535d03bdc52ad3cc55f42404529127cad07a8edde4a3952fa5bc32bf68db5346

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
Size 1.8MB
Sample260701-mm2araby2p
SHA256 535d03bdc52ad3cc55f42404529127cad07a8edde4a3952fa5bc32bf68db5346
MD5 1715330c75de000b213186c984101f6b
SHA1 c0e729db91b548989663cff03992bd8e8f3e951b
SHA512 ce6de9c11fc5547101b89a1e5421ef1859010498f27f2448ec4497ed15b5c3a61bbfb5fab0ef0b574dcda9863986393908d36ec28e95b17f7af5cc51e2643321
SSDEEP 49152:JNZCWOLT4GPGnCmbK2MtENOx8T4LXS/UL:XwnLTHGnQzC
TLSH
T13E856B0667F94129F1F33B71EEB992645A77BC71AD3AC50E6280025E0DB4E90DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
2400	alg.exe
2832	GameInputSvc.exe
1788	GameInputSvc.exe
5868	elevation_service.exe
5296	elevation_service.exe
4972	maintenanceservice.exe
4124	msdtc.exe
3444	OSE.EXE
3048	PerceptionSimulationService.exe
5496	perfhost.exe
2568	ReFsDedupSvc.exe
1280	locator.exe
4436	SensorDataService.exe
2084	snmptrap.exe
3492	ssh-agent.exe
3004	TieringEngineService.exe
236	AgentService.exe
6064	vds.exe
2108	vssvc.exe
4968	wbengine.exe
6988	WmiApSrv.exe
7008	SearchIndexer.exe
1260	AdobeARMHelper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3f2f2dede819cbc6.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	AdobeARM.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1a620754509dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1788	GameInputSvc.exe
1788	GameInputSvc.exe
1260	AdobeARMHelper.exe
1260	AdobeARMHelper.exe
1260	AdobeARMHelper.exe
1260	AdobeARMHelper.exe
1260	AdobeARMHelper.exe
1260	AdobeARMHelper.exe
1260	AdobeARMHelper.exe
1260	AdobeARMHelper.exe
1260	AdobeARMHelper.exe
1260	AdobeARMHelper.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6728	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
Token: SeTcbPrivilege	2832	GameInputSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3004	TieringEngineService.exe
Token: SeManageVolumePrivilege	3004	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	236	AgentService.exe
Token: SeBackupPrivilege	2108	vssvc.exe
Token: SeRestorePrivilege	2108	vssvc.exe
Token: SeAuditPrivilege	2108	vssvc.exe
Token: SeBackupPrivilege	4968	wbengine.exe
Token: SeRestorePrivilege	4968	wbengine.exe
Token: SeSecurityPrivilege	4968	wbengine.exe
Token: 33	7008	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	7008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	7008	SearchIndexer.exe
Token: SeDebugPrivilege	2400	alg.exe
Token: SeDebugPrivilege	2400	alg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6728	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
6192	AdobeARM.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1788	2832	GameInputSvc.exe	91
PID 7008 wrote to memory of 2656	7008	SearchIndexer.exe	113
PID 7008 wrote to memory of 1236	7008	SearchIndexer.exe	114
PID 7008 wrote to memory of 5388	7008	SearchIndexer.exe	116
PID 7008 wrote to memory of 6004	7008	SearchIndexer.exe	117
PID 6728 wrote to memory of 3984	6728	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe	118
PID 6728 wrote to memory of 1260	6728	2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe	119
PID 1260 wrote to memory of 6192	1260	AdobeARMHelper.exe	120
PID 7008 wrote to memory of 4284	7008	SearchIndexer.exe	121
PID 7008 wrote to memory of 1856	7008	SearchIndexer.exe	122
PID 7008 wrote to memory of 1992	7008	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_1715330c75de000b213186c984101f6b_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6728
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  PID:3984
- C:\ProgramData\Adobe\ARM\S\22893\AdobeARMHelper.exe
  "C:\ProgramData\Adobe\ARM\S\22893\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\22893" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\22893" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6192

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5296

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4972

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3444

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5496

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4436

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2084

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:6064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6988

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:7008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2928 2904 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2960 2912 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2960 2912 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2928 2904 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 85df138b1d64493f4cce62f68b0ffe4e7517e5eb5c33913d9e212096dd581599
MD5 a95638a59cc69f80b2f382cc789c98c5
SHA1 2633830321d231f9c73a36548bbe3f833548f658
SHA512 8dde3f150d4565ed5e2c1640fa33e9c505fe2f3760210ca069e6c3f6772d843da132580543c91db13ac0ddb2eca518cc323b4211780f958ac31f7105f81e1da3
SSDEEP 49152:Tb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnHx8T4LXS/UL:x3q6gjB6C
TLSH
T1F8D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 51403eba44072ce134ed273346d8d2e14d38c9d29b659418d79ab46767bf0fcd
MD5 2e7f324d2d756eb4a3c5af794bc89c37
SHA1 52c1d6a216d4cc40126b70ba2928c8520bc89b2e
SHA512 a4f37c421d6a4b0b79e23904a49704d10926e42e1b0ad6409cd75e1291a7fe3dd8f15a53a6e51f025a43ea44fa62898038c458b3980cb9fd078f4fb7c25eae88
SSDEEP 24576:sXYXGjczAC+UWPF8T4z1huSmRNJVmIcT+:2jcwx8T4LXS/UL
TLSH
T15905022877D004FAEC67927CCC628915E77378964360E79B03A4D9250F273D86E7EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6e010afe19cc5356ed6e7c9730c6682f70102843b7fc396a9835ff63c63c0087
MD5 660e55f3e9a9954640f21f1ff7c5970c
SHA1 9d5a13fec6aa42d1302a895f55cdf2de8b6c367a
SHA512 c8a5717ba0ead5a7440c21612d2ddd43b2a08fa31830e6f9300cb7437d6a3f268fefb9ae534c9b254507a0b076197ffc4930beb1f5ba437cb40f48dfa374802d
SSDEEP 24576:N00ehjM0gyxOrMM+UWPF8T4z1huSmRNJVmIcT+:NyjM0PoKx8T4LXS/UL
TLSH
T181459E16F6748371D073C0B9C5D2A69EEA72308657308ACB4296D77C2F277E68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 802089b0ac9dec9257c5f92e7c1b2ac839fd44a95f63d9b9cfbc64a414e5d635
MD5 c7a58f0fb702202b440af3fbef6d4933
SHA1 a44b0cb429950ccdab005751b94844f675d16ac2
SHA512 a56ae87dac549e1601617fdfd607e15024db08235eac54686da92e48663aad1bf08db5886c960743ac45f6494b1b6c928cb884bb237e211c7a7675954ba7b87f
SSDEEP 24576:cKD/ezSC6vUyD/aqgrvW/6q8wyuu+UWPF8T4z1huSmRNJVmIcT+:z/ezSC6vUzPvuHjy2x8T4LXS/UL
TLSH
T1D6756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 cba86e649082dfc0e1150eaef5a075c1dd7997073ec368b22ec45cdf0ee4c6c8
MD5 755840e285169c63a2f3c3ef32caf0d0
SHA1 c788a2a8b911530f6ee4e7e8464f6ac3b82cd4ba
SHA512 379e4349aa3d1bad100f52aa0e17114fe230566dab534879b6dbe5a2a42dc37ed066f4f7f6dfd7dae48cf79c71345f121a489ca5a232bee978ac22d80ffb8af3
SSDEEP 24576:rabmPiFy4v/l+de+UWPF8T4z1huSmRNJVmIcT+:raXFy4Xl+px8T4LXS/UL
TLSH
T172559E66F6748331D073C0BAC5D29A9EEE3234425B318ACB1246D76C2E277E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 1e891d30979e17ba2840d5cb4c0c85e717cbf7c75d8fa302dab548bb8bf48015
MD5 50d9243d58b2de237bdfff7a82fa8cf3
SHA1 1b8f460a3def9acd06826671e168362417341e9f
SHA512 a710d8d3807104542e5579e1cf295ada692b7053f3adc8d70c73e16268cf58398dd2c674645b6b83faed47ca9f32e6f10434a6159a86ee69c38728102a89f5a9
SSDEEP 12288:AJZf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:AJZ+UWPF8T4z1huSmRNJVmIcT+
TLSH
T1CED4234E7B5591F3DA30BEF46D0D8DEE53B64DCB20629D526021FA4A012D368FEC50AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 2bc777ad4b5722115f636c058e0f9ad90adc2035c5c9b0f4e1d60b60ae8c0024
MD5 73f155c30df3203dd6cc8d38a7c6a5d7
SHA1 042d19a79bf1823184fb986fc4f2e9c2cf459c8a
SHA512 1408e359c9c2ee62230d7c8724713635403713b4d4842319e166dc3f44783732808ee79ed76e93aab98368373001c8833ed6a8d8a711d8eb4d6f9e708a62578b
SSDEEP 12288:XeBNUbTVO86UWDf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:XJIUS+UWPF8T4z1huSmRNJVmIcT+
TLSH
T12B15D03BEE28FCE2C27A9DB85A518640D77278714B2293CBD175C30E8E176E05EB5C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 a89f0fae0e8ccb8bec31a96d4037c47429bf65b57a61fbe10400ff93aa24f1af
MD5 6ce8995aa1ec0255e07a80cf943f32f4
SHA1 c14ed1b50ef98bac82875674ccb537387f355207
SHA512 6755d73fb584581b138a589b64f455dcfe2883fade06fbbceb2f8d59c8d779498f4ce797d5118afec6f43d30b594c4efad0a900aebfed389f1b960f7bb95ad8d
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ39DN5JPNRV3THg:nQvGAdlCEL8c/3RN75ClC
TLSH
T195367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 7c0901c96fa9449cd928e5a223ffde35963f19bf394842a06c4400bb857a826e
MD5 5b4041261fad9d425f93079a0750603b
SHA1 9650bed80069d686f11922c6e83486d940599300
SHA512 cb5b48a9d15e845870733d89201ab8d3aedc40943f9857dff7fc9e4d893eee6aae152faba56644b214cacfd0f2b696dd92b23373f6e32825fbc7b30130526021
SSDEEP 12288:yEwSfxL/2Dc3bDLLmt0LDQewsAjdf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVy:7mewsAjd+UWPF8T4z1huSmRNJVmIcT+
TLSH
T13E15E031FF74E032C37B0DB61B26C71A147D79610B6219C3E3A89E9E49342D267B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9b343002cdb5bec7731f73177370420913bcebe309609653351d630a96e274fa
MD5 ddef0005b08bf33ad4c5c59559fe9dd1
SHA1 3b864da862b0596da2a8c7750ede8da3482bce22
SHA512 f6f5af68a8e909889ac67dbe720fa3f5e465d41b8e0b707a745a02a6ce7d96fdb9d1a3e1b23b4eb345670e76aaa97d108e4846141c91f039f782654cb0e35cc1
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyXr8dPlbuJHq:BUEtQevvqc2W1cpV2XrI2q
TLSH
T1F5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 51ccd937c5e65281b496cfe5d2eb874b7295fc7e20965a79a666d0ce77c503ab
MD5 51a93593a10e6b23685fa7a4ae10d73e
SHA1 0555346796836fb93cf2365cee4ad4eb66e8e08d
SHA512 bbd73ebb7e82aa0a61b46eb5b94da3c7e44054fd39115a2799dcce5b049e11f8fe2f9ed93abe3d82a10da78a35ab81fb61920ab80a2c1316753a7babb401ed4d
SSDEEP 49152:hqbRquA/m2yL5zM8FiV+XenmE3/z4x8T4LXS/UL:WoqiVjnmRC
TLSH
T17DD58D0976B8C1E4D1F6C77886A2CA47F37178154B31ABEF4265461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9aeebbace767cd3e4e05640d7487c121704ef558857c5fc468171a2de4235e70
MD5 ea273a31ecba7535d3b59eb18a6e0567
SHA1 68e549efbdf3522f47c3b14ac5a023caab8b9f8c
SHA512 a00bbfcd088ed5aa245a247792f7cf8c198d21c10215d8db097fe75f42308e983d246ddb21ab3ea62da4f58402e5e6ccfc16b3869c544da9f92e76e19001f4e5
SSDEEP 24576:RAhGLvHFoiwtA5l7S53++UWPF8T4z1huSmRNJVmIcT+:RAMrFoiq5Xx8T4LXS/UL
TLSH
T10045AE81E7F951D4F5B3AAB89D768571EA76BCAA1E31C20F2160D10F0E33A509D64B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 08c09fb3a99d93a167d5dff4d04a4857a15c65ce649e6035b36333355212e88c
MD5 7c3d9365800e7ea14b43646042e688ac
SHA1 dc176ececc732dc4da6b2e7c40d8e218fed10f17
SHA512 e7ee5e8e736ab34b9e5e8fe34a46a65d4e3cdf222ceb724a212c85d6c2a103ca671c0857c8b6222157d82c99da7e326c96883e4eca8be89619f659bc035dbf11
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+Csvf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCI9:uwuuOWn+UWPF8T4z1huSmRNJVmIcT+
TLSH
T18005F14A77A40CFAE96696388947C53AF7F3BC422621DB1F1360C65B0F27361BD69720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 3f4f1573c317f21633d09d802e439e3b32f7d28aa98609d6e7a6b54d4c9da56a
MD5 5dab8de5ead31cb792760f3c3091f992
SHA1 96f30f08588f2a3cd8864df8e234712945363301
SHA512 47a5ce3d1444d367fe28b1d68b0ab44d5e748289549cba093961d42aaa6eb3a5337f4a46bee1609b2bf29b0f5c380f48331a2a930a80d57bf3515752ffb07101
SSDEEP 12288:nSL1Ii1f2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:SLua+UWPF8T4z1huSmRNJVmIcT+
TLSH
T1E7E4124E37E460F7D162A6B8DD994A89D3B23897233247CF1120C65A0F277D5AEB5332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6efafa7f897b2a4c87c44f4c4f237db6b76af3a4b9e479511086c9be7fb4557a
MD5 90709de403461e044a24736150fb5a6c
SHA1 875db894decd7a982bfb7c0a3febadd83fac3107
SHA512 522532b52d9f3297a627cc06d154c360dee46c0b0a102778000cd514cc057e704cde1a5b69e4d471b05d9755879a0113fcd7ca2855e0ecbc5100b3d1628d8840
SSDEEP 24576:ewvJaf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL05FgqyJVEfO/COu7:s68Qg55nhMeWu7PNU3/2ByVaOq
TLSH
T16CB55933B2F200A9C44DE1769F4A872196D17C71CFE0E3DB8555721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 175ce5780f5c64ce8288b568643d87bb2695038d829d85cd9fd8c0ae47fcde71
MD5 0e5f3ab326b7685ea0d75aa2d62fa858
SHA1 b07076d93ee6dbd648a56aed84060c07cdc0dcc5
SHA512 039b7cd3ae5e07102ea70894d7a5498c552bc1b1c4c5d71abbbd339a46def1fe83b8a8f60a42ab7d619bf22dc40907ea13debb05a10ec7576e6a035633dd18e9
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk994:0y5112gYy5azzVv569nLKnhZ3B1O
TLSH
T10F168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1cc2d32eafd1363867bfa7fcd459541a272e02d4df4f2a40b7390efdaa300dc4
MD5 a31db6884000470fad5b53eb2ec7cea1
SHA1 9b564f04e7afd006a8da0d0a2add4d5bd2c40d12
SHA512 1d06f4f67e762d3eab39e1c1f08c49fd13ef0905d9f35b2ca13112c0a3abb8285e437560705c04223c4c32140891d28b4d99e69feb5b087d58df3a1ecbe4d2e4
SSDEEP 49152:HB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glfx8T4LXS/UL:Ju6JmTxd2dfC
TLSH
T1D7D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 f8d4124358a62c9556aee68cdd56e9ef2df376b19d10bd0020d1427b0a8ab71a
MD5 6310f86a93183e4b123341d4b7a4bbdf
SHA1 e228b42d8ef1f381e46fb8ce401831f18f8da56c
SHA512 403897628ffd820e931a49dec50f67cb67bf55c871c9fd07daa7f8f8efc00a55b79a0122ce7aefbd00aa462887d074045f2a6a91cb553b619473c6365b246281
SSDEEP 24576:+cwvtk9RX6wkyAIz+UWPF8T4z1huSmRNJVmIcT+:aMnYIKx8T4LXS/UL
TLSH
T19B35D02DEBD844E2E077923C8DA7464AF2B178591B31C6CF125A936D0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 7e6b21c20ea4c2ffe610dbce49fe6322f6b7ba31a5600605a92989604879e65d
MD5 b98fc85ac401a85ca55e1644ca7dff43
SHA1 8cd18a5cc52c65f531a9b57eb95886820a5f4442
SHA512 d165161879ccc63ab29b7bafacc9caf2713d055fe17b0172aed0d97ea294d2b52788cdac32aab83466dd004bfbe30f1e4f304bae7cf16f499ffdd16cab6b055d
SSDEEP 49152:XY7YNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04x8T4LXS/UL:PySzPgC
TLSH
T11F067C56A16801D5C1B9C1B98F0BCC1BFBB134090335ABEB02E556935F6BAF0AE7E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 28e364808ea10cafbdd96ac1a7cf38ce09363b08fb20c9d634c0a451dfca296f
MD5 b291d1fa5814ef98a2140861fa9b042d
SHA1 b0f9eedf6bd23c4f3f3632519d056ea32b69e5cf
SHA512 cb21f6f0c1934fe44d957c5f2d3c0e467f4cd71c08b5a6ffd80a4ba61fcdd0452626ba10c1e4db8cfa852a345ffcde99cf3a58864c870944423d7465ed062106
SSDEEP 24576:wt7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYj+UWPF8T4z1huSmRNJVmIcT+:wt7JUQjXirIhCnDHUPfF/Mx8T4LXS/UL
TLSH
T11F65AE1EA3EC01E5E17AD27885154A5AEA71782E1B31CACF2270837D5F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 97a3276a49c81b5e14d98d1835e7c6ebdc0d7d8b4913dc1b0c83ee984cd685de
MD5 4172fa9ce0b0189509c42810b8eb0d52
SHA1 2f11a8d4bcb0fdca51a4bc54871d1d21de4cf458
SHA512 b7473020a39557cb77e3a5b05ab4028358bce07019965932b1b569b0b907a678976a1e48a6307635c1003fe0a230ca17d880432c6312b9721498f17273527ef6
SSDEEP 12288:ezifPo0gL+yFzTpEcAH1BRzO/q1Xkex76TyybkFobnKLmX6:XPFgqyJVEfO/COuUkF2KL
TLSH
T164F4011AE29415D8D1AE6178CB658640F3377C2297E1D3CA47C0F53E2F7AA809DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 102B
SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
MD5 c42592fd019ec4a186471c670ded3b4f
SHA1 2d5a5b980279b0305441b007778a31c18e84cfb7
SHA512 dc22dbfd7fd36284002bcaa73c2224d42afa850123dedac16c37ac48abddebf6d0c7db1d02793dcc9553d226de60a2cad8075a03be7efb4caa29e92157bb36d5
TLSH
T172B0125313D54C10F4101801CDF444337F2270C0680AC00CC0D1111744F0CC0CE622AF
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 824B
SHA256 c62557ca2d044a3b9ebd39042dcf529c783de02b64e466462aa6cb35d24135a9
MD5 730cdc49a49dc278867956cc11e8fad3
SHA1 4cf2bf16c29ae4538ba552700533463575edde28
SHA512 d9b58266132179c39e62a84ad80f32dd3836310b09c2c7b231137a7c70a6c343994466b0579248878f626fa849b3cea3ccbbe7a10c6967bec922241904f215ee
TLSH
T17C019A831AE91520F1B21F44DFF994735B337CA35C2DC86C90E8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 1KB
SHA256 0eeb54f5f9ab9f83b9702f383f2f244365693b049ccaae9a8c321c2feaa06e30
MD5 d73129a0589213a6394a0dc80c2f3bf5
SHA1 4247387c5b9bef07ce3cd3ec277766939643334e
SHA512 4379ae3856736e23eb4a389c70c457a186903c241426db396833eaf1ae2ae6bb1e3451145260fe2531014f001dd0c09a1eb5b8879101e495eb75791c09011790
TLSH
T1FF219D872AE90164F5B35F54EFF9947357323CE22D19C86C80D8124E4CF1A90D5B27AB
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\22893\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 41d54078bb4b943dfda9a56d9b99a81f54ac5e265cf44c8f55f6497cb0a7d4fc
MD5 b91cf15ba55ac0e5a65d3cdeaaf71f19
SHA1 a8f8a921dab370660b2bc5606de355372fb6b0f4
SHA512 17f4172578fc6d44ecd3bd7e98addbeee68253002c05e29f2fb4f2d38667c46d569087fd241ef5ff0261769f54e9279dd7496d00dd52e9be3b8d5d23487826d8
SSDEEP 12288:CnhIxU3fgKQp+qHjatDgCjY3IpxD0oZlGYVYTLICbMKLV:CnkUPM+WOtD7jqGNlJVYT8CY
TLSH
T1033538447666C78FCA6940321E37C1CCAB707D51EE44AB0772C88B3FD476659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 378KB
SHA256 1dda197fc828af723749f153834185eda7bcead21cfde4935e28a837c81ca575
MD5 acbc461fff3d0943f5d9c284b15c03c7
SHA1 97d40c323a6f026f20b7f566096522b8248c74c9
SHA512 f296b1f31f14afe6847d01951a025e74baf606776b79ba2791e896eb9b35cfead6644a6524a62385f4edf142a580fda4cbbb66ba9e44782546084fa92b9a5cfe
SSDEEP 3072:DD4D3ZRLF2NK77vxqNVFARDZDkHtc1BD5DL:8ZRLF2N47vxqNVFAEHtc1T
TLSH
T1BA84D8457369E31FC4B980330871A69EB739F4219F016F033BCC5E759CB116A39AA796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 727B
SHA256 b3703cdccef269991cbd76292d7e9821af4a9931c602e212abad853b5d3fd37e
MD5 da5e3587c0d1e9453babdd863adcbdea
SHA1 7ed29f32c2a131e3b1b409681a1bff8c2328c77c
SHA512 bf2ccd703f7ee2ea254b2f8a571ab89bb8ad5671d7704a56681c3db888960e5f22997e41f60e492e2f3986ffa9b6488c7e1263fe502148d13603e684af1453ff
TLSH
T1450149511EDD6B597F447468ED2C573DB3C390092BD489EB33164140908077157B65C5
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 727B
SHA256 28b919a3716cdbe4e38b676dd11074e40a5fdd851fb11cb43f91b12bfb7195ba
MD5 32e5fb4aefad891149d1a5d3f0e52277
SHA1 6fee67b2de013e4998b5cdec3c1e14ca8c208056
SHA512 6903ca64699eca5eb387ebe98c5557c45478f838d1eb856d5ad5c6718426ea3e9c2ba1c7c44dfc23420b704c8283cd60f410d4aa67bbcc275b21fac21edd2421
TLSH
T1420144465F6F2FF290028A6B6F68A6BBBA561152324E4247747E3DD4C01835B23C9349
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 404B
SHA256 e369efc90be8a78fe21fa345c9ef0d2b4c73293a855a5f38ffbce9ef2efbec42
MD5 21c55a9496f32420c87b79737f1ffc37
SHA1 4090f2e3683254d5a2790e482db96a0032b05fcf
SHA512 e229d7a44927608bef7930a7737495faa3f24a7e154c6c50161550a3ad37a48f53eea1ca0b7d873dfc034f62d6ee4b12a3e0d1e455409e37e6afcef7061fb8dc
TLSH
T1B0E0263435F9456EF2F5D5344BEA5C1258D9F24B098AD26A2580274EAB16FC04CF1634
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 404B
SHA256 16ed34e1dc540e05963f725a921e1d12c92069c2777ceb49ff4c0c164e330731
MD5 7c1444ebb8b2679efcfb02930cba1c82
SHA1 85c87b06de55a03521adcd13ec43895612c29705
SHA512 6660cd411ace5e6264f20d4a68543895c6ea0942a0575679858ba0a4b041020912ff020878aa63aef1ca58cff6ed646ff1905a63bff0263d9bb204e24eab4df3
TLSH
T1C5E0C03431F4019DF0F0B8380FF6A9138489F30A1946C3B801403315EA14B008DD2924
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 1KB
SHA256 75aa2cddf4e756874c20013a1ed037b8177821155da29a772343cb3f7f71a653
MD5 5456a184ead39df84897e2fe403326f5
SHA1 4fe50e01304a8820466c1848b652d7d265539b3a
SHA512 374b724e6831faa1d575dbaaad4e98bd427ba5a095e4179ca179df3f6bd293cf5ca418044bd1a77d2540ddc50c64842fa02b619d58d32e9bce56a556a94f28f8
TLSH
T139217C48573E49F222A50178F6293DE0A599F9120705DDB07BE007563392C37ED6F1B8
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp76F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp76F0.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpB5A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpB5A1.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpB5C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpB5C1.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpBBDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpBBDD.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpEBDA.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpEBDA.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 7fad308717418751734b780531cf7e0854911a6c7f768633b6a0e5e518ba5c26
MD5 60fd198772ad4d5ce420ba7fb7fe4968
SHA1 98ae5284b41011d4d2726acee01ac0b0a853e65b
SHA512 efa6084bb6e76db7dbbb6af17fa8ecdd08c3716840a4b2a86a8133b899808c937ef1954073814f25242c5a6c7e342eab24777a52623956dc4f26b3b5ff79abde
SSDEEP 12288:RW7sf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:0s+UWPF8T4z1huSmRNJVmIcT+
TLSH
T10ED4230EBB5595A3E430BFF45D0E8DBD237B2D9B27219893B010E949011D7A8FED14AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 db270c1ac9f3fc0d955ec1182ee9fcdf31293d932a95ec34ff6bc49fabb174d6
MD5 4178f3fc70b5403d9e32f1099f3ac4b1
SHA1 6a2aed2c59d813c267a481c3359e8dbd8f01b93f
SHA512 b6c7fea65e2f168e514b6d1243097e98976d949881850df3cf652b439ce7d86e24864bd5a76beca6ca05b3893da7fc6133a0d0ebe3c3842cda4ac88fbcba0767
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYk+UWPF8T4z1huSmRNJVmIcT+:cgb4mBIBhGFgx8T4LXS/UL
TLSH
T18B65AE1E32E802F5E0F5E2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 e08381927343187a2e2f64249738a681de9609eb280d6b78918ec7f60056fe08
MD5 d8233928453abb9244d030199cb507d8
SHA1 4f91691918ebe0d3ef95c66bbe429873f1f665a5
SHA512 6e84349b569c7f97dbfea9aabdb78374b16659d146200f39f426cda71cdc55533202dec910d307b49bde08267733a8f77d27e26da18da718bde545f51948d47a
SSDEEP 12288:IMG9of2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:FG9o+UWPF8T4z1huSmRNJVmIcT+
TLSH
T109E4231D36A170E2C434EBB89C198DEE76B23993132159EF5090E5390B0D7F4BAF9C99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 a3c90a86fe9ac7bb2704febf41faab7c447fa291bb38a7125094c81203bdc335
MD5 29116e7d0432f970cd7d74af648b233a
SHA1 eb155cb052af5c117e2f531afa5118d201ab9540
SHA512 25326ccbf39fa0bb084990bb70b04ba3f559d7de976f53541fcb2732b4dca11d9c4213f47fd9d6171a2256c4d0d16a51f372c2069ad30473a8daa5e0780464da
SSDEEP 12288:+/f2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:+/+UWPF8T4z1huSmRNJVmIcT+
TLSH
T18ED4234E7B5591A3D530BFF45D0A4DED13B61D9B232249D3B021E90A020E3E9BEF54AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 1b0a5cd143633f6bb8ce51b6a0991ae3d08218dc4b3f7047569753e60da13ffd
MD5 aadc43fc949441d99481f3ccf5511f1a
SHA1 d6a94bb908aaca442631b2b060cbfbd20617965e
SHA512 0608fe49a8bb6cb6f9aece98166d0a719f12c111798e8eb8b745c9738318bdba08e4bd29c22035bd40b085226f773dde8cf14dfa4b145d9913e8350144259ce3
SSDEEP 24576:cWi8u8FpJqH1jlria7/mm+UWPF8T4z1huSmRNJVmIcT+:XRZFPqVoa7/ix8T4LXS/UL
TLSH
T15535F16577E101F1D477E13889464AA7F6B2B8160320EFDF06A8CA550F237E45BBEB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 94001a6d79d60ac2ff0bbfd31cc5e1f518ae4b4dd9a2efa7f78973e6e7dbc00f
MD5 25cd93f81b60992fdca841b0bd516857
SHA1 b3623bd8fa3e35dce81096f9c474480a38195830
SHA512 5c3650ae4ceeb1bf6a58542a95b53102a8df3b266334efda5378120cf1ef778dc77ea536d023073270cbf1495cb4fb388db2cb36c6635d58fbe3c40461cb1206
SSDEEP 12288:NHvUrBFrEjwaQpf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:NPUr+NQp+UWPF8T4z1huSmRNJVmIcT+
TLSH
T1B005F11F32A818E5E676E17C8946875DF77278631312D6CF02A0C17E0F27AE8BD79A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b4045cd22abe6cf8f1de66129885aaec67002d94b5168fc4a13458fab0aa9c08
MD5 4d4d02114ecac88cd0badb59bfae9b67
SHA1 7b97434f118bdc532f8003d37ff9b710bc71b021
SHA512 4eb93983b5a1f3e8d6b677c17d13818db455f63a6ae6b9f06b545eeec92a36295e8b756be3e3368f52cc443fb75af053fa7214885a0a4621dcf7cf8e1c81e0af
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTx8T4LXS/UL:MG05lO43bAC
TLSH
T1CAD5C06E62EC11F5D0BBD17CD9C64A0BEBB23815033556CB02A486A91F27FF4697E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 79b2a28ff7c1511443bdad11137a45058446c8071e5406225e6fd26882575ae6
MD5 4af2524811a0397f13038901b7385462
SHA1 55356cc1aa85e9bbca36fa93248a6343edcefc93
SHA512 baaefe744c257b6452ad01a68dd6ccb1ca34d2a718c7e247ed33251741555ae28ab165d293bd8713cf3c30e90afcb347408e54da041d533570d69e37e67464e7
SSDEEP 24576:mta5POZ3dpbWVM50JicR2hG0lasx2+47eidnU+UWPF8T4z1huSmRNJVmIcT+:Ua5POZ3wJt2pasx2+mTx8T4LXS/UL
TLSH
T1B965BF5EA7FC01D5D575D17CC5838A1AE5B1342613329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4c64292690995ca899deaa020438a8f341dd337b5188d891978ad8907142cd1c
MD5 a377645fe523f0e5bce504b0d7c6afb7
SHA1 a8af1a0d25a1034215bac1b8a13e96d44b7f3a48
SHA512 c351b9310c8b03544925d2aaa2138b8960147dde419b6ea4725753d04dd22395b4bbe1099d87175fb81a725be3496810f673ea03a5ebf5e98ae97975cfcf16e9
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkX+UWPF8T4z1huSmRNJVmIcT+:sNc/zEOVHFbx8T4LXS/UL
TLSH
T1C4857C1623E901E4F5B7E1BE89679946FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 16bddd048fd99c05addc57e5eb5ae237744ec7bf5ef1a3b5a377a347aec52a40
MD5 791c60b73f137329fd14598c3b56eadc
SHA1 a4b1d89e16bba905a2bcfd52f7d6ebc49e60a43c
SHA512 62860e0c92b7d01f98465eacb3661bb8c28c8c03d692eae39f94b85fff2c616f5e1ecece228629b119055c9cca4c3053ce7b3e255168630ccf0b17b941bd7dab
SSDEEP 24576:KJnJPbzB4SC+UWPF8T4z1huSmRNJVmIcT+:KJnJv6Srx8T4LXS/UL
TLSH
T1EC15E13DD2A810E5D4B7C2B4811A1B9AFF71386D2B2269C715B4D5353F02FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ed28f3afd73183494b51cf6626d17a407565c55e148ef4175340e1cb19fdd447
MD5 22eccf1a19b1a2034dfdcb3a5f6736cb
SHA1 2e890e6f04f297527d42cf342b4d75f67d5b6cc0
SHA512 ac964c459527c9081ed21508f8440fdf1a2819cd3137980f1aca243eb6725387a877bc83b9022f1cbb336e8c37e0e7d15e6e66d443a9fbb32b1e29d6b0904ba0
SSDEEP 24576:4CLHGL0MoeVtFumTijCmlKQWDks+UWPF8T4z1huSmRNJVmIcT+:4CLHGeeV5ijCmlDWDkhx8T4LXS/UL
TLSH
T190A56B05B7EB4184E8F3CAF5CA2694169B327C549B34F7EF4A80C96A1E32BD0D578B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 47e2fd157d8281483e6bb44e053a911350ae58c205d71977e4f62c7bb78f7c17
MD5 2039943d1b0b5ab37b1e526342bad704
SHA1 cfec7ba2fad0f6dab7d0d0996c136d1cbc16a13e
SHA512 64ad5e8a6a79f02f563a55a936d8545779b67f49bb76feea9110018181e9ae5dc594ae331ffd94bc6d0e9b2c575d07de928184546464cbdc1e4069e689f7276c
SSDEEP 12288:D1Hck6j5ZI7Qf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:36DIc+UWPF8T4z1huSmRNJVmIcT+
TLSH
T11C05011D337A10F6D037E07D8A830956D2B2B4B293225ADF0694C57E4F67ED8B978D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 738b329cbaa6b1724d083eb73968715faf3131176117781ccb65d48cf55e05e9
MD5 2124025a9fd505d11950c4605e556d57
SHA1 8054baece2edfc1d1f58b4709e3024cc145f175b
SHA512 7c86f4ba448fd445e1c80837dc2cdb6ad75f1892ef6712633fe8a2afad0fabb4af401103b3534c8ad8a6c106a78b4b91e15ed99ea030d1c5978a22c9709d8939
SSDEEP 12288:9G6kyGf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:EtyG+UWPF8T4z1huSmRNJVmIcT+
TLSH
T1E6F42309739460E2E93457788E2785E94B767C12172246DF6090FA3E0F3A7E4BDF0B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 2771044c06f1d45e268660676301634e3e34dc8367d787d002d31506e705d7eb
MD5 e551ffdd162b27df3d31320a4e61ccec
SHA1 6bdb3adcfc456e9404025aeca602f81733a9dc60
SHA512 06f2f5b2a13a5e5ba854db1d46199ac8d30eca7fe4e4a36180ac33f29caa6d4d16d43d03b0358e2a32e2508d19656360d76dd6bf6df208b7a8e8dd5cab52479e
SSDEEP 12288:AgCf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:TC+UWPF8T4z1huSmRNJVmIcT+
TLSH
T118D4234D775161B3D820FFF45D0E4EEE53B629AB232258E77050E929060E3E4BEF1896
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 2f65047fcac34d3bed520ce3104903caf590a5f3a449a1d210597833e43e47dd
MD5 cdcd27b331dfe92b2ecdece4c18c4d7e
SHA1 710df748e758bec0b145d7ffe824b7d6b8431d5f
SHA512 9f98925eb879ba2b732cd49465e2bddfd45b1583d0b231f4558fabc59f1b32447c69903c5c08291d77ab26763121cfa402e9bf48260f1fc1906f1920847405ec
SSDEEP 24576:Jkg+LoTfaidZe+UWPF8T4z1huSmRNJVmIcT+:agdTrZnx8T4LXS/UL
TLSH
T128559D1D77EA05DAE2B2D679D8221493D633B4311772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 cdf041721f4b0c0cdfb3025f7f6f127127b429b012a9b9f1084d3a18b9b8dfa8
MD5 b69a104c0a8ded1bb5bc4e6bbd464f7a
SHA1 a090cac1ac3160a637614f564b0415ee2053a88b
SHA512 ffc917522f548f7a6372fae962131cc7d2cea10ee2590cce2aaa59cd4d2423b0dee288b77f889e6f19eeeb43d75995ed663fc0d14c7fce044a4dfa2a4da9267b
SSDEEP 12288:spJcm8CNwFf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:srcmRwF+UWPF8T4z1huSmRNJVmIcT+
TLSH
T1D005F14EB3AA00E2E177D27C8C46455AE3B37472231257DF02A1C77E0A1BAE97E74B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3ed235580402847e569e17eb728f2aed98fb6bb84071371f75bf1dfaae817d82
MD5 23fa3f9c79bcc65eb198267e7809db7a
SHA1 5588c3f9b20fd387025a6a29ae4a21bc154bc7b5
SHA512 2d0a207156adfb8eeefd91e8e06cd6bd1258c316b5c156a6610a7345ff676b2db9c5bd657147c4172e346143066a83fb92c128d6692d29b83d15f85db3df6b31
SSDEEP 49152:IDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3Mx8T4LXS/UL:V3Upow8sBPC
TLSH
T162A58D3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e54cd559353a6f0e3d422c907aab59eb33b5bd6e6d0aff79c7c07e1b9ce5fb0a
MD5 c8ec207d36855815e398b1dd1bd57394
SHA1 3dd39d5b72842e88558ed4d1a3ba439f547c4e7e
SHA512 e7c05a3f15fc25f2d3938c452e3e206bce6a99deb9890d90563e1103a8a4c155b5a5284ecfe98ee1b09509eccce79d56a25681256dfe22c8d5fb0eed6633964c
SSDEEP 24576:ATkNvNnaFeYhJNtmZBmo+UWPF8T4z1huSmRNJVmIcT+:ATMwBtOmdx8T4LXS/UL
TLSH
T11855AF2EBBB846E4D1FAC6B4CD238516E6727461173293CB5290C13F0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 992KB
SHA256 4ec7b1ed217fa96b675077b263eb7ebcaf240aa69d56704d2f9d16f4e554dc3a
MD5 02827908e215a9252a6458d2a77165db
SHA1 be514f1c070dc2e22ed87dede991403ac12da744
SHA512 dc1de923dbe752619759ad61ee772fcce09bea60e22e58caa105cdb5b7177189f74b9b18cb90429bffb2bf83aab5df1e18c0080dee68a0921f15201186c26515
SSDEEP 24576:uD3FHshBIYQgAV+UWPF8T4z1huSmRNJVmIcT+:uDVHeBIAAAx8T4LXS/UL
TLSH
T10625E13EEB9C00E5E57AD2BCDA538A06E77138A9032255CB1194C1BA1F1BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 fe82c29f33a5dfe07c6c61970500b01514fda6379b590526e21f6c0e72b3a4e1
MD5 f3a90d0a341b953cd46ca60d0745fe30
SHA1 63d6979f126b8afea7bd4cd238cd0983fbe6dc3b
SHA512 9f6b3be511c1c582ab7b7de54d50dff42269d16ae52ab5098649316095b61aa713e9eb08edf1cb33f558f5263d9d23b6fcc353e289da57b2e7d9fd4e48a59bc1
SSDEEP 12288:8yS6b3IkxjbBzBf2UIttPfN8TrMz5/4ShhufalzE+eNd2uWvVaDCICFcjG04SJD:q6UqjpB+UWPF8T4z1huSmRNJVmIcT+
TLSH
T1C3F4120E37D060F6E4349674DD19856D42B17C73133259EF31D4E63E0B3ABD4A9BAA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-256-0x000002230FBB0000-0x000002230FC16000-memory.dmp

Download

memory/236-322-0x00007FF6E9750000-0x00007FF6E9A71000-memory.dmp

Download

memory/236-260-0x000002230FBB0000-0x000002230FC16000-memory.dmp

Download

memory/236-262-0x00007FF6E9750000-0x00007FF6E9A71000-memory.dmp

Download

memory/236-255-0x000002230FBB0000-0x000002230FC16000-memory.dmp

Download

memory/1280-281-0x00007FF781E60000-0x00007FF781F0E000-memory.dmp

Download

memory/1280-212-0x000001504AA70000-0x000001504AAD6000-memory.dmp

Download

memory/1280-210-0x000001504AA70000-0x000001504AAD6000-memory.dmp

Download

memory/1280-209-0x00007FF781E60000-0x00007FF781F0E000-memory.dmp

Download

memory/1788-37-0x0000022016660000-0x00000220166C6000-memory.dmp

Download

memory/1788-200-0x00007FF7FBD60000-0x00007FF7FBE29000-memory.dmp

Download

memory/1788-35-0x00007FF7FBD60000-0x00007FF7FBE29000-memory.dmp

Download

memory/1788-38-0x0000022016660000-0x00000220166C6000-memory.dmp

Download

memory/1788-36-0x0000022016660000-0x00000220166C6000-memory.dmp

Download

memory/2084-230-0x000002203BDE0000-0x000002203BE46000-memory.dmp

Download

memory/2084-229-0x000002203BDE0000-0x000002203BE46000-memory.dmp

Download

memory/2084-228-0x00007FF7F3080000-0x00007FF7F3134000-memory.dmp

Download

memory/2084-291-0x00007FF7F3080000-0x00007FF7F3134000-memory.dmp

Download

memory/2108-275-0x000001D15DE30000-0x000001D15DE96000-memory.dmp

Download

memory/2108-339-0x00007FF7CC5A0000-0x00007FF7CCA71000-memory.dmp

Download

memory/2108-276-0x000001D15DE30000-0x000001D15DE96000-memory.dmp

Download

memory/2108-280-0x00007FF7CC5A0000-0x00007FF7CCA71000-memory.dmp

Download

memory/2400-157-0x00007FF7917C0000-0x00007FF7918E3000-memory.dmp

Download

memory/2400-17-0x0000023D3AA70000-0x0000023D3AAD6000-memory.dmp

Download

memory/2400-16-0x0000023D3AA70000-0x0000023D3AAD6000-memory.dmp

Download

memory/2400-18-0x0000023D3AA70000-0x0000023D3AAD6000-memory.dmp

Download

memory/2400-15-0x00007FF7917C0000-0x00007FF7918E3000-memory.dmp

Download

memory/2568-202-0x0000020270D70000-0x0000020270DD6000-memory.dmp

Download

memory/2568-201-0x0000020270D70000-0x0000020270DD6000-memory.dmp

Download

memory/2568-507-0x0000020270D70000-0x0000020270DD6000-memory.dmp

Download

memory/2568-208-0x00007FF6F55E0000-0x00007FF6F5D24000-memory.dmp

Download

memory/2568-272-0x00007FF6F55E0000-0x00007FF6F5D24000-memory.dmp

Download

memory/2568-508-0x00007FF6F55E0000-0x00007FF6F5D24000-memory.dmp

Download

memory/2656-349-0x00000181B2060000-0x00000181B210E000-memory.dmp

Download

memory/2832-28-0x00000203612B0000-0x0000020361316000-memory.dmp

Download

memory/2832-27-0x00000203612B0000-0x0000020361316000-memory.dmp

Download

memory/2832-187-0x00007FF7FBD60000-0x00007FF7FBE29000-memory.dmp

Download

memory/2832-29-0x00000203612B0000-0x0000020361316000-memory.dmp

Download

memory/2832-26-0x00007FF7FBD60000-0x00007FF7FBE29000-memory.dmp

Download

memory/3004-248-0x000001662E7F0000-0x000001662E856000-memory.dmp

Download

memory/3004-246-0x00007FF7FEE00000-0x00007FF7FEF95000-memory.dmp

Download

memory/3004-247-0x000001662E7F0000-0x000001662E856000-memory.dmp

Download

memory/3004-303-0x00007FF7FEE00000-0x00007FF7FEF95000-memory.dmp

Download

memory/3048-178-0x00007FF6A2980000-0x00007FF6A2ACA000-memory.dmp

Download

memory/3048-181-0x0000019749FD0000-0x000001974A036000-memory.dmp

Download

memory/3048-180-0x0000019749FD0000-0x000001974A036000-memory.dmp

Download

memory/3048-254-0x00007FF6A2980000-0x00007FF6A2ACA000-memory.dmp

Download

memory/3444-171-0x000002CB7A660000-0x000002CB7A6C6000-memory.dmp

Download

memory/3444-170-0x000002CB7A430000-0x000002CB7A584000-memory.dmp

Download

memory/3444-172-0x000002CB7A660000-0x000002CB7A6C6000-memory.dmp

Download

memory/3492-295-0x00007FF7A0F10000-0x00007FF7A11B3000-memory.dmp

Download

memory/3492-237-0x00007FF7A0F10000-0x00007FF7A11B3000-memory.dmp

Download

memory/3492-238-0x000002813EEE0000-0x000002813EF46000-memory.dmp

Download

memory/3492-239-0x000002813EEE0000-0x000002813EF46000-memory.dmp

Download

memory/4124-158-0x00007FF731CD0000-0x00007FF731DEA000-memory.dmp

Download

memory/4124-245-0x00007FF731CD0000-0x00007FF731DEA000-memory.dmp

Download

memory/4124-160-0x0000021A1B340000-0x0000021A1B3A6000-memory.dmp

Download

memory/4124-159-0x0000021A1B340000-0x0000021A1B3A6000-memory.dmp

Download

memory/4436-319-0x00000195B7010000-0x00000195B7076000-memory.dmp

Download

memory/4436-218-0x00007FF62AC30000-0x00007FF62B047000-memory.dmp

Download

memory/4436-219-0x00000195B7010000-0x00000195B7076000-memory.dmp

Download

memory/4436-220-0x00000195B7010000-0x00000195B7076000-memory.dmp

Download

memory/4436-321-0x00007FF62AC30000-0x00007FF62B047000-memory.dmp

Download

memory/4436-290-0x00007FF62AC30000-0x00007FF62B047000-memory.dmp

Download

memory/4968-342-0x00007FF776660000-0x00007FF776B67000-memory.dmp

Download

memory/4968-285-0x0000014914A50000-0x0000014914AB6000-memory.dmp

Download

memory/4968-289-0x00007FF776660000-0x00007FF776B67000-memory.dmp

Download

memory/4968-284-0x0000014914A50000-0x0000014914AB6000-memory.dmp

Download

memory/4972-145-0x00007FF724BE0000-0x00007FF724D48000-memory.dmp

Download

memory/4972-154-0x00007FF724BE0000-0x00007FF724D48000-memory.dmp

Download

memory/4972-152-0x0000024321E10000-0x0000024321E76000-memory.dmp

Download

memory/4972-146-0x0000024321E10000-0x0000024321E76000-memory.dmp

Download

memory/4972-147-0x0000024321E10000-0x0000024321E76000-memory.dmp

Download

memory/5296-139-0x00000134DDB80000-0x00000134DDBE6000-memory.dmp

Download

memory/5296-137-0x00000134DD900000-0x00000134DDA54000-memory.dmp

Download

memory/5296-138-0x00000134DDB80000-0x00000134DDBE6000-memory.dmp

Download

memory/5496-189-0x0000000000900000-0x0000000000969000-memory.dmp

Download

memory/5496-188-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5496-194-0x0000000000900000-0x0000000000969000-memory.dmp

Download

memory/5496-265-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5868-130-0x00000257E04A0000-0x00000257E0506000-memory.dmp

Download

memory/5868-131-0x00000257E04A0000-0x00000257E0506000-memory.dmp

Download

memory/5868-129-0x00000257E0340000-0x00000257E0494000-memory.dmp

Download

memory/6064-267-0x000002A828080000-0x000002A8280E6000-memory.dmp

Download

memory/6064-325-0x00007FF750F20000-0x00007FF7511AB000-memory.dmp

Download

memory/6064-269-0x000002A828080000-0x000002A8280E6000-memory.dmp

Download

memory/6064-266-0x00007FF750F20000-0x00007FF7511AB000-memory.dmp

Download

memory/6728-1-0x0000000003580000-0x00000000035E9000-memory.dmp

Download

memory/6728-7-0x0000000003580000-0x00000000035E9000-memory.dmp

Download

memory/6728-6-0x0000000003580000-0x00000000035E9000-memory.dmp

Download

memory/6728-0-0x0000000003380000-0x000000000349F000-memory.dmp

Download

memory/6988-296-0x00007FF6537C0000-0x00007FF6538EF000-memory.dmp

Download

memory/6988-345-0x00007FF6537C0000-0x00007FF6538EF000-memory.dmp

Download

memory/6988-298-0x0000028112A50000-0x0000028112AB6000-memory.dmp

Download

memory/6988-297-0x0000028112A50000-0x0000028112AB6000-memory.dmp

Download

memory/7008-327-0x000001C1CA600000-0x000001C1CA666000-memory.dmp

Download

memory/7008-348-0x00007FF6F5070000-0x00007FF6F53AF000-memory.dmp

Download

memory/7008-326-0x00007FF6F5070000-0x00007FF6F53AF000-memory.dmp

Download

memory/7008-328-0x000001C1CA600000-0x000001C1CA666000-memory.dmp

Download