Overview

overview

8

Static

static

3

2026-07-14...op.exe

windows10-2004-x64

8

2026-07-14...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/07/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-14_19b0b0e447cf133267d15bfe6b681ad5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
  • Size 1.8MB
  • Sample260714-e2ndfagv3z
  • SHA256 7f84306b181d5cf4067f43008f8610331040bb306144392359e383faa504d558
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_19b0b0e447cf133267d15bfe6b681ad5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_19b0b0e447cf133267d15bfe6b681ad5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
      2⤵
        PID:5228
      • C:\ProgramData\Adobe\ARM\S\13933\AdobeARMHelper.exe
        "C:\ProgramData\Adobe\ARM\S\13933\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\13933" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5316
        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\13933" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:5468
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4028
    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      1⤵
      • Executes dropped EXE
      PID:316
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
        PID:3932
      • C:\Windows\system32\fxssvc.exe
        C:\Windows\system32\fxssvc.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:1196
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:2196
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:2708
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:4656
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:4844
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:4480
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:3152
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4308
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:2224
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:692
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:3292
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2368
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:2132
        • C:\Windows\System32\OpenSSH\ssh-agent.exe
          C:\Windows\System32\OpenSSH\ssh-agent.exe
          1⤵
          • Executes dropped EXE
          PID:660
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:2180
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4776
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:4872
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4912
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1668
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:4876
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:632
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:5712
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 904
            2⤵
            • Modifies data under HKEY_USERS
            PID:5736

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 245dbffadee310466750d176969215a08a544e86e67ea09ae9b3b3b238359108
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 849KB
              • SHA256 4f9c9f85510d85f769fb8b7546e4a91b069f0d9cbd00b61ab209f8bca9160f07
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.1MB
              • SHA256 75fa8bd83a2cb3a0636bcb5805449918852c4e2b837dd555234fa9533ed881a3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 d75046badacbd6c9154779405d728e117b1cc3a6a893771a6dce6cf696797abf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.3MB
              • SHA256 fd58afc356ab0f71740984e5661c0759448e32d219f6080b833fc9a9de3ee50b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 603KB
              • SHA256 bcb456187372fb672a92b180edb13c20696f11e347bea35a8698031809ef5d5d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 863KB
              • SHA256 ebe7901a159cfdd3f3c602646ca24890624d69705ab3f4cd0a5a5dc449f44fe0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.7MB
              • SHA256 906664df05b77ba75a8edab25c76ad0ebf61178042ede4548fadc3ecd8790a40
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 932KB
              • SHA256 52356640cca90f868cabd0df69cd5000226c37f351800114a1243593dc28940d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 f978a0713eb2eff79ba9f2891c18e23a58d4afddcdcd3509d27653c366c91f66
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 3f184e027c5e90b1792d836bdf8d3b559954a42c49bea883d53fb8cfa0895462
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 e3043a7e67b9c35f6eeca6457a6c8cb56f2be32d441a69dea82cd1b03ee1ba91
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 829KB
              • SHA256 9d166ab5bc01093052a82a8b9e6097aa28967efaf828b5286b27f1440a326f23
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 678KB
              • SHA256 e1fd3a29ef316259b15ae985c1d4cdfc7a7bfbc77a01c7d40f9e984b716a37ef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 edc103d7662fa1dcd03d0db93e5a227004c6d66abda17b44529ada3b181d9fdf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 ec62e3fd54e59b9e8194fd183a82e6d3e765a0d001a846b5f1ac90ceacd584cb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 952f36a41f95c5f15b0ec18cae4432b662522d47a21f72e904bed7a954ac2b26
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 0b3c693e57558b0dda8470492fdd144b6a1028d0c79050b79482f146612cce8c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 907e77de1831e334efb2ae8c4e0c18f9049206cc509cef98b3957c82175f653c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 cffa8d2f2d07beb484c5eeba4e73acd3f2a64708a3cef826607ba7c66f8f80ec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 91f5a5278549906e9de479a594fad1da5443537c721d06cb9af903a7e26d2815
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 722KB
              • SHA256 a103bb44f651b423bf71ddd05981e81bb011922446a5b159c822f51337b07c37
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 102B
              • SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 1KB
              • SHA256 53768d7fa207f770965f3317ce87226413229fe7f0506d1c22373f0e56d4c56a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.msi
              • Path C:\ProgramData\Adobe\ARM\S\13933\AdobeARM.msi
              • Size 1.0MB
              • SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARMHelper.exe
              • Path C:\ProgramData\Adobe\ARM\S\13933\AdobeARMHelper.exe
              • Size 413KB
              • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrManifest2.msi
              • Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
              • Size 18KB
              • SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 471B
              • SHA256 4e3d6dac752554be82c5322e41bdc0c1a8931b3cac8d77d6d268e2a3201ced03
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 727B
              • SHA256 ad9b713b5c30fd039725c72c891c46c9631f586cc79dfb51452a0bea77c83e08
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 727B
              • SHA256 7de94c8e5137b2b50d2fd00d04e7a839fac98e33fb06ef3f3d22768a71180373
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 727B
              • SHA256 32ae664c2e7350b37ec09b4818ed6c9b7ba82426e2beebf73ccc2170bb448197
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 400B
              • SHA256 b416aa0ee60efd0387a3576e9ea72d2f49f1b6393ce08c6111d9b5d10317b840
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 404B
              • SHA256 4edbe0c64619bf808e36fe71b34e8072c30c7a896e06d6831d619e942ffcd8d1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 404B
              • SHA256 5a0a10db0691ec0c9adb1d2acd39e1af8254622728984a9c889a6a9ef70399e4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 412B
              • SHA256 20504acbd6579ebea8ac63ce6de98b378f23d9d63bda5b9e7fa89712b7826156
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 1KB
              • SHA256 07efa88db69b914eb40e5d899488044a679d4200b20441ddd81e626753cd9060
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
              • Size 251KB
              • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp1943.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp1943.tmp
              • Size 5KB
              • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp9E3F.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp9E3F.tmp
              • Size 5KB
              • SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpD7FE.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpD7FE.tmp
              • Size 5KB
              • SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpD928.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpD928.tmp
              • Size 3KB
              • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TmpE09B.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpE09B.tmp
              • Size 5KB
              • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 610KB
              • SHA256 e94a87fd15a0c267de9826bc4a84a64db4a0f08184825ee6409757e5e98f56ff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.8MB
              • SHA256 7902204d9bacbdec42161363dc1c87548030c6a440d755c4b1164b149437b773
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 681KB
              • SHA256 389cb1eeadf81f92c3bd30743ce68c9c45fc1a33a6bdb15cf5885c7081f311c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 68fdb93ad2f73954bc887c35c790fe5b54288644d65a629781fbe447d1a42901
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 600KB
              • SHA256 32b2e52f2bd10580e15abe47cb53dc9e9367abb0ea7c339d4d8ebd68dccd77ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 963KB
              • SHA256 41b2968b7315db1d5731de672ce5c16f534825657e93536874cede6bbf5eacdd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 693KB
              • SHA256 812f23c0489899320fcdbb9581036fa188ca01f49c78a6de95a438b88ee8fd2a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.5MB
              • SHA256 20546ec55bf3b7eee37397b38545146696266c5e72e3f8b88217ef9fc27ad1fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 99a5bb1625463444e443c10025958d5eab3d8c61c457e0f82a4069aeb089014a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 cd7963e2c2f114b465c5d287f2c3df8d66e6dce5fa0a83a0af8110dc87629bb8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 907KB
              • SHA256 64c6e3c6b44136d1069d9823bc71440f85c830068888a2b30d0dcf50dd49c0b4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 f481ef5f1d75df5d7181240ada5b3f1a321ca4a9dc1c697de723f3257c5d1517
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 682KB
              • SHA256 d628238a64aed18a70246b7337f4ef095856b64d1050627648a2a499c1b22520
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 734KB
              • SHA256 e0566dd2bf6d846d789a73db535d0626d0ade309cf0d8d495fff8447d41006c2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 605KB
              • SHA256 2d310b431565e88e1566c323221c44ca25625b005cea40ad2729670ce54df279
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 99b16408c946c06bc5372696516d1b57b698b5de69106eaa8f1d341c4db5feb8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 794KB
              • SHA256 83123a4752e06d5b9f696dd2ce870972f1dcccaf6e8824593b0cef4252f99a41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 fefb495e529381fdbc37975fb4c909ff03cd414277211bbdf4aaa1297ebc7031
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 dea86cb2701a48c0f6fe4cd5eeadaefa2bfffb1b403b308ff833dcddf9a3c0c4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 899KB
              • SHA256 5bfae6ce28c824d52fbb58cfbd1b4491d7af217e216ad3cc72aab9c759039695
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 657KB
              • SHA256 7d5ca9beef6bb25a796918fac83aa7f272c6875f88071d1ae8b040c5c88dd17e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/316-180-0x00007FF704BC0000-0x00007FF704CA4000-memory.dmp
              Download

              memory/316-111-0x00007FF704BC0000-0x00007FF704CA4000-memory.dmp
              Download

              memory/316-112-0x000002841AB70000-0x000002841ABD6000-memory.dmp
              Download

              memory/316-114-0x000002841AB70000-0x000002841ABD6000-memory.dmp
              Download

              memory/632-361-0x000001A4360C0000-0x000001A4360C8000-memory.dmp
              Download

              memory/632-566-0x000001A4373A0000-0x000001A4373A8000-memory.dmp
              Download

              memory/632-329-0x000001A42DAD0000-0x000001A42DAE0000-memory.dmp
              Download

              memory/632-345-0x000001A42DD00000-0x000001A42DD10000-memory.dmp
              Download

              memory/632-323-0x00007FF743130000-0x00007FF743484000-memory.dmp
              Download

              memory/632-375-0x00007FF743130000-0x00007FF743484000-memory.dmp
              Download

              memory/632-324-0x000001A42CBF0000-0x000001A42CC56000-memory.dmp
              Download

              memory/632-325-0x000001A42CBF0000-0x000001A42CC56000-memory.dmp
              Download

              memory/660-304-0x00007FF731DC0000-0x00007FF731FAF000-memory.dmp
              Download

              memory/660-236-0x000001F303AE0000-0x000001F303B46000-memory.dmp
              Download

              memory/660-235-0x00007FF731DC0000-0x00007FF731FAF000-memory.dmp
              Download

              memory/660-237-0x000001F303AE0000-0x000001F303B46000-memory.dmp
              Download

              memory/692-209-0x0000021349B90000-0x0000021349BF6000-memory.dmp
              Download

              memory/692-210-0x0000021349B90000-0x0000021349BF6000-memory.dmp
              Download

              memory/692-299-0x0000021349B90000-0x0000021349BF6000-memory.dmp
              Download

              memory/692-300-0x00007FF6D7CE0000-0x00007FF6D814D000-memory.dmp
              Download

              memory/692-214-0x00007FF6D7CE0000-0x00007FF6D814D000-memory.dmp
              Download

              memory/692-271-0x00007FF6D7CE0000-0x00007FF6D814D000-memory.dmp
              Download

              memory/772-6-0x0000000001700000-0x0000000001811000-memory.dmp
              Download

              memory/772-7-0x0000000003100000-0x0000000003169000-memory.dmp
              Download

              memory/772-0-0x0000000003100000-0x0000000003169000-memory.dmp
              Download

              memory/1196-128-0x00007FF6BB4A0000-0x00007FF6BB728000-memory.dmp
              Download

              memory/1196-122-0x0000022B898B0000-0x0000022B89916000-memory.dmp
              Download

              memory/1196-121-0x0000022B898B0000-0x0000022B89916000-memory.dmp
              Download

              memory/1196-120-0x00007FF6BB4A0000-0x00007FF6BB728000-memory.dmp
              Download

              memory/1196-127-0x0000022B898B0000-0x0000022B89916000-memory.dmp
              Download

              memory/1668-306-0x00000209DD6C0000-0x00000209DD726000-memory.dmp
              Download

              memory/1668-373-0x00007FF7CDE50000-0x00007FF7CE37B000-memory.dmp
              Download

              memory/1668-305-0x00000209DD6C0000-0x00000209DD726000-memory.dmp
              Download

              memory/1668-310-0x00007FF7CDE50000-0x00007FF7CE37B000-memory.dmp
              Download

              memory/2180-313-0x00007FF6847E0000-0x00007FF68496F000-memory.dmp
              Download

              memory/2180-245-0x000002D9B3040000-0x000002D9B30A6000-memory.dmp
              Download

              memory/2180-244-0x000002D9B3040000-0x000002D9B30A6000-memory.dmp
              Download

              memory/2180-243-0x00007FF6847E0000-0x00007FF68496F000-memory.dmp
              Download

              memory/2196-132-0x000001E5EE0A0000-0x000001E5EE106000-memory.dmp
              Download

              memory/2196-131-0x000001E5EDE50000-0x000001E5EDFCD000-memory.dmp
              Download

              memory/2196-133-0x000001E5EE0A0000-0x000001E5EE106000-memory.dmp
              Download

              memory/2224-265-0x00007FF63C8A0000-0x00007FF63C948000-memory.dmp
              Download

              memory/2224-201-0x00007FF63C8A0000-0x00007FF63C948000-memory.dmp
              Download

              memory/2224-203-0x00000206C5890000-0x00000206C58F6000-memory.dmp
              Download

              memory/2224-202-0x00000206C5890000-0x00000206C58F6000-memory.dmp
              Download

              memory/2368-228-0x00007FF6EF7E0000-0x00007FF6EFB04000-memory.dmp
              Download

              memory/2368-227-0x0000011198F60000-0x0000011198FC6000-memory.dmp
              Download

              memory/2368-301-0x00007FF6EF7E0000-0x00007FF6EFB04000-memory.dmp
              Download

              memory/2368-226-0x0000011198F60000-0x0000011198FC6000-memory.dmp
              Download

              memory/2708-139-0x000002B83EE00000-0x000002B83EF7D000-memory.dmp
              Download

              memory/2708-140-0x000002B83F0A0000-0x000002B83F106000-memory.dmp
              Download

              memory/2708-141-0x000002B83F0A0000-0x000002B83F106000-memory.dmp
              Download

              memory/3152-252-0x00007FF641CB0000-0x00007FF641D9A000-memory.dmp
              Download

              memory/3152-181-0x00007FF641CB0000-0x00007FF641D9A000-memory.dmp
              Download

              memory/3152-182-0x000002A9905D0000-0x000002A990636000-memory.dmp
              Download

              memory/3152-183-0x000002A9905D0000-0x000002A990636000-memory.dmp
              Download

              memory/3292-276-0x00007FF72E800000-0x00007FF72E8AB000-memory.dmp
              Download

              memory/3292-218-0x00007FF72E800000-0x00007FF72E8AB000-memory.dmp
              Download

              memory/3292-220-0x0000021859780000-0x00000218597E6000-memory.dmp
              Download

              memory/3292-219-0x0000021859780000-0x00000218597E6000-memory.dmp
              Download

              memory/4028-18-0x0000018660DE0000-0x0000018660E46000-memory.dmp
              Download

              memory/4028-147-0x00007FF7266A0000-0x00007FF726787000-memory.dmp
              Download

              memory/4028-16-0x0000018660DE0000-0x0000018660E46000-memory.dmp
              Download

              memory/4028-15-0x00007FF7266A0000-0x00007FF726787000-memory.dmp
              Download

              memory/4308-190-0x0000000000620000-0x0000000000689000-memory.dmp
              Download

              memory/4308-189-0x0000000000400000-0x000000000054A000-memory.dmp
              Download

              memory/4308-195-0x0000000000620000-0x0000000000689000-memory.dmp
              Download

              memory/4308-262-0x0000000000400000-0x000000000054A000-memory.dmp
              Download

              memory/4480-174-0x0000025604B80000-0x0000025604BE6000-memory.dmp
              Download

              memory/4480-172-0x0000025604C10000-0x0000025604D8D000-memory.dmp
              Download

              memory/4480-173-0x0000025604B80000-0x0000025604BE6000-memory.dmp
              Download

              memory/4656-150-0x00007FF6D9140000-0x00007FF6D92A8000-memory.dmp
              Download

              memory/4656-149-0x000001CC75D80000-0x000001CC75DE6000-memory.dmp
              Download

              memory/4656-155-0x000001CC75D80000-0x000001CC75DE6000-memory.dmp
              Download

              memory/4656-157-0x00007FF6D9140000-0x00007FF6D92A8000-memory.dmp
              Download

              memory/4656-148-0x000001CC75D80000-0x000001CC75DE6000-memory.dmp
              Download

              memory/4776-261-0x00007FF61F420000-0x00007FF61F849000-memory.dmp
              Download

              memory/4776-259-0x0000016A5D060000-0x0000016A5D0C6000-memory.dmp
              Download

              memory/4776-255-0x0000016A5D060000-0x0000016A5D0C6000-memory.dmp
              Download

              memory/4776-253-0x0000016A5D060000-0x0000016A5D0C6000-memory.dmp
              Download

              memory/4776-254-0x00007FF61F420000-0x00007FF61F849000-memory.dmp
              Download

              memory/4844-249-0x00007FF6BE1D0000-0x00007FF6BE2E4000-memory.dmp
              Download

              memory/4844-160-0x00007FF6BE1D0000-0x00007FF6BE2E4000-memory.dmp
              Download

              memory/4844-161-0x000002785F800000-0x000002785F866000-memory.dmp
              Download

              memory/4844-162-0x000002785F800000-0x000002785F866000-memory.dmp
              Download

              memory/4872-266-0x00007FF68C180000-0x00007FF68C43E000-memory.dmp
              Download

              memory/4872-366-0x00007FF68C180000-0x00007FF68C43E000-memory.dmp
              Download

              memory/4876-374-0x00007FF629280000-0x00007FF6293BB000-memory.dmp
              Download

              memory/4876-316-0x0000022815A60000-0x0000022815AC6000-memory.dmp
              Download

              memory/4876-315-0x0000022815A60000-0x0000022815AC6000-memory.dmp
              Download

              memory/4876-314-0x00007FF629280000-0x00007FF6293BB000-memory.dmp
              Download

              memory/4912-270-0x000001CEFFF60000-0x000001CEFFFC6000-memory.dmp
              Download

              memory/4912-370-0x00007FF6F50E0000-0x00007FF6F55BD000-memory.dmp
              Download

              memory/4912-275-0x00007FF6F50E0000-0x00007FF6F55BD000-memory.dmp
              Download

              memory/4912-269-0x000001CEFFF60000-0x000001CEFFFC6000-memory.dmp
              Download

              memory/5736-575-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-581-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-583-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-582-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-578-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-579-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-580-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-576-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-577-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-574-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-573-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download

              memory/5736-572-0x00000211CF7D0000-0x00000211CF7E0000-memory.dmp
              Download