5d685259105ba073a62d411e86a033609b438868988ec6933f56853c3e9b9658

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Size 3.3MB
Sample260718-b9rjaacv2q
SHA256 5d685259105ba073a62d411e86a033609b438868988ec6933f56853c3e9b9658
MD5 d9a96f601abbe8f90163dc8e13be013d
SHA1 8f5c0ce21674ef043f029a8cac773d4ec7967d24
SHA512 89998ae99d1c06c49b53466abb08bc378c357b1774f76eb7009b17ea368d028d2d1a81995d7af03f41ba5d7386ddb8aa23058876939294448b453f80f125b648
SSDEEP 49152:sZOATAK7IjnDreNwL934vsDEuJUNliAceq58uCiqHUzj23P2jCe8SiQXZH0:sZ9TWDreQDEuJU9mGji1C450
TLSH
T141F5AF217701C4B6D95302B0ADBDEA5F816DBE218F7414C7B3D82F6E55B19C21B32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4128	alg.exe
2748	GameInputSvc.exe
804	GameInputSvc.exe
4516	elevation_service.exe
2124	elevation_service.exe
2564	maintenanceservice.exe
240	msdtc.exe
4596	OSE.EXE
5904	PerceptionSimulationService.exe
5848	perfhost.exe
3408	ReFsDedupSvc.exe
4468	locator.exe
3932	SensorDataService.exe
1368	snmptrap.exe
3368	ssh-agent.exe
3924	TieringEngineService.exe
5276	AgentService.exe
5712	vds.exe
2608	vssvc.exe
3396	wbengine.exe
3100	WmiApSrv.exe
436	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7543bb6e238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6dca4055816dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059238e075816dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005cb912075816dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f7605075816dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
804	GameInputSvc.exe
804	GameInputSvc.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTakeOwnershipPrivilege	2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTcbPrivilege	2748	GameInputSvc.exe
Token: SeBackupPrivilege	3408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3924	TieringEngineService.exe
Token: SeManageVolumePrivilege	3924	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5276	AgentService.exe
Token: SeBackupPrivilege	2608	vssvc.exe
Token: SeRestorePrivilege	2608	vssvc.exe
Token: SeAuditPrivilege	2608	vssvc.exe
Token: SeBackupPrivilege	3396	wbengine.exe
Token: SeRestorePrivilege	3396	wbengine.exe
Token: SeSecurityPrivilege	3396	wbengine.exe
Token: 33	436	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeDebugPrivilege	2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	2420	2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 804	2748	GameInputSvc.exe	91
PID 436 wrote to memory of 2660	436	SearchIndexer.exe	113
PID 436 wrote to memory of 252	436	SearchIndexer.exe	114
PID 436 wrote to memory of 1776	436	SearchIndexer.exe	115
PID 436 wrote to memory of 4540	436	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_d9a96f601abbe8f90163dc8e13be013d_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4128

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2124

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2564

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4596

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5904

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5848

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4468

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3932

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1368

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5276

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5712

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3100

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2660
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2768 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2900 2852 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9af9e685c96685659c070013971ad68cd93f9b430f5c3f66de9e04bdeb41ca15
MD5 568ba8cdcb1738cea5c4cfb5b448eb62
SHA1 189eff9dfeb06f230d0e4f48c92c40f46356d22b
SHA512 149e569b6724792702a1d2cb04dbed7dc6a494ff42df96e78866fa4f0731b4b8c474e82871d96084e9cde21494504d2a01c77a28f2ba2834e93d8eed08e091d6
SSDEEP 49152:Lb+632BuPkFKRrdE6oh7stBhuXjfS4LWxniuCe8SiQXZH0:Z3q6gjBxuC450
TLSH
T142D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 d16a10020b01a99a27c0a92dbf82514f39ec76559b26e54a5688db8041669864
MD5 f0182f9e5d565276cba9f3deca480fc7
SHA1 7bd77a558dd0e9b35ba2af39de106a806bd5e0b5
SHA512 649819ac6fed169141a600a77d8a779a697c8887b173d8ad924bf95865180ea6c0e930d522eb5422f913525c32c3d29a12e2bf098d0b74f4d05ef982a910418f
SSDEEP 12288:o1XLsZvZKxy2lRq2czAPZ1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:OXYVytczAPZCe+3SiRejrxb9FvHYt
TLSH
T14205022877E009F9DC678178CDB28506EB33785547A0F7AB03A486761F237989E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 0f7df2a4393ea3a9c087ff3a07cddd5bfb6adffda11e6f0efc6ad0d6393debf1
MD5 ac641b45d65633f730d9a1cd7758a688
SHA1 bb2b68fa602f59357350c4a4860e7e146ed3b1f8
SHA512 c639994ee8b514050552fcc1e3e11f82c0b75b8d4826eb6051d16417007e4cf8aef70c686b3eadd00039ddd93f4f34b93115c549a5bf95460972344a4ecfc7d6
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CIk1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:uwuuOWXkCe+3SiRejrxb9FvHYt
TLSH
T15305F20976A50CF9E96781388A97C53AF7B3B8112A64E72F1760C35B5F37311AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8164de8038bcb17de99957774d20d762f335532798f9c0c1a2b8044ecf57a260
MD5 2ea5b2b50059bce303780efa63aaed81
SHA1 760db5d8eb01c383b462a419223bf97c497e4068
SHA512 df6c057d8e4a5eaac8f86c32ba3b951a1d12dce147e4fde58eaf1b74726fa290621d94b155cee20aec9321cb8a77000e808b007aaf22406c789833d68b831e9a
SSDEEP 49152:OB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glZ5Ce8SiQXZH0:cu6JmTxd2dZ5C450
TLSH
T109D59D13F5DA01E8D05AD478974A9233FA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 2d1ce94346bb690d6c0e0ce4288ad484b9a5a659b5df6975ad242c7853914aa5
MD5 ffc3fa1ec3e756594e849a3590186c10
SHA1 51a993f59fbf4457a72c26cea7668047ae5f6435
SHA512 9735675c79f7d6f5190e61b16d509c69d62fedc3717a5c2409a12972d7d4b20de07a7665c546099d46e25b9c2175d4660604a333d82136e850a1233c872d7790
SSDEEP 12288:RX7by1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:RbyCe+3SiRejrxb9FvHYt
TLSH
T1C7D4231A9C694EB2D87B81B03EA3450FB73E77655F8476BB631603EA5C30B44CE28429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d26e5ac009fdce0e41b1eb971783b0eeb8c35aad602fa28002396e058049d0e9
MD5 6adcdee3134137df197c1b8cfccb2eec
SHA1 24ff646fdc1d933e23efb7fd870f339809fbe62e
SHA512 65514bebe92345bc567bc3bb86b617c7892820dca41423bb8796870bfdcf2e9ddbad435ec918554b43bfb10bb3d8d96cf81dadacf82d2ef36a939557898fba18
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bY/Ce+3SiRejrxb9FvHYt:Vgb4mBIBhGF4Ce8SiQXZH0
TLSH
T12A65AE1E22EC02F5E0FAD2B89DA64417D6B278160731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 e1e607f3a8820e0ca3c9358ff244957a27be1461e1fb8ecd023ac9a0c97c72bd
MD5 4d30d57e32a954d172f34a4f24c9debf
SHA1 d1a4715eb5b9e6be071fbedc8badfeaeb2bf11af
SHA512 581d51fd4fb30b98b9420301035200acaa0859b3aa7632a97db9e4b330625d8fd7fff0c51fa1c924e0df6e0029a3a43dcfec59e706c853ab0c6f099fb14b205f
SSDEEP 12288:VpGN71oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:fGN7Ce+3SiRejrxb9FvHYt
TLSH
T13DE4122D6CB629F4C93BC1B46D72454FBA3636615B4436FF075582B68E20BE0E63CC68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 81ed7b31f7aeffe9dfe1bf010d0bf80b911f13c01496ba14d6a7d1afc3898e6c
MD5 0432615bdc6d41d61a3b99acaf1b7b69
SHA1 6706334864356cea03ab6e282a1cbbaed1ee7f8a
SHA512 d4a44647fef658bb0baa7b37bc6a7b8b6d64b7757fed0d8d3aca00968d3b1d2e552635c42592473406e6a7fcd0e15da8e2465fbc51a55fb3dbb4eed4803f160e
SSDEEP 12288:MO01oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:MO0Ce+3SiRejrxb9FvHYt
TLSH
T179D423199C650EF6C96781B03EA3094FBB3A37266BC437FB531603A64D24BD4D638879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 930df029fc6c7662da4d58b6c7d1e2aff3091c9face9c521922ce33e6349587e
MD5 36815bdcade04a02cd57997585db2ab4
SHA1 2b428f9ad20b7e971938e6d2a7e3ec85278f4678
SHA512 c1497596d6fd3a1b2c296389d6ff29a49765ef479317c77d1b7d1d777d5b977c61d16b0fae478b4aa6f63c59b52514be91636c792acff80fd1167978a416420e
SSDEEP 24576:1wH8g8sDJqH1Mzria7/mzCe+3SiRejrxb9FvHYt:mcfs1qVra7/ECe8SiQXZH0
TLSH
T13035F1257AE101F1D47BD1388A824667F6B2B4250364FBEF07A88B551F23BD44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 82664ded9ec766f1ce906b206a70c08d0ac3f6bf7dee3a3af167ad8a97833122
MD5 ed540af38e9f6cabc15740dd73e96c5a
SHA1 c8385e3ced4e4cbb6652ea24a3f67ac871bfe236
SHA512 7198a6aca81a1512a40c2690c3095797721ea1fce2dab8cba774039253c1aa2e184efe341cc3f3cc2fc680e52419426d9f9e048f3717f3b9bad6fee6204d64bb
SSDEEP 12288:VHvUrBFrEjwaQnWT1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:VPUr+NQnqCe+3SiRejrxb9FvHYt
TLSH
T12605F12F65A91CF5E676E17C8A82470DF77274621741A2DF03A1817E4E23ED8BD3DA20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 314e1cae7fd902567e992e8df5c08829836bf93ad55b70b85935cdaff3e46559
MD5 cbe8206ed996239652290cdcd9cc2790
SHA1 1a13775d510d3728b63abadbdb49fdd9ac3269f3
SHA512 3e52d2384d7cb7490ee31232495a0ea4d869f09699c86f01f95c1042035b559d6fd3f2aada0df3a55da5f7de1bafb2abd96d21f485eaef62e57d33535aa85fea
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNACe8SiQXZH0:RG05lO43bEAC450
TLSH
T108D5C06E62EC11F9D1BBD17CDAC64A0BEBB23415032456CF02A486A91F27FF4967E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 2ba5abb4fce45553fde57134ef1eeb9aa22aef8f25b9fa88c039acbf7d5876a9
MD5 4c883eaf6a1427d5722e702ae27054c0
SHA1 2064227b96e4d470f425e2db11bb0cbc753fb1f8
SHA512 600256bf7cdee1e4fffd293a6d19aa1c3c31ec7a205ff856a77d8e8522ad438134ab9b45e0bc0f9b8d04ba0cf4af81052749ed8c03330037f27338b7ecefd7a1
SSDEEP 24576:RNa5POZ3dpbWVM50JicR2hG0lasx2+47eidnUCe+3SiRejrxb9FvHYt:La5POZ3wJt2pasx2+mOCe8SiQXZH0
TLSH
T1AB65BF5EA6FC01D5D5B9D17CC5834A1AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c7201858af95f20567797a34a16803296fa40614f737dc919011b68e27ceb74a
MD5 47af1045c946cb94c28efc519fae1049
SHA1 9c73bf9d2d893f7e185fe9ed4474d9e90a0ead8b
SHA512 317994e36deaa460dac4a791b8c016832bbec2f43463c96538141cbf797cd1993cfe9b3f4f8b65b399edc3183377258f5bec6003e9a106e0e177d1857b970993
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7Fk3wRCe+3SiRejrxb9FvHYt:3Nc/zEOVHFsuCe8SiQXZH0
TLSH
T122858C2622E901E4F5BBE1BE89779546FA71786513309ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 1b44b06dd9d692f748e88b8edaa2de20942d3081f20096645c8a2691a63a5cbe
MD5 0dde910814818a69cb332c8dc552f1eb
SHA1 6dc84da3b32acdd1429aeaf67a66d457554fae80
SHA512 99a6dccd12ad196a60cab533ba38de29d153a2dd78eca3142fa928fc4a510b9dd204deffaf12a6ff083ce85d1edb0e204552e9ff4d69c23dfc227e8ca8c33e07
SSDEEP 12288:nkHPJnJP6szeCs6Rl28dr1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:WJnJPbzB4SrCe+3SiRejrxb9FvHYt
TLSH
T12715D03DD2A810E8D4B7C2B4815A1A5AFF31386D2F1569DB19B4D1353F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 97967d69c431a99cf1e7e21bae3b8cf9339404698db47fc0dc39844bb857e6e8
MD5 012d789d935aacf7bd089329e253e0fd
SHA1 b3de766967ec8ad9ee1427bb27cc9e8ef1bbc2a4
SHA512 689080b5b5f68244ad8ee7fe85fc91beec96eed7605808d666a6a9cbeca5a743c2c6514aab24f91b80708fd1650c02d310fc18610fcaf3a32dd5f9cb47dcc920
SSDEEP 24576:6CLHGL0MoeVtFumTijCmlKQWDkACe+3SiRejrxb9FvHYt:6CLHGeeV5ijCmlDWDkACe8SiQXZH0
TLSH
T1F8A56C05E7EB5184E8F3CAF5CA2294169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 cf208f8888601c88cf06ab989704841d44b81ab2e280e5393fc157988bcad4df
MD5 af466cf739d89b9a796f1a7dd9868757
SHA1 c69cb194ec22c9257337cb7aa99ce7ca32872ee5
SHA512 9d6d25d497ff03939d126ba7f33018651c50bd3d956f947b329ec2324299488d5afe7026123b15a84314ff912ce17965e1a871f747eff887856c8b845906047c
SSDEEP 12288:UxHck6j5ZI7S+1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:k6DIW+Ce+3SiRejrxb9FvHYt
TLSH
T13305011D267A10F5D06BD07D9A93050AE2B2B17187512AEF0794C2BE8EA3FD8F93CD51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 e3e6aae147cc4c43cc9eba9485b41b56bc1b060b3c22982cce45dd71a38e58be
MD5 8b4f0319bbfc24570a03af89c3940b7b
SHA1 dcba25655a85923d50212ca627acb6e3317ef91f
SHA512 c98235a71c1667b8614233bb3f8ca2e4bf0702602904ab1819a99c7a0858bb27b7772fa341faf45cae13e0acc93dafebd01e33b6e1c64dab1e072bdb288e3132
SSDEEP 12288:AG6kym81oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:Rtym8Ce+3SiRejrxb9FvHYt
TLSH
T175F412096AA415E5DABA42746EB3418EAF367D205B4073FF1391933F1E31BD0E934B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 c251fa4d5d7a677ac5ff744efc5a1e7088e0eafe17b587c6f411eb01ba31adbb
MD5 67ad2864000668ffcd465f774281497f
SHA1 f4087ec03a85c3d417e0a0667c7ff1fae19f3dea
SHA512 5e8ce0a42c13c69f5f3055e7d95f6d9d49438f26fdcc729f0f76b2d590982724152812b6de9902b815e60b07894dd89e425fd32d30adc59a88214d8549569551
SSDEEP 12288:5lbW1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:bbWCe+3SiRejrxb9FvHYt
TLSH
T179D4222D9C651AF5C82781B02EA30A4FB73A33751B8436FF175643B68E24BD4D638C69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 4d6b6bf86110b4f439c6903fe54567370a187ef00806ec533e37789a5b68b724
MD5 12f5bf811d4ac855844ebaa3e841f2d8
SHA1 ea1d9cc836ebfad16e4cfc260026355ea080c180
SHA512 f05e8117fa414ee9e0d84c1bc9e23d1c1b2dc9d27aa695a67e93c0a1289ea1cb8a43ae888a0e6657a0556be20ed41b8cf864c50d3913274beaf3edcf65826552
SSDEEP 12288:dUgIBZyFDK3tT5Tr7aVLIH9lH3c11oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkx:dUgIKoTfaidZsCe+3SiRejrxb9FvHYt
TLSH
T143559C1DA7EA09DAE2B2D275D8721483D633B4311771D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 aa69682afcbf4744a2561ac91a01ccd55635c98b725d1fa7b5d653cf9387b3b7
MD5 1afc8df645204c5f337808c93269f245
SHA1 a3136b58141b67d3c8d7225940172924d5118fba
SHA512 f1d591d4a1b61f32506bc3c326624f40748e8bd6e37c6ece4700c323fa1e97a86a80f28a743008dad04611d78ce23f99f430c12d3c090a4326b16a0876d31c32
SSDEEP 12288:JpJcm8CNu1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:JrcmRuCe+3SiRejrxb9FvHYt
TLSH
T15F05F11EB6AA00F5D1B7C17C8D82454AF7737131275167EF02A1837E4E27AE9BE38A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 080616e3215c25e8aecd4126b6744bdcfbd01cb34c30fdb31f808aacdf0eae28
MD5 0107d4e76f367812682b08b6dd08bd70
SHA1 f25f9322e80944d1c564a63bbe0a64e11535bf8a
SHA512 294fa1230a5d094fac54516c1152eb999ff00dda94fe62e4c00bed831c1a1657217f731a11d6450576969058985bc1bfec4b16880a193f87ea15b91bb2c1903a
SSDEEP 49152:uDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3QCe8SiQXZH0:v3Upow8sBZC450
TLSH
T172A58C3DA2E810A8C9AAC379C54213A6EA71742D3F3055DB0174C178BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-74-0x00007FF728070000-0x00007FF72818A000-memory.dmp

Download

memory/240-75-0x000001258D0C0000-0x000001258D126000-memory.dmp

Download

memory/240-76-0x000001258D0C0000-0x000001258D126000-memory.dmp

Download

memory/240-133-0x00007FF728070000-0x00007FF72818A000-memory.dmp

Download

memory/436-227-0x0000025ED3580000-0x0000025ED35E6000-memory.dmp

Download

memory/436-250-0x00007FF7F0AC0000-0x00007FF7F0DFF000-memory.dmp

Download

memory/436-228-0x00007FF7F0AC0000-0x00007FF7F0DFF000-memory.dmp

Download

memory/436-229-0x0000025ED3580000-0x0000025ED35E6000-memory.dmp

Download

memory/804-37-0x00000274C2210000-0x00000274C2276000-memory.dmp

Download

memory/804-84-0x00007FF64C3E0000-0x00007FF64C4A9000-memory.dmp

Download

memory/804-35-0x00007FF64C3E0000-0x00007FF64C4A9000-memory.dmp

Download

memory/804-38-0x00000274C2210000-0x00000274C2276000-memory.dmp

Download

memory/804-36-0x00000274C2210000-0x00000274C2276000-memory.dmp

Download

memory/1368-145-0x000002CF4B7E0000-0x000002CF4B846000-memory.dmp

Download

memory/1368-146-0x00007FF75DAE0000-0x00007FF75DB94000-memory.dmp

Download

memory/1368-147-0x000002CF4B7E0000-0x000002CF4B846000-memory.dmp

Download

memory/1368-199-0x00007FF75DAE0000-0x00007FF75DB94000-memory.dmp

Download

memory/2124-54-0x0000018F47620000-0x0000018F47686000-memory.dmp

Download

memory/2124-53-0x0000018F47400000-0x0000018F474F3000-memory.dmp

Download

memory/2124-55-0x0000018F47620000-0x0000018F47686000-memory.dmp

Download

memory/2420-7-0x0000000002C20000-0x0000000002C89000-memory.dmp

Download

memory/2420-3-0x0000000002B10000-0x0000000002C1C000-memory.dmp

Download

memory/2420-6-0x0000000002C20000-0x0000000002C89000-memory.dmp

Download

memory/2420-0-0x0000000002C20000-0x0000000002C89000-memory.dmp

Download

memory/2564-64-0x0000019D80A00000-0x0000019D80A66000-memory.dmp

Download

memory/2564-62-0x00007FF64B8C0000-0x00007FF64BA28000-memory.dmp

Download

memory/2564-71-0x00007FF64B8C0000-0x00007FF64BA28000-memory.dmp

Download

memory/2564-63-0x0000019D80A00000-0x0000019D80A66000-memory.dmp

Download

memory/2564-69-0x0000019D80A00000-0x0000019D80A66000-memory.dmp

Download

memory/2608-193-0x0000021710370000-0x00000217103D6000-memory.dmp

Download

memory/2608-192-0x0000021710370000-0x00000217103D6000-memory.dmp

Download

memory/2608-198-0x00007FF6A7CD0000-0x00007FF6A81A1000-memory.dmp

Download

memory/2608-226-0x00007FF6A7CD0000-0x00007FF6A81A1000-memory.dmp

Download

memory/2748-27-0x0000022434BA0000-0x0000022434C06000-memory.dmp

Download

memory/2748-29-0x0000022434BA0000-0x0000022434C06000-memory.dmp

Download

memory/2748-26-0x00007FF64C3E0000-0x00007FF64C4A9000-memory.dmp

Download

memory/2748-61-0x00007FF64C3E0000-0x00007FF64C4A9000-memory.dmp

Download

memory/2748-28-0x0000022434BA0000-0x0000022434C06000-memory.dmp

Download

memory/3100-217-0x00007FF780E00000-0x00007FF780F2F000-memory.dmp

Download

memory/3100-218-0x000001CE44690000-0x000001CE446F6000-memory.dmp

Download

memory/3100-249-0x00007FF780E00000-0x00007FF780F2F000-memory.dmp

Download

memory/3100-219-0x000001CE44690000-0x000001CE446F6000-memory.dmp

Download

memory/3368-157-0x000001C30FA60000-0x000001C30FAC6000-memory.dmp

Download

memory/3368-200-0x00007FF7862E0000-0x00007FF786583000-memory.dmp

Download

memory/3368-156-0x000001C30FA60000-0x000001C30FAC6000-memory.dmp

Download

memory/3368-155-0x00007FF7862E0000-0x00007FF786583000-memory.dmp

Download

memory/3396-209-0x0000024278870000-0x00000242788D6000-memory.dmp

Download

memory/3396-246-0x00007FF7FE990000-0x00007FF7FEE97000-memory.dmp

Download

memory/3396-208-0x0000024278870000-0x00000242788D6000-memory.dmp

Download

memory/3396-206-0x00007FF7FE990000-0x00007FF7FEE97000-memory.dmp

Download

memory/3408-252-0x000001FC187D0000-0x000001FC18836000-memory.dmp

Download

memory/3408-117-0x00007FF67DFD0000-0x00007FF67E714000-memory.dmp

Download

memory/3408-116-0x000001FC187D0000-0x000001FC18836000-memory.dmp

Download

memory/3408-253-0x00007FF67DFD0000-0x00007FF67E714000-memory.dmp

Download

memory/3408-118-0x000001FC187D0000-0x000001FC18836000-memory.dmp

Download

memory/3408-171-0x00007FF67DFD0000-0x00007FF67E714000-memory.dmp

Download

memory/3924-165-0x00000281BDBB0000-0x00000281BDC16000-memory.dmp

Download

memory/3924-163-0x00007FF741950000-0x00007FF741AE5000-memory.dmp

Download

memory/3924-164-0x00000281BDBB0000-0x00000281BDC16000-memory.dmp

Download

memory/3924-207-0x00007FF741950000-0x00007FF741AE5000-memory.dmp

Download

memory/3932-201-0x000001B129D50000-0x000001B129DB6000-memory.dmp

Download

memory/3932-203-0x00007FF697430000-0x00007FF697847000-memory.dmp

Download

memory/3932-136-0x000001B129D50000-0x000001B129DB6000-memory.dmp

Download

memory/3932-135-0x000001B129D50000-0x000001B129DB6000-memory.dmp

Download

memory/3932-197-0x00007FF697430000-0x00007FF697847000-memory.dmp

Download

memory/3932-134-0x00007FF697430000-0x00007FF697847000-memory.dmp

Download

memory/4128-16-0x0000019DDFDE0000-0x0000019DDFE46000-memory.dmp

Download

memory/4128-15-0x00007FF60D0F0000-0x00007FF60D213000-memory.dmp

Download

memory/4128-18-0x0000019DDFDE0000-0x0000019DDFE46000-memory.dmp

Download

memory/4128-17-0x0000019DDFDE0000-0x0000019DDFE46000-memory.dmp

Download

memory/4128-50-0x00007FF60D0F0000-0x00007FF60D213000-memory.dmp

Download

memory/4468-125-0x000002273CB20000-0x000002273CB86000-memory.dmp

Download

memory/4468-126-0x000002273CB20000-0x000002273CB86000-memory.dmp

Download

memory/4468-181-0x00007FF78AF60000-0x00007FF78B00E000-memory.dmp

Download

memory/4468-124-0x00007FF78AF60000-0x00007FF78B00E000-memory.dmp

Download

memory/4516-46-0x000001BD14C90000-0x000001BD14CF6000-memory.dmp

Download

memory/4516-44-0x000001BD14A30000-0x000001BD14B23000-memory.dmp

Download

memory/4516-45-0x000001BD14C90000-0x000001BD14CF6000-memory.dmp

Download

memory/4596-89-0x000002D26C450000-0x000002D26C4B6000-memory.dmp

Download

memory/4596-87-0x000002D26C4F0000-0x000002D26C5E3000-memory.dmp

Download

memory/4596-88-0x000002D26C450000-0x000002D26C4B6000-memory.dmp

Download

memory/5276-172-0x0000013B64260000-0x0000013B642C6000-memory.dmp

Download

memory/5276-174-0x0000013B64260000-0x0000013B642C6000-memory.dmp

Download

memory/5276-173-0x00007FF66CF40000-0x00007FF66D261000-memory.dmp

Download

memory/5276-180-0x00007FF66CF40000-0x00007FF66D261000-memory.dmp

Download

memory/5276-178-0x0000013B64260000-0x0000013B642C6000-memory.dmp

Download

memory/5712-185-0x0000027E33E20000-0x0000027E33E86000-memory.dmp

Download

memory/5712-216-0x00007FF740B00000-0x00007FF740D8B000-memory.dmp

Download

memory/5712-184-0x00007FF740B00000-0x00007FF740D8B000-memory.dmp

Download

memory/5712-186-0x0000027E33E20000-0x0000027E33E86000-memory.dmp

Download

memory/5848-110-0x0000000000950000-0x00000000009B9000-memory.dmp

Download

memory/5848-104-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5848-105-0x0000000000950000-0x00000000009B9000-memory.dmp

Download

memory/5848-153-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5904-95-0x00007FF7D8130000-0x00007FF7D827A000-memory.dmp

Download

memory/5904-97-0x0000025C9AD60000-0x0000025C9ADC6000-memory.dmp

Download

memory/5904-98-0x0000025C9AD60000-0x0000025C9ADC6000-memory.dmp

Download

memory/5904-144-0x00007FF7D8130000-0x00007FF7D827A000-memory.dmp

Download