dab9727bbf6ff63823a3eb7898c5feece15333d6b5ef9f4bad51e2994f19d7d653b
SSDEEP 12288:tmeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:tL+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1CD652341D34C888AC57B0B308B6B4930365DBFE62F42E14AF48977998CB0DE98EB5759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f7df8b2aff4699a6900f4fcb5e95a7017a78524d05fee7bcaee850ef3239746f
MD5 1bfd800c530ed6cc9e8517ed6463ef71
SHA1 9c6a993eef17b64f888dc18f202df8380fd18b04
SHA512 b72df3f32ee31ba9cc0bcdb0217c79480e6f749cb5d668bd966c400bc0824b3fb8da1f3299bb3208e49996ef914a5d4abbab2a8d3ed4d887950f0d58e9110959
SSDEEP 49152:Xa0h2GEkuAe73q3pp46zwwQd+tgauhwbR3P8wT8:Xa0hNYG4JwJgaPJ
TLSH
T15F85AF1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 27c1f185ca0f11e7294b41ebaf7594346b1c1049129295e2d5ca0d7cfbd199be
MD5 4b59d1d5b3bcd0d4d17489599c06af37
SHA1 38dfdac66bee6f5f6c5dcb5d2ca27f843ba64652
SHA512 255ce56e5e3375bb9aa29baa00ec13b5e64b87d3fecf68185d54820199e0dceed226828f1c658dcc117d9039d5e28c5d62c7af436c41339b4ad907dbfe5e8981
SSDEEP 24576:ThbHjPq+4ZAgayjhwbmY3MaReFeDvSP3b:ThbHjy+tgauhwbR3P8wT8
TLSH
T1C965127D53AC20C9E176927C86964502E371BC661B12A3DFA2C593BE4F32EE84D35F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d74330187abff6786135a506f255e5fc46a88b9fd5663eeeace8a7f882e5498b
MD5 1f28fa97506eef64ccfdf9668dbba90e
SHA1 06c89077c5bdf5c10f078d53085ba90a326129a3
SHA512 c691a3eb06249e4623b96bba882f90765c25a613eaf29a2e8f75eca8287b79e362f2ae272c580a2b806bdc58872a2843acba51b09e5cc16ecae5c8b486e89068
SSDEEP 24576:b3YgnJcRTk4yti+R5dBR/C+4ZAgayjhwbmY3MaReFeDvSP3b:bIgnaTk46pBR/C+tgauhwbR3P8wT8
TLSH
T10F45BF2DF2B910B9C8AAD236450147B5FB71782D1F209ACB0174C638AF16EE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 298f1ba07dd4d12372f2542efcbef75313e54c868069bdebdb413b04f714ba52
MD5 9cfbd1a6678d32cc0f287f2744d65edc
SHA1 ddccf45f4c47c92dc2901fb4657c84bfc50d94f9
SHA512 c48c417bc8b50040556fca40e78d1df034fb53112cdf332085dad269073d45ae4e9a74c7450ff321482eef8057889d6e7f030914597148c4155f01db84decced
SSDEEP 12288:lqeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:l/+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1C5552380D24C98CAC57B0B748B6B09207688BF962F4662C6F4CD7795CCF0DED8AB5794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 75d693f73aed58f69ef63d27de06ddc5710141f382978b49c44d25931be5b515
MD5 1b2df0de642378081af881f390c5972c
SHA1 c8ffd1422c454c8665afb92901993c66f4ca5b19
SHA512 dafc9a6e9589f8aff966dc4f316d262c471361a4dc05a587467b88db616f9f68f083a73b1c63a14ff47450bc0c01d036e98e86f68ec47c9f50193b983ef429c9
SSDEEP 24576:y0L3UT0+4ZAgayjhwbmY3MaReFeDvSP3b:y0L3Uo+tgauhwbR3P8wT8
TLSH
T1E9850154F79400F9D87B823CCA668A12E272B89D0764E7DF43A84B651E737E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 eaade0d99a533098ee2637bebe9b6c319b1c5f0f94b98f069e43e1499565b31e
MD5 e90e3942964abef05c48bb9a01f3718e
SHA1 369c0378b5bc6fb853be765eb11e3d4cd47ba5d5
SHA512 69832f223c16aa4dbe207915ed4b727d4c2eb19177627bd2fbc4ad3d63effabbc591d720ffab8731597e164b6c8a7370decedfb05591470a91c02fb2e509aa52
SSDEEP 12288:6pFtDONeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:COI+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1C9650259329C10D9D17A523C8A974205E3B1BCA61B1253DF46D092BE4FB3FF89C3AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 540ba738e9185119c6e09f1fe914e62285fac3728224ed97a3cb48a032894a41
MD5 af4eecefd8f3f927c2a78aa98628bbd6
SHA1 dba543a43bdd8d86287c907db439ba6eeef15cd2
SHA512 2f8c2a774cc5f9a6996737ed8180c8e14ee63fbb65343d75a1ff6584916465def2305dbf6c8fb737c8f6fa09fe5ad970fa2745d92a922fe3a4dc317dfdd1615f
SSDEEP 24576:q7NM9YqZqmWMUkPjZM48Mv6bEhs7+4ZAgayjhwbmY3MaReFeDvSP3b:q7cBWMpPjN8DbEhK+tgauhwbR3P8wT8
TLSH
T1EA65AE2E6BAC81D5D477D13DC9A28205F6F2B8611B318ACF5152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2d4af49fde87df1f9f2163b2d55fc620f5e12bf2e9a29641d39cfebd6f0c585e
MD5 0d13d629b9b146c631b430eec9193ac1
SHA1 374099026f409f6671d1c4ef3de4c4d0795ba99f
SHA512 2b60a87e6419db4b3940d9243ab4040f2606c433249e71778bf40bf52678f46adc4d7347b0c95613d95fdf43ecb9f1b0dae3f4492973c372ea6b1a5c857f9b11
SSDEEP 49152:yF2YuHNETovAvNYf8kmb+tgauhwbR3P8wT8:76BCf8krgaPJ
TLSH
T1CB858E2927ED80A4E0BBD27D45B79246FAB2BC511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e6b4e3068213d5841412c05a0cdfceb9fdcc90402fd04d4c5cb1b32aa7bc6b4a
MD5 1b48d5588eb7d1ac9ba1cce9a36c9f09
SHA1 65094b93816516a8f6614b0c011fd282e03a2cf2
SHA512 7819009e70bf82b8978625e1b57ff097d52f95057943bb1dac6752eb8e0f2298f7d290fe9296782b6574c931bff8949fcc82ed4021a67d774a53d306b5e8cf7b
SSDEEP 24576:IAFs06+Omlf8NXEbToc+4ZAgayjhwbmY3MaReFeDvSP3b:NFs060loXu9+tgauhwbR3P8wT8
TLSH
T1AA65BF2F62EC00D5D07ED17D8A97C916F6B1786307256ACB0160867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 fb772eacb47d019fe4f067e7aff6db16f3e59810c54fb4701e809cf643eda37d
MD5 dcf43efc793e454a4545bb5f0f5379f3
SHA1 2b3aef1b3be7212260bd3def1248bafeaeeaed15
SHA512 4c9c7e963633d2fe67f08f338619f77c893b1fe4cde147f80c72d89b53f29eab94f37fee4c12b5cae2bc24c34eabae40c3ea891933e33ee516f9feeac08cf1f1
SSDEEP 24576:jJnJ5D3WY9+4ZAgayjhwbmY3MaReFeDvSP3b:jJnJ5DGY9+tgauhwbR3P8wT8
TLSH
T16685D02DD2A810E8D4B7C374825A1B51FF72386D2F226AC768B4D5357F22EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 c30b5e996a1b499fa2c1f18c74f01d2b4ad9e61df74d869fcc169f98178f3085
MD5 2922ba4dd0645b9a8da55d3bbb11914b
SHA1 8a5bc0562da8fd77f0b91accda0656f7f8922621
SHA512 d4309c16f3a16d69e0838f0e2752e67b145b30549909d31afdfab1a657143dbc39da89ff3a0dfd38410202a960e44036fb3306ee696ecb75623022eb1ace8765
SSDEEP 12288:eEP3RjQeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:9jh+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1BE65125D679C60D9C13B523C86A24600E3B2F8B12B5227DF95D5D37E8E72EE94E38B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 6b887c9cc851d2808c5be8b6524a7f1c29d16113caeee0b8b51e24b659ef8a1f
MD5 8df72b4516dec701e3c548c5561d3ac1
SHA1 2606a72dab722c934039d7c03f776948d5ed9bb9
SHA512 7bd375fe757b273c0d313e00d282fa33f4c89f260671b18ac564be931d64204838e9a6c7d682354e579a869d80f1c2d92c7b5e5251d349a8b986b1c939433105
SSDEEP 12288:njkyDeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:nIy6+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1A8651244A39894C9D67A07388B7742A0AA74BC612F1193DFA0C0F73E9E71FE88D34B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 788f6090096181f06aa0f6cf78161bf1da289b2b2f73b6a5f0d88f5f172af3cc
MD5 cf78584e0515881fa6e91107a300bd23
SHA1 12f0e000c0f784515b93eebc42bef22c00a16351
SHA512 d8002a3505877ef318635f1619b2b3900e688c3e3e581d03b510292414e2bfe29e886c8b1f06c210b27b3a415651a26ef6969cf86105fa45fe300be4fa732cb9
SSDEEP 12288:WW9eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:LY+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T132552344925C64CEC53B0774877A0A606294BEA62F4271DFF4C8B7B5CDF0DD986B1B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4787d97f36835236945716aa5522edfddc25353ab5af320557842f61decac75f
MD5 6d82208451db7b0950392d2db7f73cf5
SHA1 3de06458393f82adf366f9a4d32ccbb4013fe224
SHA512 ae950a40533754216a7a8c7ef08708ef63ec6256341e19aab8e5c039a56bcceebd414118d4c0b2f6a31a7d6d5374e72fa80baa84f628a951e2c6f477cd8cdeff
SSDEEP 24576:cQ9MxZKdcz9dw3D+4ZAgayjhwbmY3MaReFeDvSP3b:cVKZD+tgauhwbR3P8wT8
TLSH
T153558D2DABE9058AE177D235D5A240C3A673B4311B31D6CF2448D13D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 6029653063eabe47b0f07bff63c95cfe4c6e10cf72eed8a4724153938f620505
MD5 80416e11825d5ad289a016a4d691385c
SHA1 4caf34bc90697075d9c7b462634a52162dbcd5f1
SHA512 3ea5dc33aaa390a908ad8c667566d4208d591686fe798916e6dbd1167e894c2f8c4568a314b7400decac9ebbb37c5ad89c18d08677d46bcd638d541e32d2e0b2
SSDEEP 24576:RyocHApu+4ZAgayjhwbmY3MaReFeDvSP3b:8ocHApu+tgauhwbR3P8wT8
TLSH
T12075E01FB76D40E2D176823C8A858641E7B3B4701B6263CBA591C33D8E73AE9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bfc3dcca847bb99cbe4e2d53e2ae6cb58e9995c8ee09deaeb6d92f800df5b19d
MD5 92d14a906382f77b4940f4bc4c05cc1f
SHA1 46ac1b4d607afab0cfe76130cd489dd853c0a711
SHA512 0ea8b5765ddb73890db30b57e6e337347a7c3d44f24086fdcaf4cfb8308d954164410b644d1bd2fa49b817d40acb2472cdb6b0831c0d805fe3cecdb49f28b1fd
SSDEEP 49152:6WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKu+tgauhwbR3P8wT8:80zuNIXgaPJ
TLSH
T1C2A57B3DA2BC00A9D8AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 81640342048e93425faaa5864a42419da2f5b1913055aa23080e6bc7220148f9
MD5 10a6ac79b82b585baf4bc9729cc6afe4
SHA1 b8a0428850b63f7a71c918378c4512d1265bc5ee
SHA512 645707f1f0cfb591bf0a6350f3f6dd294977bf73fe692db7d493d9a78a95c23f6ac88f0144658248315a43e676b40ca33e741dfe0cef9c90f0dc08ac91b06e56
SSDEEP 24576:21QT7EcpfxR+N5AWAz3ooiYzjMqbh+4ZAgayjhwbmY3MaReFeDvSP3b:bTDxR+N5YzTBjMo+tgauhwbR3P8wT8
TLSH
T10455B02EA7F815E9D17E86788B238512FB727861073193CB42A0C17E1E779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 3b3e9bbfdcc423495002e9c2e17162dfe7111e1df999d053736e789aa9b2cb7e
MD5 8677284d766a0912f6a3b862edcf428f
SHA1 43716e21973c468b978417ae8b4f578e7509edb8
SHA512 5d6ba51514df5cb231c297c1d7338e59f1d1299e5dd04573523bc98dc96075f6c858033c31d971c9399d80c3e31a0e197fb623df6677e88eb80c58de06e8491f
SSDEEP 24576:wTMdOz0FFS+QmSLl+4ZAgayjhwbmY3MaReFeDvSP3b:40K+QmSLl+tgauhwbR3P8wT8
TLSH
T13685F17EA36D14E5E47BC27CC6538902F6727862032266DB46D0C1B92FA7FE47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 a924374d4dfae1aa8af100f04e80411ad565fdd00cf7e09962ba662a0686de51
MD5 19b448e8a0f8689717e0c9cadf96719c
SHA1 fefd564409b39fec295df23d368933a549a1bda5
SHA512 0728734a718ffd2b83bbc00bd18a3c9e0cef92f45fb8b46d43b9366e8e8ed8c69ae966b373ee0da5fa9c104f5658adb21acee9c32a9e99293ec36d4ffd84bbac
SSDEEP 12288:b4+peH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:70+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19F65124863DC34C9D47747348B3A0611A270BCB62B1166FF74D4EABA8F71EE88935B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/756-30-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/756-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/756-36-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1100-149-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1100-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1104-5-0x0000000000D90000-0x0000000000DF6000-memory.dmp

Download

memory/1104-7-0x0000000000400000-0x0000000000AC3000-memory.dmp

Download

memory/1104-69-0x0000000000400000-0x0000000000AC3000-memory.dmp

Download

memory/1104-0-0x0000000000D90000-0x0000000000DF6000-memory.dmp

Download

memory/1160-1004-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-1002-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-977-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-978-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-979-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-980-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-981-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-982-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-983-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-984-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-985-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-986-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-987-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-1006-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-988-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-1007-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-1008-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-1009-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-1010-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-989-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-1005-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-976-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-972-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-973-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-974-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-975-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-990-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-1003-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-991-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-1001-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-1000-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-999-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-998-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-997-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-996-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-995-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-994-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-993-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1160-992-0x000001B6BA2B0000-0x000001B6BA2C0000-memory.dmp

Download

memory/1460-111-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/1460-166-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/1680-163-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1680-372-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1828-158-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1828-371-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1928-61-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/1928-53-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/1928-59-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/1928-64-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/1928-66-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/1968-127-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1968-130-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1968-344-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1968-121-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2208-86-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2208-92-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2208-85-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2208-157-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2348-410-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2348-368-0x000000000CF00000-0x000000000CF08000-memory.dmp

Download

memory/2348-188-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2348-209-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2348-172-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2348-167-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2384-364-0x0000000140000000-0x00000001401A7000-memory.dmp

Download

memory/2384-146-0x0000000140000000-0x00000001401A7000-memory.dmp

Download

memory/2492-107-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/2492-162-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/2492-104-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/2492-99-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/2580-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2580-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2892-114-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2892-361-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2892-286-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3112-134-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3112-140-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3112-143-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/3112-363-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/3304-15-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3304-110-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3304-24-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3304-23-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3536-154-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3536-370-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3552-426-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3552-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3552-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3552-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3552-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3552-424-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3696-12-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/3696-106-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/3984-153-0x0000000140000000-0x0000000140194000-memory.dmp

Download

memory/3984-83-0x0000000140000000-0x0000000140194000-memory.dmp

Download

memory/3984-80-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3984-74-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4308-70-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/4700-118-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/4700-323-0x0000000140000000-0x000000014015B000-memory.dmp

Download