Overview

overview

8

Static

static

3

2026-08-03...op.exe

windows10-2004-x64

8

2026-08-03...op.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 10:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_9d59f4e48c40db156e9639b4e1d248f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
  • Size 1.7MB
  • Sample260804-mme3hshf49
  • SHA256 6b01eb963cbef519a3d02f12ef2dde24427509b9de81c7cbdc424c6be7132fd2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 30 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_9d59f4e48c40db156e9639b4e1d248f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_9d59f4e48c40db156e9639b4e1d248f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
      2⤵
        PID:208
      • C:\ProgramData\Adobe\ARM\S\15014\AdobeARMHelper.exe
        "C:\ProgramData\Adobe\ARM\S\15014\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\15014" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\15014" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3104
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:5124
    • C:\Windows\System32\GameInputSvc.exe
      C:\Windows\System32\GameInputSvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2276
      • C:\Windows\System32\GameInputSvc.exe
        "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
        2⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:2932
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4708
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4480
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:1464
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4716
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2760
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1720
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:8
    • C:\Windows\System32\ReFsDedupSvc.exe
      C:\Windows\System32\ReFsDedupSvc.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:208
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2484
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:3500
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:5112
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1900
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:360
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2232
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Executes dropped EXE
      PID:2656
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1368
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1244
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Executes dropped EXE
      PID:2992
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:5660
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:3036
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 952 2936 2956 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
          • Modifies data under HKEY_USERS
          PID:2744
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2972 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
          • Modifies data under HKEY_USERS
          PID:3008
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4956
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 952 2936 2956 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:2592
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2972 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
              PID:5984

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 cff57dae575dae0edb9e98556ea31bec69a5f57620769b1bb9ab5cddf26710b3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 845KB
                • SHA256 df6ff4a9e1a3a3092d9344ad41ac382e57d3129c972ab4b30d25ec9d927accad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 1.1MB
                • SHA256 bf1fc84034e24254cc5222f6e5dd52820725552f77687ba781c1266b00cb8eb9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 1.5MB
                • SHA256 6352a28f4c8670f186f0922247d5a6749aeabf46b62cf7bd97204e615c77f458
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 1.2MB
                • SHA256 86626614b4abd6f4fefc7c1211d9868a8660bb07a11064acba507b8002bbfb04
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 599KB
                • SHA256 100a52d9f265a2b32574588e48484a32d505a3e3805eda111eb65973febf614d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 859KB
                • SHA256 30002a211b834934b2a6c18dc2e2c80f1c55b3826f0cb7d6e0ca0616beda4e43
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 4.7MB
                • SHA256 b11d79807d23d2195a4bdeeed04f4ed342bd4b301861446fc7bde210d0c9b0a9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 928KB
                • SHA256 47639e6bbe064e04fb464c6acafcec59c978b632f684f2d6e99ad511ea7fe407
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 24.0MB
                • SHA256 bbfc5c7c249004fee1fb9317df6049481fe18fa03f0e28521a747c87e72ad666
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 2.7MB
                • SHA256 0a9f3349b648c48b6d38184115727dc459f35478783849bb4590e09d62483ae6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICLUA.EXE
                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                • Size 1.1MB
                • SHA256 0c6ac5cde0d35162168d75281b82980a991beadad77a389ce12c26dc2ff4a087
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 826KB
                • SHA256 64eb5a1f99a76136822a932de5b8eb5f63f779c944e557a892df143ebfec6089
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 675KB
                • SHA256 9a306832f565a1f944757640c84d386522d56971098bbbc32d12ffc45d707212
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 6.6MB
                • SHA256 d4607bdd9adab15b3ad5543a2ab310a4ad944ea12e3dd6df3a6b90a2bdd678d6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 6.6MB
                • SHA256 6a8f78f05aa846469fdafa9e5ee57db0b4a486639d9ba4fa729a5aeac82a1bf7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 2.3MB
                • SHA256 b5a46a3a26a2367c55a8476cea46db299775d528b4460ce95e74c0faa854e3e9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 4.0MB
                • SHA256 69cc349e51ec2c535511b4f5ab6e7490c2218df8e83bdd8d937b04dbab71ba7e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 f0b2f85f1d67bafd02fd1a7c38409f0e6a4b28b6c1a7c70587bc2bd007c9d75b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 2.2MB
                • SHA256 25b929c1a885185c841ae12a67e3fefadf26c27152b628a743ac0834097f0f81
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MsSense.exe
                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                • Size 1.0MB
                • SHA256 c96370fe44b572491f8354b631203d417d6d7ac8353d58b0630d5626f82d2536
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                NisSrv.exe
                • Path C:\Program Files\Windows Defender\NisSrv.exe
                • Size 3.6MB
                • SHA256 af90df74f6704ab9ec72aac177738748a88c71d9caa825f4d490a989b63815fb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 1.5MB
                • SHA256 f45d6729298f9275fbcfa0c2697b06569e66ead25bc0cee72b8c8f687868a371
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 718KB
                • SHA256 fd1d37c255e2740d02cb33ea7ca3f0c6bed2ccf6d2e286c2d040dda00c0042d2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ArmReport.ini
                • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
                • Size 102B
                • SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ArmReport.ini
                • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
                • Size 824B
                • SHA256 c62557ca2d044a3b9ebd39042dcf529c783de02b64e466462aa6cb35d24135a9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ArmReport.ini
                • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
                • Size 1KB
                • SHA256 076339ad65455f7dd94895c489b8718f4ff3bca622b6d233d5e1c42aa6ef6b28
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                AdobeARMHelper.exe
                • Path C:\ProgramData\Adobe\ARM\S\15014\AdobeARMHelper.exe
                • Size 413KB
                • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                • Size 976KB
                • SHA256 070e9573052f50245d6426b8c8aba77fde58899fb22f8851bb6630eac6cc7eb7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db-wal
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                • Size 1.2MB
                • SHA256 779b30b99e9caf06842146fd0f8c85d9703b39173223730bd4fd334c9ad074a8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                • Size 471B
                • SHA256 be28306753fbcd10dfdccc0d803daf45cb9d8820d5d9f5ce83f7716d37584923
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
                • Size 727B
                • SHA256 584564c6ebb0d10fc33f61e622dfbb23f8393c3ff1e48ab9cabc6efe68b78650
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
                • Size 727B
                • SHA256 491d34f8e6ef0eb083e957e263eb07f7a504eee12798914fbf265354dbae7498
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                • Size 727B
                • SHA256 8d048730b983105d77a346709c2f03ca8f061c0d7c12cf101a8335751211343b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                • Size 400B
                • SHA256 ae08db688dc2a4558a590508e222f5fb05b3583a9ac066d2be13974cef8e9a4c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
                • Size 404B
                • SHA256 3d1998d2a145483ca79dddfb28e541ca29c293fcde31d79699d8512c835c931f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
                • Size 404B
                • SHA256 84e9c6ffcd34aecc2022ce51e4cdcd038ebf9b498181873fbd3c5d37d6a5de3b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                • Size 412B
                • SHA256 6f257eee97e006579a6cd6e087e8778457b5d10eee55942b17e73a48485bd83b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                AdobeARM.log
                • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
                • Size 1KB
                • SHA256 967811b52c7d603723107a01c11f94f3f559dd9d90b0ea5067bba30e18446a4e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ArmUI.ini
                • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
                • Size 251KB
                • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Tmp476C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Tmp476C.tmp
                • Size 5KB
                • SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Tmp4848.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Tmp4848.tmp
                • Size 3KB
                • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Tmp4F7D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Tmp4F7D.tmp
                • Size 5KB
                • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Tmp8007.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Tmp8007.tmp
                • Size 5KB
                • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Tmp8E.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Tmp8E.tmp
                • Size 5KB
                • SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 606KB
                • SHA256 b2d5d3dfe6a991b635b456318c273e9db6767a6f06ab2371646addaa33f884dc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.4MB
                • SHA256 b67067e8510ec715c3521fb70cd8b05e05c06839b188c4edafbe26c4c1f5cf25
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GameInputSvc.exe
                • Path C:\Windows\System32\GameInputSvc.exe
                • Size 660KB
                • SHA256 350023b2f831a3f230a7f73b13f197c6c980a8d1e2a98c695bb6ccb35c59eba3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Locator.exe
                • Path C:\Windows\System32\Locator.exe
                • Size 624KB
                • SHA256 735b94c39c85074289086f6a75413296ac0f86b2d3aa4c1eea0b5b1f14191ce3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.1MB
                • SHA256 16dd7bac826e3f8147b0c69b3534336f053117805f06903df31280312169fd86
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReFsDedupSvc.exe
                • Path C:\Windows\System32\ReFsDedupSvc.exe
                • Size 2.7MB
                • SHA256 8e0ff7de76bfb30d8157a602fe11cc6752a7c61dba844d8e6398f5ae61ab3cef
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.5MB
                • SHA256 21c60275eac6a2d005882bf6d1490fe73ecc1c9e19ea88084f23b7785c2fd1ae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.7MB
                • SHA256 0a2073a004a2146da8bbab30ed4d0463ebf052af06e3e92264beab9ca5233cc2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TieringEngineService.exe
                • Path C:\Windows\System32\TieringEngineService.exe
                • Size 932KB
                • SHA256 5cc126e292926eae96dc5248f88a13a6ea024d9cdb3adfd365f4397daee1e9ad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSSVC.exe
                • Path C:\Windows\System32\VSSVC.exe
                • Size 2.0MB
                • SHA256 ef86bddddc009493c87051e20f1fbd809178dee1504ea6b0c2048af1cb0fc2b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                alg.exe
                • Path C:\Windows\System32\alg.exe
                • Size 776KB
                • SHA256 68ede40cdb5797139d269dc2b65083c6b8a3443620dcd5600aa1790464763412
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msdtc.exe
                • Path C:\Windows\System32\msdtc.exe
                • Size 760KB
                • SHA256 b4a96713bd7164a22784e3fe66939694eefa7ba6bc7dc4f172ca7b08af24fa34
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                snmptrap.exe
                • Path C:\Windows\System32\snmptrap.exe
                • Size 632KB
                • SHA256 e83d21a673cb1bb2edc717c7dd23eb2dfc397085cf033307d78a110ab1fc9eaa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vds.exe
                • Path C:\Windows\System32\vds.exe
                • Size 1.2MB
                • SHA256 3a0311b4ef5cdcabbada532692bb1bcacbe11056832b4212108ac058ec7f605b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WmiApSrv.exe
                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                • Size 792KB
                • SHA256 04ada786caed9a4c53a67c23e83e2b2faa7234843f2dbb43ec7216c6878001c8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wbengine.exe
                • Path C:\Windows\System32\wbengine.exe
                • Size 2.1MB
                • SHA256 683b14d895d8fcaa68bef3be1afab3c63dc40e33982353370a836531cff4db1c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 a45cba29ce111246e811fbe347e0501266596e7758949614259856026b462859
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 828KB
                • SHA256 338d03ca41c5ebaf6333b944647dc54a7f84efde79d68076ce2d3e02cda800a1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                • Size 988KB
                • SHA256 0a3f6eb5eb5f2fa71846da668ec160d8b3e8ef32b7fc0cef169d61e62d56fed1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msiexec.exe
                • Path C:\Windows\system32\msiexec.exe
                • Size 768KB
                • SHA256 2ad7e94688b3ab555a6349dd6777cf85cd9bbed140ee546d3456d598eada92ba
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/8-194-0x0000000000890000-0x00000000008F9000-memory.dmp
                Download

                memory/8-188-0x0000000000400000-0x00000000004AD000-memory.dmp
                Download

                memory/8-189-0x0000000000890000-0x00000000008F9000-memory.dmp
                Download

                memory/8-274-0x0000000000400000-0x00000000004AD000-memory.dmp
                Download

                memory/208-202-0x0000027621E10000-0x0000027621E76000-memory.dmp
                Download

                memory/208-201-0x0000027621E10000-0x0000027621E76000-memory.dmp
                Download

                memory/208-362-0x00007FF7254E0000-0x00007FF725C23000-memory.dmp
                Download

                memory/208-361-0x0000027621E10000-0x0000027621E76000-memory.dmp
                Download

                memory/208-203-0x00007FF7254E0000-0x00007FF725C23000-memory.dmp
                Download

                memory/208-283-0x00007FF7254E0000-0x00007FF725C23000-memory.dmp
                Download

                memory/360-247-0x0000017331140000-0x00000173311A6000-memory.dmp
                Download

                memory/360-246-0x0000017331140000-0x00000173311A6000-memory.dmp
                Download

                memory/360-245-0x00007FF654740000-0x00007FF6548D4000-memory.dmp
                Download

                memory/360-320-0x00007FF654740000-0x00007FF6548D4000-memory.dmp
                Download

                memory/1188-6-0x0000000001BD0000-0x0000000001C39000-memory.dmp
                Download

                memory/1188-7-0x0000000001BD0000-0x0000000001C39000-memory.dmp
                Download

                memory/1188-3-0x0000000003430000-0x0000000003574000-memory.dmp
                Download

                memory/1188-0-0x0000000001BD0000-0x0000000001C39000-memory.dmp
                Download

                memory/1244-284-0x0000016FFA160000-0x0000016FFA1C6000-memory.dmp
                Download

                memory/1244-286-0x0000016FFA160000-0x0000016FFA1C6000-memory.dmp
                Download

                memory/1244-330-0x00007FF669AC0000-0x00007FF669FC6000-memory.dmp
                Download

                memory/1244-285-0x00007FF669AC0000-0x00007FF669FC6000-memory.dmp
                Download

                memory/1368-276-0x00000272960A0000-0x0000027296106000-memory.dmp
                Download

                memory/1368-329-0x00007FF637E50000-0x00007FF638320000-memory.dmp
                Download

                memory/1368-275-0x00000272960A0000-0x0000027296106000-memory.dmp
                Download

                memory/1368-280-0x00007FF637E50000-0x00007FF638320000-memory.dmp
                Download

                memory/1464-147-0x000002222DC20000-0x000002222DC86000-memory.dmp
                Download

                memory/1464-155-0x00007FF6CA220000-0x00007FF6CA387000-memory.dmp
                Download

                memory/1464-152-0x000002222DC20000-0x000002222DC86000-memory.dmp
                Download

                memory/1464-145-0x00007FF6CA220000-0x00007FF6CA387000-memory.dmp
                Download

                memory/1464-146-0x000002222DC20000-0x000002222DC86000-memory.dmp
                Download

                memory/1720-181-0x000001C40A450000-0x000001C40A4B6000-memory.dmp
                Download

                memory/1720-178-0x00007FF7BD1B0000-0x00007FF7BD2F9000-memory.dmp
                Download

                memory/1720-180-0x000001C40A450000-0x000001C40A4B6000-memory.dmp
                Download

                memory/1720-265-0x00007FF7BD1B0000-0x00007FF7BD2F9000-memory.dmp
                Download

                memory/1880-334-0x00007FF6C0EE0000-0x00007FF6C121E000-memory.dmp
                Download

                memory/1880-305-0x00007FF6C0EE0000-0x00007FF6C121E000-memory.dmp
                Download

                memory/1880-306-0x0000020EC4F80000-0x0000020EC4FE6000-memory.dmp
                Download

                memory/1880-307-0x0000020EC4F80000-0x0000020EC4FE6000-memory.dmp
                Download

                memory/1900-237-0x00007FF65D6C0000-0x00007FF65D962000-memory.dmp
                Download

                memory/1900-238-0x00000121A02C0000-0x00000121A0326000-memory.dmp
                Download

                memory/1900-239-0x00000121A02C0000-0x00000121A0326000-memory.dmp
                Download

                memory/1900-318-0x00007FF65D6C0000-0x00007FF65D962000-memory.dmp
                Download

                memory/2232-259-0x00007FF6D31C0000-0x00007FF6D34E0000-memory.dmp
                Download

                memory/2232-254-0x00000214630D0000-0x0000021463136000-memory.dmp
                Download

                memory/2232-262-0x00007FF6D31C0000-0x00007FF6D34E0000-memory.dmp
                Download

                memory/2232-260-0x00000214630D0000-0x0000021463136000-memory.dmp
                Download

                memory/2232-255-0x00000214630D0000-0x0000021463136000-memory.dmp
                Download

                memory/2276-26-0x00007FF7A4E30000-0x00007FF7A4EF8000-memory.dmp
                Download

                memory/2276-27-0x0000017206310000-0x0000017206376000-memory.dmp
                Download

                memory/2276-28-0x0000017206310000-0x0000017206376000-memory.dmp
                Download

                memory/2276-32-0x0000017206310000-0x0000017206376000-memory.dmp
                Download

                memory/2276-187-0x00007FF7A4E30000-0x00007FF7A4EF8000-memory.dmp
                Download

                memory/2484-209-0x0000015F97360000-0x0000015F973C6000-memory.dmp
                Download

                memory/2484-293-0x00007FF6C1DA0000-0x00007FF6C1E4D000-memory.dmp
                Download

                memory/2484-210-0x0000015F97360000-0x0000015F973C6000-memory.dmp
                Download

                memory/2484-211-0x00007FF6C1DA0000-0x00007FF6C1E4D000-memory.dmp
                Download

                memory/2656-266-0x00007FF656700000-0x00007FF65698A000-memory.dmp
                Download

                memory/2656-267-0x0000026FFDB40000-0x0000026FFDBA6000-memory.dmp
                Download

                memory/2656-268-0x0000026FFDB40000-0x0000026FFDBA6000-memory.dmp
                Download

                memory/2656-328-0x00007FF656700000-0x00007FF65698A000-memory.dmp
                Download

                memory/2760-171-0x000001A063620000-0x000001A063686000-memory.dmp
                Download

                memory/2760-172-0x000001A063620000-0x000001A063686000-memory.dmp
                Download

                memory/2760-170-0x000001A063420000-0x000001A06354C000-memory.dmp
                Download

                memory/2932-36-0x0000016FAE4A0000-0x0000016FAE506000-memory.dmp
                Download

                memory/2932-38-0x0000016FAE4A0000-0x0000016FAE506000-memory.dmp
                Download

                memory/2932-46-0x0000016FAE4A0000-0x0000016FAE506000-memory.dmp
                Download

                memory/2932-35-0x00007FF7A4E30000-0x00007FF7A4EF8000-memory.dmp
                Download

                memory/2932-200-0x00007FF7A4E30000-0x00007FF7A4EF8000-memory.dmp
                Download

                memory/2992-296-0x000002353CA60000-0x000002353CAC6000-memory.dmp
                Download

                memory/2992-333-0x00007FF7D5810000-0x00007FF7D593E000-memory.dmp
                Download

                memory/2992-295-0x00007FF7D5810000-0x00007FF7D593E000-memory.dmp
                Download

                memory/2992-294-0x000002353CA60000-0x000002353CAC6000-memory.dmp
                Download

                memory/3008-367-0x000001A4B7040000-0x000001A4B72CB000-memory.dmp
                Download

                memory/3500-218-0x000001FBE63B0000-0x000001FBE6416000-memory.dmp
                Download

                memory/3500-321-0x000001FBE63B0000-0x000001FBE6416000-memory.dmp
                Download

                memory/3500-219-0x00007FF62BFD0000-0x00007FF62C3E6000-memory.dmp
                Download

                memory/3500-301-0x00007FF62BFD0000-0x00007FF62C3E6000-memory.dmp
                Download

                memory/3500-323-0x00007FF62BFD0000-0x00007FF62C3E6000-memory.dmp
                Download

                memory/3500-220-0x000001FBE63B0000-0x000001FBE6416000-memory.dmp
                Download

                memory/4480-139-0x000002AE0CB20000-0x000002AE0CB86000-memory.dmp
                Download

                memory/4480-138-0x000002AE0CB20000-0x000002AE0CB86000-memory.dmp
                Download

                memory/4480-137-0x000002AE0C8D0000-0x000002AE0C9FC000-memory.dmp
                Download

                memory/4708-130-0x00000255B3E70000-0x00000255B3ED6000-memory.dmp
                Download

                memory/4708-131-0x00000255B3E70000-0x00000255B3ED6000-memory.dmp
                Download

                memory/4708-129-0x00000255B3EF0000-0x00000255B401C000-memory.dmp
                Download

                memory/4716-160-0x0000023616EA0000-0x0000023616F06000-memory.dmp
                Download

                memory/4716-253-0x00007FF688D80000-0x00007FF688E99000-memory.dmp
                Download

                memory/4716-158-0x00007FF688D80000-0x00007FF688E99000-memory.dmp
                Download

                memory/4716-159-0x0000023616EA0000-0x0000023616F06000-memory.dmp
                Download

                memory/5112-228-0x00007FF619FC0000-0x00007FF61A073000-memory.dmp
                Download

                memory/5112-229-0x00000224A3F90000-0x00000224A3FF6000-memory.dmp
                Download

                memory/5112-230-0x00000224A3F90000-0x00000224A3FF6000-memory.dmp
                Download

                memory/5112-304-0x00007FF619FC0000-0x00007FF61A073000-memory.dmp
                Download

                memory/5124-157-0x00007FF66C080000-0x00007FF66C1A2000-memory.dmp
                Download

                memory/5124-19-0x00000291C6DC0000-0x00000291C6E26000-memory.dmp
                Download

                memory/5124-17-0x00000291C6DC0000-0x00000291C6E26000-memory.dmp
                Download

                memory/5124-16-0x00000291C6DC0000-0x00000291C6E26000-memory.dmp
                Download

                memory/5124-15-0x00007FF66C080000-0x00007FF66C1A2000-memory.dmp
                Download