f4aa1ca8e200a80abb071eb9583c9306b1b655862130c72cee65f18e2d81f92a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Size 2.3MB
Sample261017-e5bttahv7k
SHA256 f4aa1ca8e200a80abb071eb9583c9306b1b655862130c72cee65f18e2d81f92a
MD5 e4327b63dc9e700200e7b12aa388cf90
SHA1 b4eacad9a983a303bf7ca9123e9b9dc4bd8f5e6c
SHA512 555c6dba262c8c4cdb9c01cd06323fa5c191580a305cbe11c43b251531b675d9e53f32c234840fbe9da13eadb6556eb2fff25925bc55d840e1b08c3c6ff0b572
SSDEEP 49152:oxIPU/Edd1KelJ4F9fJ4klKXnjh/91Uc5fv5050xJITAEm:oxtFfJ4ke1Tv50axJI3
TLSH
T1F1B50121B641C075D7A201F50A7DE7B9093EEA2247395ADBF3E41E989D301D06B3A39F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery macro ransomware spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 3 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0002000000021d4c-546.dat
behavioral1/files/0x0002000000021d35-547.dat
behavioral1/files/0x0002000000021d34-548.dat

Executes dropped EXE 21 IoCs

pid	Process
4036	alg.exe
2432	DiagnosticsHub.StandardCollector.Service.exe
3904	fxssvc.exe
3384	elevation_service.exe
5008	elevation_service.exe
2328	maintenanceservice.exe
544	msdtc.exe
1208	OSE.EXE
2284	PerceptionSimulationService.exe
4632	perfhost.exe
1296	locator.exe
1256	SensorDataService.exe
4348	snmptrap.exe
3040	spectrum.exe
2152	ssh-agent.exe
564	TieringEngineService.exe
3016	AgentService.exe
520	vssvc.exe
4244	wbengine.exe
3052	WmiApSrv.exe
4752	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9a4a9c5f5ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000001703f-554.dat	upx
behavioral1/files/0x0001000000017425-555.dat	upx
behavioral1/files/0x0001000000016789-562.dat	upx
behavioral1/files/0x0001000000017971-561.dat	upx
behavioral1/files/0x000100000001780a-559.dat	upx
behavioral1/files/0x000100000000c530-557.dat	upx
behavioral1/files/0x00010000000233bc-556.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088b2986bf05ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000899a3c6af05ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f678769f05ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dee9966df05ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d50d169f05ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000694b4d6af05ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeAuditPrivilege	3904	fxssvc.exe
Token: SeRestorePrivilege	564	TieringEngineService.exe
Token: SeManageVolumePrivilege	564	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3016	AgentService.exe
Token: SeBackupPrivilege	520	vssvc.exe
Token: SeRestorePrivilege	520	vssvc.exe
Token: SeAuditPrivilege	520	vssvc.exe
Token: SeBackupPrivilege	4244	wbengine.exe
Token: SeRestorePrivilege	4244	wbengine.exe
Token: SeSecurityPrivilege	4244	wbengine.exe
Token: 33	4752	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeDebugPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeDebugPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeDebugPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeDebugPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeDebugPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeDebugPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeDebugPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeDebugPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeDebugPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeDebugPrivilege	3824	2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Token: SeDebugPrivilege	2432	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4916	4752	SearchIndexer.exe	119
PID 4752 wrote to memory of 3172	4752	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4036

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3440

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5008

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2328

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1208

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4632

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1296

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1256

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4348

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3040

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1036

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3052

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4916
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3edc14722a3a65703083b6719b6b20b05fd917827943c4e9e21322cbf9fcb1c7
MD5 4aece2efeaa2263a4837d44c6127c4d2
SHA1 f82272ab3df68344368091d4a89b65fca1fa5302
SHA512 4164d1fc7c9d75c6e771dba438c34d339298e4fc90fcbde7dec26685fa41b832cb46861639fbb1bc63dc62446aed7f0fd05ab593feec0f6677217340cb81d544
SSDEEP 49152:0b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn9fJ4klKXn1:u3q6mjBefJ4k
TLSH
T109D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ecc046bcec2d6545a989f2824adccce16490fc0319917de033f343a04bfae26b
MD5 ce433159ef6ee28649b39065736192bd
SHA1 1ea6f39eb085551f533ccb79671ae37217d76f26
SHA512 ab6581616f69351fbd1cb6a882369fe198e3ca9cdb70cc25109f2f0ce5c89c02f7dad45ec5a482a6a8810066dc35e94a0344ed157d206a0375a8ee24dafb8e79
SSDEEP 49152:JkcbfJ4klKXnBz/91Uc5fv5050xJITAEm:JDfJ4kq1Tv50axJI3
TLSH
T11975123973E009F9ED6B8279CDA1C401EB33BC814725E79B03A099652F776981E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 c6f70a89e2617d22e3a0a9575cf852c9525e73490fc82c0753b7290aed74fe32
MD5 7995a3faf7baca4b555fe0a0a94b8f02
SHA1 f5d9e4361b7c1fb9e99e7af1d224ecbba1bf33df
SHA512 95765130f9f36a40db4decd23310b418612d1ec207bc2a9d80ac85d03c7f7035f02ba2d0d6e11369520be3f2fd7219077b69a037e0b2f63746241d5212d631a5
SSDEEP 12288:E1XLsswWkxy2lRq2czA6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:CXYfDtczA6fJ4yL/tNCJPXUQrPp
TLSH
T10405F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4439fd4156081e4b54448ef1d67722e1df67dd08113e6d0c5255ca9ffd9b1564
MD5 5a228cc1ccd3f956cc05ac46a3ad023c
SHA1 def26c834e2bf46fc0f90b46169d2dc52981eaa9
SHA512 7ef0e34e4aa10a6217d7ae26b878cafeadfbf9cd638e5ac4fe180838e3faa5f9c148aba5b1985d78ce085e8b549c154b724c8a2857b69ec8aaefc51bb3070a73
SSDEEP 12288:Smw5HEjsChNEBFgl0WDm+CrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTp:LwuROW4fJ4yL/tNCJPXUQrPN
TLSH
T12905F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 59a88b7a91a1663002c936d0d811338b468f6caa8399892d4b5df2e32ae524cd
MD5 b27cf69a3bcc48120e277fbc742c1d4b
SHA1 9aaf9c304aea0bcd1b165a572c0467ab306f3708
SHA512 90ac9ecaccb688792d47f366a278d8383c87f85e633562b18187a90d0b68bf4f1f8ede13812f234d4d977ca096790f08f7fb931b1101b9ff56f14c37c3c12c6f
SSDEEP 49152:MB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glKfJ4klKXnO:Gu6JmIxd2dKfJ4k
TLSH
T13ED59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.7MB
SHA256 a36c024c633484e4f4b886af58cb20e7355419ed3109f80f830b51ab75fdcba0
MD5 019825a75d59d8303cd4855834d733f5
SHA1 6509b8aee0a263daf4c8e6201ee0aa892ee66b8f
SHA512 2096f3e22372cbea39451ab28b620ba779e5aba0f320d6545318ff4598a624ed1b9b4365da78598c889daf4c1f1ba18ffa7ea656d74515f2d3c0617fc47e2d66
SSDEEP 49152:DP4m4IpOO6768KN/91Uc5fv5050xJITAEm:RppOODl1Tv50axJI3
TLSH
T16485BE2DA7DC0096D0BA917486668A49FAB1742A2F3286CF1160933C3F77EE54F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertPush.docm

Path C:\Users\Admin\Desktop\ConvertPush.docm
Size 773KB
SHA256 0c0e0d66e96917ef1ee499b7b0740a32ab1875430289114b29fdb6dc32a43cb2
MD5 bedc5da83956e88d287d84383871e6eb
SHA1 38da6efee0cd98a8f79d19eea63e978cbd882f06
SHA512 e7efe3c60682d806708bfa98e694c1f0607d734705a38809e6128b8e0887e3546d7a2a66dcfa732b6a97768651ef2251165a5db9c4c4b743aef703b4f38c103e
SSDEEP 24576:3wGeTYmeSWNlFEm46zESR/XnVgUg1NbZ6mgE5:3waFlK6zEWfnVWb6m15
TLSH
T1A3F433F283F3DA16D6AA0FBB93C4C630D8C0D85691BC6CD09AE0995F4DC5853FE5206A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoSubmit.docm

Path C:\Users\Admin\Documents\RedoSubmit.docm
Size 771KB
SHA256 e1471bf238d8c7480324b34822d866c9d31b0fa714bfb015eaf24a146582c766
MD5 65e225236c035c1aef293f80c4903934
SHA1 a0e735bd401d44b030580c3a3077bab827c38d5a
SHA512 7bcc9d3cf2bcb07984fdfd4a2fe0deeabec24ec6f2e0cb2c933a174a2e9753ac0102caa50eac7527a0f7a0595bf4aad7b86b7144362354d85bb685057ef72358
SSDEEP 12288:DzZVWNFidpdjiT/70joEjdsJuKOH1lk2UnhKs4F8MPDKP7Zc9CWlKuZ6jSrfSs8d:DzP7jvjoYDKOHk3KrFLQ7E1lbZ6muEa
TLSH
T1B4F42339CD66EFB5EB2307F98B51265480EA002230F3CEB1064C31BD367577B65A765A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishCompress.docm

Path C:\Users\Admin\Documents\UnpublishCompress.docm
Size 774KB
SHA256 dbf880cefb7f60cc6640fb265d24b8313a03cf07679706d934e30b9006c87ff0
MD5 062fb1c9ccefeb4c5e6c836a9cfab4e0
SHA1 124a7eb4e8ed3373a6500539877e82d51fe228e4
SHA512 420a5624636bf3f0de74ae57916102819639ff096ff3f5597f0fdf314b73dacd5c86633f00d8504f433abd63e2861f4a3f97f809b339f20f9101d26843de192f
SSDEEP 12288:LBYF3mab+AvTpiEERNQr9Ccu/eQ5kZ88GvL1uk3Ci9/azkaxSqBJJjHUq2Fg/Z:LBAX6NQr9Z6eckc4s7azkkSqXJjHl/Z
TLSH
T1C3F433040E8331F1E4C66371BC94A4D1AE966BA597D1612F017533AB9F802F99B87EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c3b3169905023d12d7ccfc8f33bec860eb398f6c733ad4bb38b62ffb130dd92c
MD5 721028ebd70f766c5322c527d57cc499
SHA1 428449b54692f2049a42e4fc795b770dc2f677ef
SHA512 d2c5c85292798d909bf5291c4d8e88b2773643947e434c015645dd7e94a51c3420296e8a7d2f493c4701b57222dc454a2cba6693f50d015b3e741f08891c8bd3
SSDEEP 12288:uNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:uNfJ4yL/tNCJPXUQrPz
TLSH
T1F0D423A761D8D446EE7687F81648E000D3097ED56B2BA2E7EE42B4853FFC9161D6C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e73ea040ff5c194ba157b9c80b9bb18dc7985a42b5c9a933234395f7707115d7
MD5 0934e7d30d191034a4fef30223da8403
SHA1 34a4820ea29ac21ffd92ccb0613830c0434111c5
SHA512 322081a275b0b3092c14e37fe8968866401d13f786f3c550f78ca8e3a2eb83f93cfba3663a4d68fa675f374d18804cfd310d6774289be4a3f08ad78a009eb5b4
SSDEEP 49152:+a0h2GEkuAe73q3pp46zwwQvfJ4klKXnP:+a0hNYG4JwkfJ4k
TLSH
T1F9859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 e3e4a00e1b77413f5265775c8ad5a475802be2c66bec560ca3ce952fe8fc65e1
MD5 372fa99d19ab006e19019e1eff6f058f
SHA1 027ef6b5664c7ed0e267703b0dd08f09244cbd19
SHA512 4fdf8de4d37d68f108a1b7f13ed5a198b0ab19f6616ebd6fc344316868f1a5864b8c6cc5329f265e176c107b5ca4472d4651e804daf19fbf5b5ba2953d726d39
SSDEEP 24576:q1QT7EcpfxR+N5AWAz3ooiYzjMqbrfJ4yL/tNCJPXUQrPO:XTDxR+N5YzTBjMWfJ4klKXnG
TLSH
T17E55B02EA7F855E9D17E85789A23C502FB727861033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 7b48b30f33454a1dde24f752b97990c686d4e6ed472518f72aba361c2126ed25
MD5 cb31c55187afe0697854a3eaa2f67fe1
SHA1 5fdfc338728126c8b5ad584f904b621e6227e22f
SHA512 e080ca319799b686e4f0977e1d0bb75c3ae416ea036a9889948abfadead34d60efb6def89da3ce19802c24442db5376fccd490ec2563721d107c14cf94daca33
SSDEEP 12288:9hbHjfXAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:9hbHjPAfJ4yL/tNCJPXUQrP7
TLSH
T1EEE402BE22AC20D9E571D2BC5684D106C330BC951726A3EF57C2917A2F7BEE51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.9MB
SHA256 36052bd0a8e38b29ca2d6337ae08011cde7392190e567ece75d5be7164fc63c5
MD5 7219e8399bf8fa46f2b8719422618415
SHA1 9645bd09572b62adbf15c81467e4b1808fece5b9
SHA512 b0a5d687b50f07f9c0af4e238b07d96d17a8f60908de017f0165a3de5da283e9ff8145f82c9077bc24e53341a81eb8fbbc4aa6ca077e6cb6e7d3be5c1f44814b
SSDEEP 49152:eIgnaTk46pSR/4fJ4klKXnWS/91Uc5fv5050xJITAEm:e3/fJ4kO1Tv50axJI3
TLSH
T19695E12EF2B910F9D8AAD136450143B5FB71782D1F219ACB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3f24c2f79f64bf54c0c3bc3f572b4cd2940877ca7335de0e03b54e765224bfa6
MD5 48758f1f02ab83258da269473cfb8075
SHA1 b677968acbc7efa7b0c2f981c037c6217e628a4f
SHA512 da2a34da77481b8b90c5cd73b282b63be687aa936ced416f4bbf671a53d0473362ae20b90d905e597b72516ea8caf89f153637c2424e7735111cb463a602f80a
SSDEEP 24576:e3YgnJcRTk4yti+R5dBR/4fJ4yL/tNCJPXUQrPu:eIgnaTk46pBR/4fJ4klKXnW
TLSH
T19645B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 6f8a00203acfc92b055bce8554eee469215d96d8c7a9be8634972fe6d31c9d20
MD5 803ed6c34a74dbe97a75f6f34739f829
SHA1 4ed01a18cd92ea69d593d59b64461627c8285b09
SHA512 e6500eeea1581f3640a6c3c982a8310a062234ee074bee91b64a462370390bc05f547e325358fd4f7b219c4e04ffb938620e55a424e3e71e334ae8e63baa849b
SSDEEP 12288:VZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:VZfJ4yL/tNCJPXUQrPm
TLSH
T17FC423EB6094948ADE6587F81A48E001D3047FC5272F62E7AE82B4817FFD99B15BC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 27e546cfeae8e5a1790f3e7b36c9f7b346a4ef94e030eaadf2f64476a5cfe8dd
MD5 67da8aada1c0087abf915931f6779a6e
SHA1 f6917db6fea2723a5f19d3dbe62f92c202a5d383
SHA512 70b8e0d6183c41dc08ed96e280ff1a0edd53ac41384f4f498e9f958943e96ad83bd2195b7ad0d82ac496421a02397cfe71b170288dbde0074ac90c28c0218737
SSDEEP 12288:BObIA4LWOsvAYFT6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:2AL3UT6fJ4yL/tNCJPXUQrPs
TLSH
T1D025F155E29400F9ED7BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 1eb100ef1f9ebe43d4b1bae5334958cf1311e735f85e8ae477d03dfb6a35e17a
MD5 7ee3d10906e1cc37812b8b24203495be
SHA1 4319edc61f39cfe443c980d80545d633806ee708
SHA512 b4cd8d23db413ae6d1603b2c182c9852d308c16344e1fae0961e161b7cfba5afb8c0ff3f45472f1f8f62de811b9a5e55aaecf6b19bef3592c4897dfe89c6da51
SSDEEP 12288:ZpFtvO2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:/O2fJ4yL/tNCJPXUQrPN
TLSH
T15BE4026A32EC10E5D576927C4A85D209D331BCA6172653EF46D080AE2FF7EE82C39761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 574bc618f504f18f6907f932a8576cc3816b208215a740cfebf4dbd7a8e24296
MD5 23db0cefcaa0b71d619f61c935b146c4
SHA1 03dc427e99481bac04e2483d8e0a387ae2401a57
SHA512 c9cc878f126d36ae079e854f19132614b2328b28f99bb6d1140e46a09bc9810e9a61e68535fd473e95b386a553a03ca3ae9407ef273f4ae254fa253762a255cc
SSDEEP 24576:V7NM9YqZqmWMUkPjZM48Mv6bEhsdfJ4yL/tNCJPXUQrPs:V7cBWMpPjN8DbEhgfJ4klKXnk
TLSH
T1A965AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2ae1805fed0a1ef963724e8bb9811db43e1474cf0c16a645f2572ed74a648d66
MD5 fb0bd24d82e23381572f52c0d0c1acd9
SHA1 0f4f225878ad7cf3de852ec2ed7fdbda36d06475
SHA512 77291918ea42305a7a6a6641ba1d0bb27ae94e501490d5bfdd9d1839bfbb729d59ad5c68d0757724b6d6600ea974f2d326bdb8bde090eca54eeed42066fd45a0
SSDEEP 24576:FW6BApg2YuyuNDYTabvcdvNYf8km1jfJ4yL/tNCJPXUQrPX:FF2YuHNETovAvNYf8km9fJ4klKXn/
TLSH
T145858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\SgrmBroker.exe
Size 1.6MB
SHA256 920bcb954b3bbd88f36319c575644afe0317beeed7b778a99486f5c84a968007
MD5 62c0e31ac3e2c18684c9388f601011d7
SHA1 20e35b02c7b013dc4bf7b864177562a76cb60bc2
SHA512 b3477e0ff7a6369be1ce159868c0bf9d0f9e05b14ba44eaebde60e9c09e11a4c28bc274b7e3f42118e3276bf8a1ff0067abdc70d2602ef8f84aa7ddb36d4404c
SSDEEP 49152:40K+7mSLXfJ4klKXnG4/91Uc5fv5050xJITAEm:fnfJ4kY1Tv50axJI3
TLSH
T10E75127E63AD04E5E97AC17D9A53C806E67274A10316A6DB0690C1B93F9BEE43D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 d1797e3d422b0b7a2b35004a282b04e0bd96dddfb9abaa790daffda8b53af3c7
MD5 c49612ca033330dfa254fa0a62ead34d
SHA1 98f8691b2e4000846fe2ae7e53af429a8cad8036
SHA512 7e3685247cc3b4e355358c0a2fd69403dfa001ddd0fe84904995bc5004036a0a83e5184cef81366f60355d4ecab9ca3d9fbbd51e848a7952284c95ca037befb8
SSDEEP 24576:hAFs06+Omlf8NXEbToCfJ4yL/tNCJPXUQrPY:2Fs060loXuPfJ4klKXnA
TLSH
T18F65AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 f3dd1654b1e3ab068c9a0134a8fe5c7cbad985a5635874cbf423cec75c67a595
MD5 5ab35809cd1f0a0cae1989b573eb4ba8
SHA1 42b11aaa399e5a2d3964f4ef7460930711684a32
SHA512 406275c254151ce83301aae2272d302920191c4e434d23a25ff5f0fb77d4724987514ef0b5a764e3876c8ccc7a0317d90bf3d1626c62a38f25df4fc98bb20942
SSDEEP 12288:BCJnJ5D3VkrDzx9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Ss:YJnJ5D3WXPfJ4yL/tNCJPXUQrP7
TLSH
T1D315D02DD2A810E8D4B7C3B482496746FF72386D2F226AC768B4D4353F16EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 37cb1c8a56aa541f48c3cb5c709f2a3037f14b017656f869dca0a854ecb891f4
MD5 2047d09c18e791d341ad4662501ec1a4
SHA1 4623d06517a97a7cfb7f2dd6379e5e1cb2e297b4
SHA512 e234fb8d85d07c0c68c2b25b89866d0c10e2e4c73c8b553c2bd771ccb5d77b6ae9ac25fd1aa97f0c815872a2457629d50f66152a3b296d65c38c61a68e557452
SSDEEP 24576:wEPghm6/7IIXdwcXrif7qQncjlP65i3Vu4fJ4yL/tNCJPXUQrPM:Pg06DIKdwc+eQnSt65aVBfJ4klKXnE
TLSH
T125955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 ab89dd3492fc6e9bf032d0e33c7ed3e1409fb728b6f55b6a3dbd259c8117fb71
MD5 f8a0ee62f983a7a7e41a9c06551936c6
SHA1 d894a31b9d6bb36906b39ea0ab2e617be4cfec01
SHA512 a29378d00a311f6234fee3d8f4c20b0f690ee354135e4df7dba0959539b75beb10bea3b8ff36e9ea7492f59e603a978e1d744187a2b5028212752592c265530e
SSDEEP 12288:hEP3RnrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:SnrfJ4yL/tNCJPXUQrPW
TLSH
T174E412AE229CA0D9D52691BC4680C101D331F4A12B2723FF5AD1D17E5FBBAEA1D3CB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 57d4b0948930b2d6ef96410870aff216f8d11bfd4a4c6d8380303d1d6fb70d5a
MD5 dc97fffe3e9bb7e1f265fdc2ff0496dc
SHA1 cdc4907bcb2e30b5e3040bb98b4a81db1cfb18df
SHA512 c3456532d86531b9eaf81aefc79767d962d4d76941044aeebd18336a274e5bb8ca11b587f5378cef5d0fd7199940923ecacca1bd37d8b4dc90f88bf00db4e4b2
SSDEEP 12288:4jkywfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:4IywfJ4yL/tNCJPXUQrP9
TLSH
T10DF4224A23D4A085DAB647BC5A51D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 1.4MB
SHA256 4939b0592ed20db726c0bfc5d6c420802213235cd717820369b16f45351c068d
MD5 5b63ee5e16353c1bb1bf0a9100162a2d
SHA1 8612be5c489f43cd6c579ea186d7f8f8d84d2992
SHA512 ddac566dcfe7a01991e034ae58e6f65984a336845c9d06c57293a90ccf0cc799301a0f3746383a10cf2605a39c7d8c003f7dc6407584691ebe0d4893f3409eac
SSDEEP 24576:X6fJ4yL/tNCJPXUQrPicWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlx:X6fJ4klKXnKN/91Uc5fv5050xJITAEm
TLSH
T17765236A22D424C9EE7596B14B35C000C731BCA1271BA3FF69D1D9B96FBDAD81C38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 aedd2df6a1a7ba023bd4415bf1c7c75a69bdc87caf6da486b730f9019c6af709
MD5 8941a7fa3915b7ea15f7e0fa8b188767
SHA1 d38560dcc86ccc86415c25acb4267b6ae6c3c89e
SHA512 10c92e8f42b8d1851e00a992d97bf8dce535121ad068448d6668d39bb774eb89b9c54b3e477f99f42ae43b39a592923298b69a3d3f40ccc104421d45e569be5d
SSDEEP 12288:DymfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:umfJ4yL/tNCJPXUQrPg
TLSH
T1D6D423AF2095A089DE2687F81648E100C3147ED5272B72FB9DC2F4A17FFD99615BC782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 c104019877d04d47f1f0dd2d48a4c8c0041f343cce9227d69829f05c1b38619b
MD5 b67ae4098555dcee6a2001cc5da4f94e
SHA1 033e865eae9fda3702d1d96cb90af652375e5b4d
SHA512 a8d3675b88becbc29f889050ca8350c655dc97102d01376ff88520e095c1bca2ecaf45976d3e84039e8385a557effe9e4073190cd1a2e45d48c96a6b6aeb46c0
SSDEEP 24576:WQ9MxZKdcz9ew36WOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlq13k:WVKi3/91Uc5fv5050xJITAEm
TLSH
T152659D2DABE9098AE177D27595B240C3A633B4311B35D6CF2448D13D4D7AEE8AE34F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 03331bd8a3be89f8c91dc217520a7f1b5209f9613d5d014041b09628e7869cd8
MD5 c655e5cc1dde1c9827cc6a093456c6dd
SHA1 f701eea0b6fdd918677aeab85bcb125d837d446e
SHA512 174eb12c14607799e871a42db8f5a2e569a422d6e7ef603a07d63ae54e26950543a38e1323b5097861638cc3dbc491db4209c4c5eedca13b016fe12ad899e0a9
SSDEEP 12288:VyoKo2JRple9pMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:VyocDApMfJ4yL/tNCJPXUQrPE
TLSH
T185F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2d6ed2f6a19219acbf482667ba5195a57f48204f6566b5243c9aefb2b2b4d4f1
MD5 ca8175d4910d5264778f67a1730216c3
SHA1 d30bb8c491589c36f771c1f9fff80ad6346a9b81
SHA512 acdc62b8f740609f2c057800a75b1c631cfff61a9ef22edf0f7c781c2d6f23a5659ec1d8ad547526e77839974a4c50c9f02218ddebe15953381791392373f1e5
SSDEEP 49152:bWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKMfJ4klKXnh:L0zuNI6fJ4k
TLSH
T1B4A57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 df6c9832a289d78b1964057c773dc59370d2ce333318db68acf4fc4ea8305b98
MD5 6144716db7a83ed975bbc7c7836a88c7
SHA1 2018888bdd61a6496b8743c0241197ebc9e2b0c7
SHA512 095db5e94a6857e407c33c80ad7c4bd1c82f97a95236cb2875b91064a7ba3de9c13e72b4b38f450f4b0fe82f6ab39ad04c2809034c1676b455738fb803a03cc3
SSDEEP 49152:GTDxR+N5YzTDjMWfJ4klKXnGR/91Uc5fv5050xJITAEm:Ou50fJ4k91Tv50axJI3
TLSH
T10AA5E12EA7F815E9D1BE85799B23C502FB727851033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 df9ea7af0f381d911839450a30c334e85285b6d4b74d82a4a5fe2a828d20f83c
MD5 46d496f835307f74174d741c82d7022b
SHA1 b79d90abe37410bca6bd89c9b97fc28c9122854e
SHA512 5d2185dbd2609c98bf5110be396681f234f435291d264b10dd886a9867e5c0bb0677c9dc0d9fee8cfa7a0c394b40c037cb0feb002618c7c7241038dde3f603ed
SSDEEP 49152:/0K+7mSLXfJ4klKXnG4/91Uc5fv5050xJITAEm:AnfJ4kY1Tv50axJI3
TLSH
T10875127E63AD04E5E97AC17D9A53C806E67274A10316A6DB0690C1B93F9BEE43D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 d4a741050a2b74d717ed5638c447b98d3404288473cbdb19cdb8eb4b24746a05
MD5 38682c590bb4b08f7c67c320ce804eb7
SHA1 2c920b1a9b7be8b69cbdd23fdfbe862e1fc65e2f
SHA512 c505c89441f3746b6263edb8dab2328831c28e54c56d6be3c02ebf0671781ba022ddd1957aac8bc747c5ed256ae2c6e2505104a60d53383501b509f8f66ad17c
SSDEEP 49152:v4gSyTk46pSR/4fJ4klKXnWS/91Uc5fv5050xJITAEm:vyHfJ4kO1Tv50axJI3
TLSH
T1ED95E12EF2B910F9D8AAD136450143B5FB71782D1F219ACB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 60d37838f404c26b072c67d72ee729f17c7b8d78a37adfb0790fe779663951c7
MD5 e1f0d2b423caa60a5a38a44ef367b990
SHA1 5ebd655cfe4b286ca4d4c7d0ee839995eebfa62a
SHA512 0a16e3fdacb7c88768aef00c44e4102db5b5c14e042a1273512f515c106df6a2bc017c2a6cd8a24f2ae4c79fea47340c9d7d5d03e52daee9a2829e9b1c1b8679
SSDEEP 24576:z6fJ4yL/tNCJPXUQrPicWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlx:z6fJ4klKXnKN/91Uc5fv5050xJITAEm
TLSH
T1B765236A22D424C9EE7596B14B35C000C731BCA1271BA3FF69D1D9B96FBDAD81C38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/520-424-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/520-209-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/544-85-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/544-203-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/564-188-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/564-409-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1208-97-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1208-208-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1208-95-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1208-89-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1256-423-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1256-135-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1256-273-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1296-229-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1296-129-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2152-393-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2152-167-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2152-165-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2152-159-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2284-212-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2284-109-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2284-100-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2284-106-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2328-64-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2328-82-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2328-72-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2328-125-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2328-70-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2432-24-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2432-32-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2432-33-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3016-204-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3016-206-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3040-143-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3040-333-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3040-152-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3040-149-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3052-426-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3052-226-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3172-453-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-444-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-473-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-470-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-471-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-472-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-469-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-468-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-467-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-443-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-442-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-445-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-446-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-447-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-451-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-454-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-455-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-456-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-457-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-458-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-459-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-460-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-461-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-435-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-436-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-437-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-440-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-439-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-438-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-441-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-448-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-450-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-449-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-452-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-465-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-466-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-464-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-463-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3172-462-0x000001A8B3F00000-0x000001A8B3F10000-memory.dmp

Download

memory/3384-47-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3384-139-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3384-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3384-41-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3824-7-0x00000000025B0000-0x000000000274A000-memory.dmp

Download

memory/3824-5-0x00000000028D0000-0x0000000002955000-memory.dmp

Download

memory/3824-49-0x0000000000400000-0x0000000000964000-memory.dmp

Download

memory/3824-9-0x0000000003150000-0x00000000031B7000-memory.dmp

Download

memory/3824-16-0x0000000003150000-0x00000000031B7000-memory.dmp

Download

memory/3824-6-0x0000000000400000-0x0000000000964000-memory.dmp

Download

memory/3824-0-0x00000000028D0000-0x0000000002955000-memory.dmp

Download

memory/3904-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3904-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4036-108-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4036-20-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4244-425-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4244-213-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4348-140-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4348-280-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4632-120-0x0000000000690000-0x00000000006F7000-memory.dmp

Download

memory/4632-115-0x0000000000690000-0x00000000006F7000-memory.dmp

Download

memory/4632-225-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4632-122-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4752-239-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4752-271-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4752-427-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4752-255-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4752-230-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4752-433-0x000000000CCF0000-0x000000000CCF8000-memory.dmp

Download

memory/5008-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5008-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5008-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5008-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download