db9a03da7d82a88f98fe34aff19d81d043472c57f95d2712406c41b979b532ae

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
Size 1.7MB
Sample260731-c3wp4abd96
SHA256 db9a03da7d82a88f98fe34aff19d81d043472c57f95d2712406c41b979b532ae
MD5 bc086c2fde0a87d2b8eb74f958f4f305
SHA1 b9a3660ce9aff5d2afb274d4ccd2f298ee39a765
SHA512 b469ab7e29e319bea2ddd61055a8eef4d1f79705b4528f0eafc3418316672c3ce933189700f2c873b0498cb4ffe762eeb972c96800b37de8d77a808f45d5d731
SSDEEP 49152:CNZCWOLT4laGMMm5K2MtENFeBRUZRbgW5pQXe9:QwnLT3GMYcwXM
TLSH
T15F855B0667F94129F1F33B71EEB992645A77BC71AE3AC50E6280125E0DB4E50DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3292	alg.exe
3556	GameInputSvc.exe
1892	GameInputSvc.exe
1512	elevation_service.exe
5060	elevation_service.exe
4700	maintenanceservice.exe
4620	msdtc.exe
2964	OSE.EXE
2384	PerceptionSimulationService.exe
3240	perfhost.exe
4196	ReFsDedupSvc.exe
3588	locator.exe
4644	SensorDataService.exe
4088	snmptrap.exe
3380	ssh-agent.exe
4864	TieringEngineService.exe
2792	AgentService.exe
5896	vds.exe
3752	vssvc.exe
3432	wbengine.exe
4976	WmiApSrv.exe
552	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\255d013b24febf98.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\java.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaw.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc36a6a09520dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef23bda09520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1892	GameInputSvc.exe
1892	GameInputSvc.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
Token: SeTcbPrivilege	3556	GameInputSvc.exe
Token: SeBackupPrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4196	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4196	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	TieringEngineService.exe
Token: SeManageVolumePrivilege	4864	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2792	AgentService.exe
Token: SeBackupPrivilege	3752	vssvc.exe
Token: SeRestorePrivilege	3752	vssvc.exe
Token: SeAuditPrivilege	3752	vssvc.exe
Token: SeBackupPrivilege	3432	wbengine.exe
Token: SeRestorePrivilege	3432	wbengine.exe
Token: SeSecurityPrivilege	3432	wbengine.exe
Token: 33	552	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeDebugPrivilege	912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
912	2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 1892	3556	GameInputSvc.exe	93
PID 552 wrote to memory of 4752	552	SearchIndexer.exe	115
PID 552 wrote to memory of 4692	552	SearchIndexer.exe	116
PID 552 wrote to memory of 2984	552	SearchIndexer.exe	117
PID 552 wrote to memory of 6016	552	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_bc086c2fde0a87d2b8eb74f958f4f305_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:912

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3292

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5060

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4700

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2384

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3240

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4644

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4088

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3380

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1656 1648 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1608 1660 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 15fd4dac71daa1a9de12bc5d41b05f05a2b8c1150963f222896462ba0f79e995
MD5 443059e025332a451a9bf21f83158206
SHA1 2710ea0edfdee0477701ad3c6c2d67e683f0d2ad
SHA512 4b4d21dc0ac86df06e125a5edd7f72c730995830db0613a0df88019dc77697a372af3d6de571991fb159e3eca27d5ba93d1d33a6995d70827c8684dfae36435b
SSDEEP 49152:Ob+632BuPkFKRrdE6oh7stBhuXjfS4LWxnVeBRUZRbgW5pQXe9:Q3q6gjB0wXM
TLSH
T1D4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 fdd34eb5efaea0938e06b0aed82ba567d8f0d04d442d00a85d24d9788b5d5880
MD5 02a8b40d0c9457df92e18125a5c1ec9a
SHA1 701f8a583cdb87501c265f3807545a05350e62c2
SHA512 36242d99eec062b595a9f90afcb615e5c74d9c1495d6978d0c676272042d40fd494870ecb5f7a14060dc248026cc996a5cd1aa96cde17a3f7f5a65dbe8e93688
SSDEEP 24576:PXYjqZczA6rVeEGRBOZRTnE7/N+x6diMgQXe9:nZcPeBRUZRbgW5pQXe9
TLSH
T15A050228B3D408F9FDAB817CC9B2C501E67378558760E79B03E499690F236D89E3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 49933acc7baa48c36ec133d239d7d39d635e81d7d071ed6fce7f200d568e9878
MD5 b276821529db46ee5c5aa0be8842524b
SHA1 e188c1c06fe23dd702c8a192e50c521d67ffcf50
SHA512 99c58d6cd84c0e285df24c937b3349e2e78ba4689b4d38c3202bd417416cbc8db39930c44be374d60f7d03317bb6ea3e874b09d5602485b066b11dc349da293c
SSDEEP 24576:Uwu8OWoVeEGRBOZRTnE7/N+x6diMgQXe:UwvOjeBRUZRbgW5pQXe
TLSH
T1DA05F14672D80CF9FAA79138C697C536F7F2B8112A25CB2B1760C64B5F37261AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2d66fc0b1b6a9d15793225697c43609900b146649713a32477a6bc00606dcd92
MD5 e1109a601e5f74411851103f3ae55e43
SHA1 7d0ebd578516aa8c24b154fcfc18b47f460681f6
SHA512 00c36a7895aba0c9007cfc16dea1251b3ee4089f4cd3607cbc8b68bb4d1b056bcf8ece21f72a46bd77d30852dc973d74fcee1430607c296fd8633b92a90519bc
SSDEEP 49152:MB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gly3eBRUZRbgW5pQXe9:Gu6JmTxd2dywXM
TLSH
T135D5AD13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpA241.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpA241.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 fa580630cf9ba29b34ca81eed8f01ede826cac5c556e7eacb00959ba7ce169a9
MD5 e28d4ea7fb981c8877846b9b91c45aa2
SHA1 36a5e18fe8535f5c32e2d3b0e8e477096eeb2100
SHA512 11c2dfbcb8b80abcc341c52e1972b3f5f665a378ef7cff6f33084dce947f6ba482e10f201bc9da79400e1bd62da38da149848c8534e188cad82bc0c86314925c
SSDEEP 12288:T470VedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:U0VeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T144D42362D2CC484AFEFDA47C82F9EA04929D7438CF0585B3BE4672894876CD9E635317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 766e00a05ce1c847d6bf4aaa7f4173eb2f1ca9b3e99a4c7902d86a7c6e0fc99e
MD5 f7a8ee2e6938ece7a42d65d70e8e2b3b
SHA1 53dd0ca03929d534a4c4713599611a47d8c16cfc
SHA512 16c7ba12c95cde90040890c83d196e708d7fbb07ea31dd7e800ec0cf646955127d84c2ec09678c964da3d713865686f849447c08b1ec65596cf4ec831f3275cf
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYKVeEGRBOZRTnE7/N+x6diMgQXe9:tgb4mBIBhGF5eBRUZRbgW5pQXe9
TLSH
T1CC65AF1E22EC01F5E1F9E2B8CDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 656KB
SHA256 fa382ea6e058dbc5e65d92d035aa02ebdde6e7891270d4bc3cd90d54becd3527
MD5 4c3b5c075f165dcae1350a81bc77f1b2
SHA1 26da16e963874c10c09e6d79462ae3078c1dc6d0
SHA512 39c8f015c3026c301b03bace13da9eb90236686802a2930d411a109c0c0241095f92d4dce4a23685453aff2b8888fc94b32e90226b0a699acd70bf42522eb50a
SSDEEP 12288:AdGr9VedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:8Gr9VeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T14CE42329A1D92099FEBDD17DC1B5EA06B4F130708B0556FF0ED1A1798F668E4F238B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 63bf4efeb4e791f67b975773f10dfad7155fbd7d5143fd9420a9d09c743f7ba3
MD5 abcc63192774a4dcbd7a33eda2364b70
SHA1 e83cf2034d9e35aac73c3b593ad8abdbf7a3c632
SHA512 a58965aa4bf242b29d2c36d113d6d3f8a66501945383129ba903da58e022fd560d7d75ebe9ebf4c9bd3ce662bd600318d8e3de1593b0d4ab6f2005e7b6537d47
SSDEEP 12288:aAVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:aAVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T110D42351D0CC448BFFF9A4BDC2F6EA0891D83438CB4A46F36E867186496B8D9E235353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 f8ccd6dd2f6f9ebae68a8d2deef54e0fdf2e9c33aa53e23e5fa663d5193cf76d
MD5 9f974347a4bc8c8b76b04cdc3d27b5f5
SHA1 2f84a74d2d531bff7ba70f543f7027a1a888f96a
SHA512 5f48e04730e3d493c632cfb2726c6b5127bb57d22219a736678e8b4b1fbfe34c4aa177bb0675dd12cb889329f7b194ead1748ba74f4533e1c1a7114d42bc993e
SSDEEP 24576:iyS8Lw6pJqH1Mzria7/mJVeEGRBOZRTnE7/N+x6diMgQXe9:Bh06PqVra7/OeBRUZRbgW5pQXe9
TLSH
T11D350265B2D101F1E4BBD138CA968653F6B1B4250364EFDF0BA88B451F23AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 23532bb43f1d9417c0438acd29047e45b398f4defcd24dbe74eb931ce6d5dbb0
MD5 38c1df1aafaa8be329d8ea89af8d7c55
SHA1 c5cbbd2e3f3013f6725afe53f42a5a87425868ed
SHA512 91a32ef2379794fbc187611f47c28a52e5ba9c3e453c5f9f711e10f96ef59697e85df692a269ee21619a78b5aa8654b67b64caea91d37a0dfaccacfc7cc9cd80
SSDEEP 24576:3PUr+NQdVeEGRBOZRTnE7/N+x6diMgQXe9:3JQPeBRUZRbgW5pQXe9
TLSH
T1B805F12F62DC18E5FABAE17DC6828709E7717462071292DF02E0816E4E67DE8BD3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 a38671002ced1a2c54be6cb7c27a54a775ecb8c65e54984a21482de5730c7460
MD5 317f4b41c37ad9fc0283b8749941de7e
SHA1 47d6d0716046d711cad582ae6a022319eaeb0e0e
SHA512 5631a9768eadf8f6b2028d96ebfe522cf67448bd2bf83dc3c637cede61757002c495fe9cab526b00f6528ad0847778c0fc4f0efe8c556d29c102ac01dcef9240
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6eBRUZRbgW5pQXe9:3G05lO43b5wXM
TLSH
T1BAD5C06E62EC11F9D1BBD17CCAC6860BEBB23415033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bc3b4ec43496501ca8707c1eea6f62b6162ac8cb6b5827a103a70b3bc7e4d28d
MD5 c4578302f865afdda7d4053821b7d067
SHA1 e7309e65bfcde24d2666cf0414055ada4cf9ab59
SHA512 4fbacee5fbe15f3116d0d2778ed3c10713eb9476804876e5ecacf72edf689047274feb15222029253be25403a17c2ce187be100b41df16f2172583c8d6464f6d
SSDEEP 24576:Rsa5POZ3dpbWVM50JicR2hG0lasx2+47eidnorI33j2D2vRRRYK8npO1ArOoKVb/:qa5POZ3wJt2pasx2+myYc25jYKz1kFY/
TLSH
T19B65BF5EA6FC01D5D2B9D17DC583461AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 19bb0b1129b3369db7cf6997396db662f1a860ee06c807bf193d695f5468428b
MD5 f9509e4db2af1f1b1917f427478d7478
SHA1 69be0cf0f38a9803a41ab922adc78652f345c327
SHA512 cdae9d1103d68c77453dc0faec4a3a91e45df72f818563c3e040abc5623c9fd94ed16fdded10daf772841188a4d68fde46ec949ce375c982896bfbe05c3942a9
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7FkTVeEGRBOZRTnE7/N+x6diMgQXe9:mNc/zEOVHFQeBRUZRbgW5pQXe9
TLSH
T1B0858C1623E901E4F5BBE1BE89779546FAB1786553308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 39a9a19af33bcce4d3e7e2611d18299fce2e46df8e842449974944948ef33eb5
MD5 f1063553e5493708a8942bd089ffe811
SHA1 a9c9cc1506f8a7b93361a5267d4fe6af910fc5af
SHA512 66b20a52d09ab9ad34accb665ae0014257802f5e628c41a96b97a07d891a0242f7ad5c0fd4dda9d6fecebe13bae22cf3cc2ed77efcc3f5aa214c45267057a83d
SSDEEP 24576:PJnJPbzB4SRVeEGRBOZRTnE7/N+x6diMgQXe9:PJnJv6SjeBRUZRbgW5pQXe9
TLSH
T16015E03DD29810E8E8B7C2B4815A5B59FE71347C2F2669C719B4D4343F12EE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1fabf59da796bd73ccde61c8aeeafd498caf00d91a15d1fd98f1431951e6dfb5
MD5 a3bb453380e83dbed60d85bb5c042a63
SHA1 fff297c2580aac7b7ec66c628007ab2ca5d125e9
SHA512 56aa554d59766ccd2dca24e07be26cbcc734f2ed419897bb45055bf836c654d205d2a39f73a3c96d293109df36a831f64b11628f554cb67bb5b5c74fd7073f88
SSDEEP 49152:3CLHGeeV5ijCmlDWDk9eBRUZRbgW5pQXe9:yjwXM
TLSH
T16DA56B05E7EA4184F8F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 772KB
SHA256 43705c5cbbc262b81195ac9385ec2376c518353a8cbac0fc60b76f33cb6ab310
MD5 14ee5476a27b583b6bae631f4834b464
SHA1 483fc320dde3158e53fea41c009db9f7e49232d7
SHA512 4f0e460e007a5c468261067d636f2604276806f914d03c3bb9e7b4ca49ebbe2b24d26b62a00cc469e9bc308f11889f0da5a956c356f917ef035377705d0ea642
SSDEEP 12288:81Hck6j5ZI7lVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:06DIJVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T120F4F15D63AA10FAE1BBD03DC6924501D2B2B074C7125AEF0BD4D5BA4EA3DDCB538B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 34dc0a85b16699f2bb561c112598d6c15f9eb616009c1975db2e9cf402c13dfa
MD5 ab1782b946b317c3492ceffa24ed97c2
SHA1 bbcb666e6812c809c18c29a583dab505391e896b
SHA512 741d358c80933f1fa5db40d7a775fa0453226ec3d00a812c5d21de11926599703d655796491b8952feaa582bfd58763e176eddf6af98c4d899082ecfe039424f
SSDEEP 12288:rG6kyAjVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:KtyAjVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T1D5F41201A3C850D9FEF9557CCAB2D2449A79BC309B1297EB6AD1F61E0E36AD4E530313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 1964de53979ee76f93251f64d41623be65077a125411d5933bd454e2005939f2
MD5 558923f2ba91b2e673b7a7d719e1851a
SHA1 af299de99a1526f2cfec159d687e08495257b9d6
SHA512 38490fbd395ae282b44ee879ad5c0307ac6b4ac8a74e7b038fee04f4e3406e3fed6c7d65e5ce407f7a3b3ea072e5e18281b262d2dfcdbb6d416f50e07f57c69b
SSDEEP 12288:yypVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:npVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T106D42355D1C8548AFEF8E4BDC2B5EB0991A934388F0656F37EC1B1858A7B8D9E235303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 b52939eb2b59c06a0473e56ade5026b97322ccf6f5e242fb14f092882d79a4e3
MD5 1043643d20c14d7280815b271dcf25f2
SHA1 4fb5be1e9baa9c21f6b6d550b8006cf7532b7f48
SHA512 2afb5f937476869b0d991763d408c72b0e9c45a87df2021a06999ec5f5374e042896c85611ae477e20f181415c842aa8526200c160e70222b497e5676370fee4
SSDEEP 24576:8TgkSoTfaidZDVeEGRBOZRTnE7/N+x6diMgQXe9:WgkTrZheBRUZRbgW5pQXe9
TLSH
T1DC559D1DA3EA05CAE2B2D279D9725483D633B4315772C6DF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 788KB
SHA256 048eca7c0ed2a74ced815f97d367d87a2553411fa8a9fee51ff22fdfee88a2ac
MD5 22dff8e9efbcd20df6a13fea7e6c8689
SHA1 056ececd9212fa1b7f5c648e33a3a35d5689cec9
SHA512 a549aa10ab88b626d9a4f5129cd68575882a7f147d2ea599b7666c904c08899a3623890928f483eff2b4b385adc13329494d4a67e08068d30437a5c67e1faeb1
SSDEEP 12288:jpJcm8CNqVedmuQ552RRFVOZR4YnEWJCZH9rB+jPSeMddiMmqTyQX419:jrcmRqVeEGRBOZRTnE7/N+x6diMgQXe9
TLSH
T1FF05014EB2AE00E6E6BBD13CC9818605E6B37030571257EB06A1C77E4E679EDBD34712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.0MB
SHA256 fff401cf565a73f7f51d08b3c3534ff567b190eedc0a1810e0c4d9ab7cf5ca0b
MD5 b51068964bd0854b3e035c5a6c95e6a2
SHA1 3f5537c96b6340925776bd3b129ec0b2d668eb21
SHA512 c6ec8f59288f126a13bf1bfce2d03c7cba9530e7360238e3ade81c7f5faef3f2b8a10d1c64d9dc9717d13ae7ab2fe960a25f6cc1d7f0e437e9e8e938fdd9e39d
SSDEEP 49152:GDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3V1eBRUZRbgW5pQXe9:H3Upow8sBG1wXM
TLSH
T17EA58C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BDF19A39F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-357-0x00007FF7CA230000-0x00007FF7CA56D000-memory.dmp

Download

memory/552-331-0x00007FF7CA230000-0x00007FF7CA56D000-memory.dmp

Download

memory/552-334-0x000002616ADB0000-0x000002616AE16000-memory.dmp

Download

memory/552-332-0x000002616ADB0000-0x000002616AE16000-memory.dmp

Download

memory/912-6-0x0000000003670000-0x00000000036D9000-memory.dmp

Download

memory/912-7-0x0000000003670000-0x00000000036D9000-memory.dmp

Download

memory/912-2-0x0000000003670000-0x00000000036D9000-memory.dmp

Download

memory/912-1-0x0000000001CA0000-0x0000000001D8C000-memory.dmp

Download

memory/1512-131-0x00000135F8B60000-0x00000135F8BC6000-memory.dmp

Download

memory/1512-130-0x00000135F8B60000-0x00000135F8BC6000-memory.dmp

Download

memory/1512-129-0x00000135F88F0000-0x00000135F8A31000-memory.dmp

Download

memory/1892-177-0x00007FF723D50000-0x00007FF723E17000-memory.dmp

Download

memory/1892-122-0x0000016BCE0C0000-0x0000016BCE126000-memory.dmp

Download

memory/1892-123-0x0000016BCE0C0000-0x0000016BCE126000-memory.dmp

Download

memory/1892-121-0x0000016BCE0C0000-0x0000016BCE126000-memory.dmp

Download

memory/1892-120-0x00007FF723D50000-0x00007FF723E17000-memory.dmp

Download

memory/2384-183-0x0000023A883D0000-0x0000023A88436000-memory.dmp

Download

memory/2384-180-0x00007FF775A80000-0x00007FF775BC8000-memory.dmp

Download

memory/2384-182-0x0000023A883D0000-0x0000023A88436000-memory.dmp

Download

memory/2384-229-0x00007FF775A80000-0x00007FF775BC8000-memory.dmp

Download

memory/2792-258-0x000001ECD7EA0000-0x000001ECD7F06000-memory.dmp

Download

memory/2792-262-0x00007FF7B1750000-0x00007FF7B1A6F000-memory.dmp

Download

memory/2792-263-0x000001ECD7EA0000-0x000001ECD7F06000-memory.dmp

Download

memory/2792-265-0x00007FF7B1750000-0x00007FF7B1A6F000-memory.dmp

Download

memory/2792-257-0x000001ECD7EA0000-0x000001ECD7F06000-memory.dmp

Download

memory/2964-172-0x00000203BADF0000-0x00000203BAE56000-memory.dmp

Download

memory/2964-171-0x00000203BAB80000-0x00000203BACC1000-memory.dmp

Download

memory/2964-173-0x00000203BADF0000-0x00000203BAE56000-memory.dmp

Download

memory/3240-194-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3240-195-0x00000000008E0000-0x0000000000949000-memory.dmp

Download

memory/3240-238-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3240-189-0x00000000008E0000-0x0000000000949000-memory.dmp

Download

memory/3292-16-0x000001ADFF6B0000-0x000001ADFF716000-memory.dmp

Download

memory/3292-17-0x000001ADFF6B0000-0x000001ADFF716000-memory.dmp

Download

memory/3292-15-0x00007FF6CFEF0000-0x00007FF6D0011000-memory.dmp

Download

memory/3292-18-0x000001ADFF6B0000-0x000001ADFF716000-memory.dmp

Download

memory/3292-135-0x00007FF6CFEF0000-0x00007FF6D0011000-memory.dmp

Download

memory/3380-289-0x00007FF720850000-0x00007FF720AF2000-memory.dmp

Download

memory/3380-240-0x00007FF720850000-0x00007FF720AF2000-memory.dmp

Download

memory/3380-241-0x000001D315050000-0x000001D3150B6000-memory.dmp

Download

memory/3380-242-0x000001D315050000-0x000001D3150B6000-memory.dmp

Download

memory/3432-301-0x00007FF7BFC30000-0x00007FF7C0135000-memory.dmp

Download

memory/3432-290-0x0000026987460000-0x00000269874C6000-memory.dmp

Download

memory/3432-291-0x0000026987460000-0x00000269874C6000-memory.dmp

Download

memory/3432-352-0x00007FF7BFC30000-0x00007FF7C0135000-memory.dmp

Download

memory/3556-111-0x00007FF723D50000-0x00007FF723E17000-memory.dmp

Download

memory/3556-146-0x00007FF723D50000-0x00007FF723E17000-memory.dmp

Download

memory/3556-112-0x0000020DC2C80000-0x0000020DC2CE6000-memory.dmp

Download

memory/3556-113-0x0000020DC2C80000-0x0000020DC2CE6000-memory.dmp

Download

memory/3556-114-0x0000020DC2C80000-0x0000020DC2CE6000-memory.dmp

Download

memory/3588-211-0x00000179A2200000-0x00000179A2266000-memory.dmp

Download

memory/3588-267-0x00007FF637050000-0x00007FF6370FC000-memory.dmp

Download

memory/3588-209-0x00007FF637050000-0x00007FF6370FC000-memory.dmp

Download

memory/3588-210-0x00000179A2200000-0x00000179A2266000-memory.dmp

Download

memory/3752-348-0x00007FF727860000-0x00007FF727D2F000-memory.dmp

Download

memory/3752-280-0x000002D028500000-0x000002D028566000-memory.dmp

Download

memory/3752-279-0x00007FF727860000-0x00007FF727D2F000-memory.dmp

Download

memory/3752-278-0x000002D028500000-0x000002D028566000-memory.dmp

Download

memory/4088-231-0x00007FF664730000-0x00007FF6647E2000-memory.dmp

Download

memory/4088-230-0x000001CB53EC0000-0x000001CB53F26000-memory.dmp

Download

memory/4088-284-0x00007FF664730000-0x00007FF6647E2000-memory.dmp

Download

memory/4088-232-0x000001CB53EC0000-0x000001CB53F26000-memory.dmp

Download

memory/4196-361-0x00007FF66BC20000-0x00007FF66C362000-memory.dmp

Download

memory/4196-201-0x0000020CA9630000-0x0000020CA9696000-memory.dmp

Download

memory/4196-203-0x0000020CA9630000-0x0000020CA9696000-memory.dmp

Download

memory/4196-202-0x00007FF66BC20000-0x00007FF66C362000-memory.dmp

Download

memory/4196-256-0x00007FF66BC20000-0x00007FF66C362000-memory.dmp

Download

memory/4196-360-0x0000020CA9630000-0x0000020CA9696000-memory.dmp

Download

memory/4620-218-0x00007FF6B5B60000-0x00007FF6B5C78000-memory.dmp

Download

memory/4620-161-0x000001F9C2CF0000-0x000001F9C2D56000-memory.dmp

Download

memory/4620-159-0x00007FF6B5B60000-0x00007FF6B5C78000-memory.dmp

Download

memory/4620-160-0x000001F9C2CF0000-0x000001F9C2D56000-memory.dmp

Download

memory/4644-221-0x0000025031FB0000-0x0000025032016000-memory.dmp

Download

memory/4644-277-0x00007FF6214F0000-0x00007FF621905000-memory.dmp

Download

memory/4644-316-0x0000025031FB0000-0x0000025032016000-memory.dmp

Download

memory/4644-317-0x00007FF6214F0000-0x00007FF621905000-memory.dmp

Download

memory/4644-220-0x0000025031FB0000-0x0000025032016000-memory.dmp

Download

memory/4644-219-0x00007FF6214F0000-0x00007FF621905000-memory.dmp

Download

memory/4700-148-0x0000029548BD0000-0x0000029548C36000-memory.dmp

Download

memory/4700-149-0x0000029548BD0000-0x0000029548C36000-memory.dmp

Download

memory/4700-147-0x00007FF79E4C0000-0x00007FF79E627000-memory.dmp

Download

memory/4700-154-0x0000029548BD0000-0x0000029548C36000-memory.dmp

Download

memory/4700-156-0x00007FF79E4C0000-0x00007FF79E627000-memory.dmp

Download

memory/4864-249-0x00000258A7AD0000-0x00000258A7B36000-memory.dmp

Download

memory/4864-318-0x00007FF702700000-0x00007FF702893000-memory.dmp

Download

memory/4864-250-0x00000258A7AD0000-0x00000258A7B36000-memory.dmp

Download

memory/4864-248-0x00007FF702700000-0x00007FF702893000-memory.dmp

Download

memory/4976-355-0x00007FF61FE00000-0x00007FF61FF2D000-memory.dmp

Download

memory/4976-324-0x00000176679C0000-0x0000017667A26000-memory.dmp

Download

memory/4976-323-0x00000176679C0000-0x0000017667A26000-memory.dmp

Download

memory/4976-322-0x00007FF61FE00000-0x00007FF61FF2D000-memory.dmp

Download

memory/4976-356-0x0000017668370000-0x0000017668460000-memory.dmp

Download

memory/4976-366-0x0000017668370000-0x0000017668460000-memory.dmp

Download

memory/5060-138-0x0000023B3B0E0000-0x0000023B3B221000-memory.dmp

Download

memory/5060-139-0x0000023B3B300000-0x0000023B3B366000-memory.dmp

Download

memory/5060-140-0x0000023B3B300000-0x0000023B3B366000-memory.dmp

Download

memory/5896-333-0x00007FF783990000-0x00007FF783C19000-memory.dmp

Download

memory/5896-270-0x00007FF783990000-0x00007FF783C19000-memory.dmp

Download

memory/5896-269-0x000001B7BC420000-0x000001B7BC486000-memory.dmp

Download

memory/5896-271-0x000001B7BC420000-0x000001B7BC486000-memory.dmp

Download