Overview

overview

8

Static

static

3

2026-05-04...op.exe

windows10-2004-x64

8

2026-05-04...op.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/05/2026, 11:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-04_b7de0aa55fb54f26eb2fda07e86d95a4_darkgate_elex_rhadamanthys_stop.exe
  • Size 1.8MB
  • Sample260504-n57e6aev7k
  • SHA256 73f5b231a4c56421c33e5fd1080c4f96beba90205f214a66aefcc395a2a18ca7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 35 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-04_b7de0aa55fb54f26eb2fda07e86d95a4_darkgate_elex_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-04_b7de0aa55fb54f26eb2fda07e86d95a4_darkgate_elex_rhadamanthys_stop.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5224
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
      2⤵
        PID:2932
      • C:\ProgramData\Adobe\ARM\S\26181\AdobeARMHelper.exe
        "C:\ProgramData\Adobe\ARM\S\26181\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\26181" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\26181" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4308
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4400
    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:4872
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
        PID:5748
      • C:\Windows\system32\fxssvc.exe
        C:\Windows\system32\fxssvc.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:1640
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:3772
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:4916
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        PID:5992
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:5660
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:5500
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:5876
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2104
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:5976
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:5700
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:892
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3556
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:5872
        • C:\Windows\System32\OpenSSH\ssh-agent.exe
          C:\Windows\System32\OpenSSH\ssh-agent.exe
          1⤵
          • Executes dropped EXE
          PID:388
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:2776
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1600
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:4320
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1692
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3492
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:2752
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2248
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:5540
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 904
            2⤵
            • Modifies data under HKEY_USERS
            PID:4944

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              AdobeARM.exe
              • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
              • Size 1.7MB
              • SHA256 669a54b37bbd034617a49248da51ba08e0fb860ac0522dff10ba33c44601961e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 31d3f74a4f1c1bd7f43e75f31c3625715fb3cc789fd0925536560cb181d72f26
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 849KB
              • SHA256 4f4f255ef7a400742641da0289085a7d18e545d6d9cbcba3163e976a076fc00a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.1MB
              • SHA256 92856124ee9278d7c2272833836dfb1219b6e3fbf34f6a5c6a4edf721224ba40
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 2ca4873fda9f183c45880ec1649b78b13d5a2af9d8f0e6b5c2acb1380180353b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.3MB
              • SHA256 8fdd87d98bb076a48ba842bad142287256ac3b00bec06f5f42ddc6aff97d515e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 603KB
              • SHA256 4be95813a1477d3af42f831db52e1748489fdb18501549dd0cdf233a87bc54d0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 863KB
              • SHA256 032c010561bb4302b42753467af7fe993ba725f5b7cfc225e4471a50256af5ef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.7MB
              • SHA256 6f1e68c61d5a7dfe5f9fddf9c29206e7ea12f17e4e7e0ae2dc6dc0c3f718b671
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 932KB
              • SHA256 f4cfa39f5f9b26030614a3dea2246a6744e3271ce836ab58ce30ba2b61c80617
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 aaa8ea9502e7204d4080a99e4279e307b7bc520f8d7cf4b0d4d27ba4de2feca2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 6a4e15644f975407426732abf41388aabd33574cf5e56cc2f79ed974a8f880bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 dd60bfe27dda9b9e754c403eae32d18d7bc813893c7d188885a28943c45f71f2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 829KB
              • SHA256 5dd7755da0dccfcc2dd90a6104a5659eac5895954165ff7534968fcb2a416c3e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 679KB
              • SHA256 75f5e3247acb669240963e49b969d95e2c92c7e8b84856c4ac736197c9f67d53
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 38ee4c64de2efe2b058000272ba78e0daeec32b6674b8a2df6d578e320cbeb95
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 7cec17433d3a2a7838843ecce3f9e6fb845f1487ef22ed71230fd02f8d9dcc1d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 e69c4b9733e64d2d1af57c2d80345dd4ae603e196d38b5d8f1c632c9076d9aa7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 722KB
              • SHA256 def56aab37a8fb97666989efaa8e9d0e7acd7393e7aa1ccaebfe0d465043c4eb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 102B
              • SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 1KB
              • SHA256 4952bf79dc925347bbceaa89752036a0ffcd844cfad74833bb96e757bad04572
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.msi
              • Path C:\ProgramData\Adobe\ARM\S\26181\AdobeARM.msi
              • Size 1.0MB
              • SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARMHelper.exe
              • Path C:\ProgramData\Adobe\ARM\S\26181\AdobeARMHelper.exe
              • Size 413KB
              • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrManifest2.msi
              • Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
              • Size 18KB
              • SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 471B
              • SHA256 b3c4bf9650881a4b53d7bd875c0f628570663cbe01d37b37faae0d121e511c8f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 727B
              • SHA256 760f0f1f65d0019f9e362cf0af2afc0e1c90454a120e174ce01d34c5f997fe85
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 727B
              • SHA256 1b7a51391e61f7941b66ce0be46bb6f670ecc80055ba72168bfc834a6ad59c90
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 727B
              • SHA256 ae479d4ecdc5eab901290785ee6e30fbcefb56fb3a8d8aa22e0e7c8e321d349e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 400B
              • SHA256 5434d959a4813a611b1b491cbf468b64093f7d350b336f5a2eb8c7e733128a0a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 404B
              • SHA256 8ae40551a82e81d4e7ddd0409e9fedd383de3ddf960f046fbf89df09f0bfa9e5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 404B
              • SHA256 5bfac9d831a774d38a6c6e0220429aec33c18fb3a0ec09f5b2901db26568d047
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 412B
              • SHA256 53dcc8a52d52980048aa71e796801f017c74de3cbff2efacfb800eebb672cb99
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 1KB
              • SHA256 fccd4d3c93ee03817da68fbf2f38e2ad6b862bbf9015b4a3e19bcc3006314420
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 1KB
              • SHA256 ce7d9e53b22dc7bba19583aed5983e311f72744a7e2bf66f9d87ccc888f72f99
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
              • Size 251KB
              • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp1413.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp1413.tmp
              • Size 5KB
              • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpB05F.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpB05F.tmp
              • Size 5KB
              • SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpDCFF.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpDCFF.tmp
              • Size 5KB
              • SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpDDDB.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpDDDB.tmp
              • Size 3KB
              • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TmpE3E7.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpE3E7.tmp
              • Size 5KB
              • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              59117704fd664f35.bin
              • Path C:\Users\Admin\AppData\Roaming\59117704fd664f35.bin
              • Size 12KB
              • SHA256 d684cdd8b35d9d850994377d415757abc01b8b88e9b18650c3cbc6e488825648
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 610KB
              • SHA256 720c0d93e30a18958b9e72d10687f403efefde0dfe66fd24b697ef4cf140c4c1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.8MB
              • SHA256 baeb0abdf9a0a10b054517a2555b17dddb80a7e060a689846312a94203b18a79
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 681KB
              • SHA256 447f047371e5ffcbe10168ca529fb8fd008837f7879723751a9cb06977a340b3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 36f0f655bc8140494a5fdd18794b05023961acd16881a40d240df13fa79abb10
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 600KB
              • SHA256 99bc1f98513828e1a4545f55b0d275485c20734372998d60f5ea51edda5aef69
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 963KB
              • SHA256 87457fdbcf755623ffcf46f0a0e6cfbad0031bf5384a0692dc27aa0005eb068d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 693KB
              • SHA256 74fa68baa8bfffd9ece95e8b36cbf6e76c5de076c8a005d3514b589ef1e95723
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.5MB
              • SHA256 74a6f66e960f64afe181aef7b9ec5366d0e4cb5cd26b4db816ab6935b9b53710
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 f61ff3597e13eefff7385e0f67edb33ca701eb518523d96a20cd35413b28d238
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 cb8804eca3b4b52fd517738eb9bca788d023ac5b95d955ae3c66a8ff6812c44b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 907KB
              • SHA256 241716b3d47c0104a74ef296d5d81c6b5e6d007730eded4e73be9bcd738a984f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 608b5ee961371c62647b9fb3c4cd16e3bf3f80af96be98695cab89cdd0468d8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 682KB
              • SHA256 fa72ddac1eba43a78cf5b6c4e66c817c1b02322a3cfe1a29d611f2235a5dacde
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 734KB
              • SHA256 076d52aa79f6d39d3e7e62caa4b25f0b611078958b535bec6a11b01df47f5db5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 605KB
              • SHA256 45fa2d171e8c3dff494de2c29b894ce8a2a97eb9142184d393eb0a72320176e9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 42de760520f166c93b04409eea53948780d12f8fca9b4152aee710b3122e27bb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 794KB
              • SHA256 6b7674b9276a0f5c59e94f6ec263cf9bc883abd097cf3195f07243cb5bfa67d1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 2ade5961bfc3db10c94ebd2e1eb2cc30ad8bf070f40c624df72b9f71e4c6d3db
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 c875e70cf48a92248551b02c1c5f375649752d2bcd6422b3ee11c4a3d719d5b7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 899KB
              • SHA256 50c1f5235e76260c4cd00c38e8a824c41e29c43d4611b01909c8d0d9554c9aca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 657KB
              • SHA256 815bbfc8ea16b029d3d22632763e6be6ad596862391bd5e4046a2fbf932b20c2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/388-236-0x00007FF6A1E60000-0x00007FF6A204F000-memory.dmp
              Download

              memory/388-343-0x00007FF6A1E60000-0x00007FF6A204F000-memory.dmp
              Download

              memory/388-354-0x00000271FC6B0000-0x00000271FC6BC000-memory.dmp
              Download

              memory/388-237-0x00000271FC640000-0x00000271FC6A6000-memory.dmp
              Download

              memory/388-238-0x00000271FC640000-0x00000271FC6A6000-memory.dmp
              Download

              memory/892-294-0x00007FF6F9C10000-0x00007FF6F9CBB000-memory.dmp
              Download

              memory/892-220-0x000001972A0F0000-0x000001972A156000-memory.dmp
              Download

              memory/892-218-0x00007FF6F9C10000-0x00007FF6F9CBB000-memory.dmp
              Download

              memory/892-219-0x000001972A0F0000-0x000001972A156000-memory.dmp
              Download

              memory/1600-254-0x00007FF611E40000-0x00007FF612269000-memory.dmp
              Download

              memory/1600-260-0x00007FF611E40000-0x00007FF612269000-memory.dmp
              Download

              memory/1600-258-0x0000022FD68F0000-0x0000022FD6956000-memory.dmp
              Download

              memory/1600-253-0x0000022FD68F0000-0x0000022FD6956000-memory.dmp
              Download

              memory/1600-252-0x0000022FD68F0000-0x0000022FD6956000-memory.dmp
              Download

              memory/1640-122-0x0000016348710000-0x0000016348776000-memory.dmp
              Download

              memory/1640-126-0x0000016348710000-0x0000016348776000-memory.dmp
              Download

              memory/1640-121-0x0000016348710000-0x0000016348776000-memory.dmp
              Download

              memory/1640-128-0x00007FF75FD00000-0x00007FF75FF88000-memory.dmp
              Download

              memory/1640-120-0x00007FF75FD00000-0x00007FF75FF88000-memory.dmp
              Download

              memory/1692-269-0x000001D5711B0000-0x000001D571216000-memory.dmp
              Download

              memory/1692-356-0x00007FF7EAAF0000-0x00007FF7EAFCD000-memory.dmp
              Download

              memory/1692-273-0x00007FF7EAAF0000-0x00007FF7EAFCD000-memory.dmp
              Download

              memory/1692-268-0x000001D5711B0000-0x000001D571216000-memory.dmp
              Download

              memory/2104-342-0x0000000000DC0000-0x0000000000E05000-memory.dmp
              Download

              memory/2104-188-0x0000000000400000-0x000000000054A000-memory.dmp
              Download

              memory/2104-194-0x00000000008F0000-0x0000000000959000-memory.dmp
              Download

              memory/2104-189-0x00000000008F0000-0x0000000000959000-memory.dmp
              Download

              memory/2104-274-0x0000000000400000-0x000000000054A000-memory.dmp
              Download

              memory/2248-381-0x00007FF6E7E80000-0x00007FF6E81D4000-memory.dmp
              Download

              memory/2248-360-0x0000027BEDC30000-0x0000027BEDC38000-memory.dmp
              Download

              memory/2248-304-0x0000027BE43D0000-0x0000027BE43E0000-memory.dmp
              Download

              memory/2248-320-0x0000027BE44D0000-0x0000027BE44E0000-memory.dmp
              Download

              memory/2248-299-0x0000027BE34A0000-0x0000027BE3506000-memory.dmp
              Download

              memory/2248-303-0x00007FF6E7E80000-0x00007FF6E81D4000-memory.dmp
              Download

              memory/2248-298-0x0000027BE34A0000-0x0000027BE3506000-memory.dmp
              Download

              memory/2248-336-0x0000027BEC9C0000-0x0000027BEC9C8000-memory.dmp
              Download

              memory/2752-364-0x00007FF7110A0000-0x00007FF7111DB000-memory.dmp
              Download

              memory/2752-286-0x000002391A2C0000-0x000002391A326000-memory.dmp
              Download

              memory/2752-292-0x00007FF7110A0000-0x00007FF7111DB000-memory.dmp
              Download

              memory/2752-287-0x000002391A2C0000-0x000002391A326000-memory.dmp
              Download

              memory/2776-350-0x00007FF60D970000-0x00007FF60DAFF000-memory.dmp
              Download

              memory/2776-244-0x00007FF60D970000-0x00007FF60DAFF000-memory.dmp
              Download

              memory/2776-246-0x000001CC0DF60000-0x000001CC0DFC6000-memory.dmp
              Download

              memory/2776-245-0x000001CC0DF60000-0x000001CC0DFC6000-memory.dmp
              Download

              memory/3492-279-0x00000251740D0000-0x0000025174136000-memory.dmp
              Download

              memory/3492-283-0x00007FF6A98D0000-0x00007FF6A9DFB000-memory.dmp
              Download

              memory/3492-363-0x0000025173630000-0x0000025173AA2000-memory.dmp
              Download

              memory/3492-362-0x00007FF6A98D0000-0x00007FF6A9DFB000-memory.dmp
              Download

              memory/3492-278-0x00000251740D0000-0x0000025174136000-memory.dmp
              Download

              memory/3556-227-0x00007FF6E3E80000-0x00007FF6E41A4000-memory.dmp
              Download

              memory/3556-228-0x0000024F5D030000-0x0000024F5D096000-memory.dmp
              Download

              memory/3556-226-0x0000024F5D030000-0x0000024F5D096000-memory.dmp
              Download

              memory/3556-297-0x00007FF6E3E80000-0x00007FF6E41A4000-memory.dmp
              Download

              memory/3772-131-0x000001823AE30000-0x000001823AF2A000-memory.dmp
              Download

              memory/3772-133-0x000001823B050000-0x000001823B0B6000-memory.dmp
              Download

              memory/3772-132-0x000001823B050000-0x000001823B0B6000-memory.dmp
              Download

              memory/4320-357-0x00000255EDF40000-0x00000255EE3B2000-memory.dmp
              Download

              memory/4320-264-0x00007FF6FF2F0000-0x00007FF6FF5AE000-memory.dmp
              Download

              memory/4320-355-0x00007FF6FF2F0000-0x00007FF6FF5AE000-memory.dmp
              Download

              memory/4400-18-0x00000153411A0000-0x0000015341206000-memory.dmp
              Download

              memory/4400-15-0x00007FF7A9CD0000-0x00007FF7A9DB7000-memory.dmp
              Download

              memory/4400-179-0x00007FF7A9CD0000-0x00007FF7A9DB7000-memory.dmp
              Download

              memory/4400-16-0x00000153411A0000-0x0000015341206000-memory.dmp
              Download

              memory/4872-27-0x000001A3B3A10000-0x000001A3B3A76000-memory.dmp
              Download

              memory/4872-26-0x00007FF7228D0000-0x00007FF7229B4000-memory.dmp
              Download

              memory/4872-29-0x000001A3B3A10000-0x000001A3B3A76000-memory.dmp
              Download

              memory/4872-200-0x00007FF7228D0000-0x00007FF7229B4000-memory.dmp
              Download

              memory/4916-139-0x000001C43A100000-0x000001C43A1FA000-memory.dmp
              Download

              memory/4916-140-0x000001C43A320000-0x000001C43A386000-memory.dmp
              Download

              memory/4916-141-0x000001C43A320000-0x000001C43A386000-memory.dmp
              Download

              memory/4944-368-0x0000025239BD0000-0x0000025239BE0000-memory.dmp
              Download

              memory/4944-370-0x0000025239BD0000-0x0000025239BE0000-memory.dmp
              Download

              memory/4944-367-0x0000025239BD0000-0x0000025239BE0000-memory.dmp
              Download

              memory/4944-366-0x0000025239BD0000-0x0000025239BE0000-memory.dmp
              Download

              memory/4944-365-0x0000025239BD0000-0x0000025239BE0000-memory.dmp
              Download

              memory/4944-369-0x0000025239BD0000-0x0000025239BE0000-memory.dmp
              Download

              memory/5224-235-0x0000000001850000-0x000000000190F000-memory.dmp
              Download

              memory/5224-0-0x0000000003280000-0x00000000032E9000-memory.dmp
              Download

              memory/5224-6-0x00000000030B0000-0x000000000319C000-memory.dmp
              Download

              memory/5224-7-0x0000000003280000-0x00000000032E9000-memory.dmp
              Download

              memory/5500-173-0x00000111D9150000-0x00000111D91B6000-memory.dmp
              Download

              memory/5500-172-0x00000111D9150000-0x00000111D91B6000-memory.dmp
              Download

              memory/5500-171-0x00000111D8F80000-0x00000111D907A000-memory.dmp
              Download

              memory/5660-341-0x00000255F7220000-0x00000255F722C000-memory.dmp
              Download

              memory/5660-263-0x00007FF681F90000-0x00007FF6820A4000-memory.dmp
              Download

              memory/5660-161-0x00000255F71B0000-0x00000255F7216000-memory.dmp
              Download

              memory/5660-160-0x00000255F71B0000-0x00000255F7216000-memory.dmp
              Download

              memory/5660-159-0x00007FF681F90000-0x00007FF6820A4000-memory.dmp
              Download

              memory/5700-288-0x00007FF77DB30000-0x00007FF77DF9D000-memory.dmp
              Download

              memory/5700-209-0x000001F6BD190000-0x000001F6BD1F6000-memory.dmp
              Download

              memory/5700-349-0x00007FF77DB30000-0x00007FF77DF9D000-memory.dmp
              Download

              memory/5700-347-0x000001F6BD190000-0x000001F6BD1F6000-memory.dmp
              Download

              memory/5700-211-0x00007FF77DB30000-0x00007FF77DF9D000-memory.dmp
              Download

              memory/5700-210-0x000001F6BD190000-0x000001F6BD1F6000-memory.dmp
              Download

              memory/5876-180-0x00007FF653CC0000-0x00007FF653DAA000-memory.dmp
              Download

              memory/5876-181-0x000001CB3B030000-0x000001CB3B096000-memory.dmp
              Download

              memory/5876-267-0x00007FF653CC0000-0x00007FF653DAA000-memory.dmp
              Download

              memory/5876-182-0x000001CB3B030000-0x000001CB3B096000-memory.dmp
              Download

              memory/5976-203-0x0000022BB9560000-0x0000022BB95C6000-memory.dmp
              Download

              memory/5976-202-0x00007FF742E80000-0x00007FF742F28000-memory.dmp
              Download

              memory/5976-277-0x00007FF742E80000-0x00007FF742F28000-memory.dmp
              Download

              memory/5976-201-0x0000022BB9560000-0x0000022BB95C6000-memory.dmp
              Download

              memory/5992-156-0x00007FF721B90000-0x00007FF721CF8000-memory.dmp
              Download

              memory/5992-154-0x0000029759E70000-0x0000029759ED6000-memory.dmp
              Download

              memory/5992-149-0x0000029759E70000-0x0000029759ED6000-memory.dmp
              Download

              memory/5992-147-0x0000029759E70000-0x0000029759ED6000-memory.dmp
              Download

              memory/5992-148-0x00007FF721B90000-0x00007FF721CF8000-memory.dmp
              Download