Overview

overview

8

Static

static

3

2026-08-06...op.exe

windows10-2004-x64

7

2026-08-06...op.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 01:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_be059ca1b9b9096407034a5e14c2069e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
  • Size 1.8MB
  • Sample260806-bl6y3afa87
  • SHA256 1e715f6e20a858dd0336a9a38a6571edc2e90c6e9f8c0a67c6248e9eb7df54f0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 30 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_be059ca1b9b9096407034a5e14c2069e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_be059ca1b9b9096407034a5e14c2069e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4336
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
      2⤵
        PID:4776
      • C:\ProgramData\Adobe\ARM\S\10582\AdobeARMHelper.exe
        "C:\ProgramData\Adobe\ARM\S\10582\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\10582" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1348
        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\10582" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4120
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3856
    • C:\Windows\System32\GameInputSvc.exe
      C:\Windows\System32\GameInputSvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3176
      • C:\Windows\System32\GameInputSvc.exe
        "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
        2⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:5956
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2060
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4372
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:708
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:6088
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2040
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3276
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4968
    • C:\Windows\System32\ReFsDedupSvc.exe
      C:\Windows\System32\ReFsDedupSvc.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1912
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1056
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:4108
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2996
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:960
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:5352
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2064
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Executes dropped EXE
      PID:2068
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3248
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5840
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Executes dropped EXE
      PID:3588
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6024
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:3240
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:4580
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2876 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:4132
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 952 2924 2920 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
            • Modifies data under HKEY_USERS
            PID:2544
          • C:\Windows\System32\SearchProtocolHost.exe
            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
              PID:612

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 f9fe8283e6bba68756af2e76bca53220f690640b61b75dc040830e78047e53f2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 849KB
                • SHA256 17663e3198859963e8cfe6198ae623aaddfb06bb46f6ea735d915e51c1815301
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 1.1MB
                • SHA256 c279659427791af066ec1b851803451a940f8e86bc67efb89afc1ce2b12b7097
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 1.5MB
                • SHA256 ef90b0142507f6fd041cfcbdd31e23502672e0a5714e0c6162d2cb950c39b4bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 1.3MB
                • SHA256 255ae38ccab30b73e709fba3f4da1dea5da263051b0760d1ea59a1455be65157
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 603KB
                • SHA256 4eeff93f1092414b0e10779786b8a8687378710a13a94d20caef2a54ed6ad055
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 863KB
                • SHA256 6ed22efb3ca68629caa3257a5ac8a0fdf01d1b37d2d2b4c4d7c7b556a56fd9e2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 4.7MB
                • SHA256 2f85de48b5180c9fde0f4b62ee8dd3958e1e15400432b42a2e7b7c1f89f6eae7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 932KB
                • SHA256 6dbc639a57590ba22b6b257276e1a3406a5fd1542f048666d8ea493d25bb9c05
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 24.0MB
                • SHA256 4a9e329775e2ee447ea8160e45ecb4209111a51165335a36cdf4ede506b854a0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 2.7MB
                • SHA256 fea93ea8d56a739ed0661e22b6f56f33386dfe2a8f8bca9fe5b1a6686aa4c54c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICLUA.EXE
                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                • Size 1.1MB
                • SHA256 86aad6c8621bdcdfd4ac4622dcc8ed1fbe405c515a314251c4133cf021a1bc6f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 829KB
                • SHA256 0cd7915a7787a9eebbc908ef1f72ab1e241e1b76bf31c64b75b972a924ccbd5e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 679KB
                • SHA256 8f6b520ff9c3f693a38f812ffee81d0250eebcbb1264502f216b0b16d33a4ee9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 6.6MB
                • SHA256 e4fcf4a23b2e2951e0a983f75c81311beda926e0510ce709599caa08571e2153
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 6.6MB
                • SHA256 503da403bae0f07b6b58ad5083f731665eefef61d517ce54fd5ed94f5b167263
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 2.3MB
                • SHA256 1bb5bf20b2de369c89b1334cae64d3fb2f3a44f992f4f1057b9bfb48741c4eb7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 4.0MB
                • SHA256 8505372760b18904ecf5ba90ef271d0ae2c1314f3c5367db24417c46449dde5c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 d9f0659aeac2358f82cb4a464417c01c4c555421b1ee05def3c35dbb68d43b6e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 2.2MB
                • SHA256 96a45b58ccacc9df114bb6e732bfc14b7f7f6d51cab2ef97f9b7149b5700576c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MsSense.exe
                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                • Size 1.1MB
                • SHA256 bca7e9433780fda161aa5f150733b6d8c6a753afeaf5b3a9965169661bfba2ae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                NisSrv.exe
                • Path C:\Program Files\Windows Defender\NisSrv.exe
                • Size 3.6MB
                • SHA256 9bc133f32fcefffa791e2ac65174f6fcac6a6b8af2512fdca0191566651196de
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 1.5MB
                • SHA256 9072009407ead7aa9a158d068e224eeedac6ebc7873736f5b7794d77bd976f62
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 722KB
                • SHA256 4db71a93152ba327b1dbe17a6c51bb005bd89d0f5ff5f4a4d5a46ccb340c50d6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ArmReport.ini
                • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
                • Size 102B
                • SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ArmReport.ini
                • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
                • Size 1KB
                • SHA256 89956d1afe2ab8e83d209ebf509e977fc9747151e06109e8375d490a198370c2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                AdobeARMHelper.exe
                • Path C:\ProgramData\Adobe\ARM\S\10582\AdobeARMHelper.exe
                • Size 413KB
                • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                • Size 471B
                • SHA256 84bd2f8e8edf2c1e8faf64423787c6f281fd81bd2c2761a68bd507996b14de46
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
                • Size 727B
                • SHA256 0ea9824be39bfa485430f0892e8278189fe29a415d60867f0d8c28f37e689f32
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
                • Size 727B
                • SHA256 261863a339ed05f6b93c4362ac29528d5ce0cfb7b5e255af44bb527d10339235
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                • Size 727B
                • SHA256 95c852c2808ea9464b8ef2648912a121d6a2bfdd95126cc3f6c11d41c0b461b0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                • Size 400B
                • SHA256 458176d9032aa98fa1d4c8320dae08461e5243642bd7d0e4fe1ebcb873670759
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
                • Size 404B
                • SHA256 b90a4341ad3794b0b340454061b027a07c004a248d12f25c4a801ca420e10d1c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
                • Size 404B
                • SHA256 0eff67d4fd8a01fa367369e84549c7afb0f1e44a39b968650ccf62d01663608d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                • Size 412B
                • SHA256 fe74b07db1d5dc63b7acf19e2ac0d0f40b20a5845d5dc269e9ba5610b364114c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                AdobeARM.log
                • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
                • Size 1KB
                • SHA256 5d1e1f3d4f41fb2b84f928901ae39a227ef9b4f50203b04a87b33f2eadc0cfac
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ArmUI.ini
                • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
                • Size 251KB
                • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Tmp474D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Tmp474D.tmp
                • Size 5KB
                • SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Tmp4858.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Tmp4858.tmp
                • Size 3KB
                • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Tmp4F9C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Tmp4F9C.tmp
                • Size 5KB
                • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Tmp8045.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Tmp8045.tmp
                • Size 5KB
                • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TmpEE7D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\TmpEE7D.tmp
                • Size 5KB
                • SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 610KB
                • SHA256 74e8c7702ec0ea792160b536bbbbcdd1c91fa5035e09f5ef47d79710df2cf66e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.4MB
                • SHA256 d60a9075cf42adea5fd240ae2b2cb2900234c396a70ed59ac5b4ba0909c07faf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GameInputSvc.exe
                • Path C:\Windows\System32\GameInputSvc.exe
                • Size 664KB
                • SHA256 6f5c2e2c3c38d8f1b8e219b7ec6dfae1237224eef789edb89cbbc738c4f35a52
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Locator.exe
                • Path C:\Windows\System32\Locator.exe
                • Size 628KB
                • SHA256 5bcf1fa9832e015f09b32973c7c646d3b736b46b67659cf6ce1867cca5c630b0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.1MB
                • SHA256 f0571e14c9914e3f24211c44a8a971d364de1e181c1719c17b4fca897e35cb14
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 832KB
                • SHA256 b3c42014dd5c472453946049b292ea8730d0688ccf2d136e574dd91413877de4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReFsDedupSvc.exe
                • Path C:\Windows\System32\ReFsDedupSvc.exe
                • Size 2.7MB
                • SHA256 33b472e2da62dea50b5f3922811b3c556b4d89a176a8a27b0cee3f6f45133dcc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.5MB
                • SHA256 32f1e7c1ac20b0a7bcbdeb57b8c456c208dac462a4a49d176a586db7e73a7f30
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.7MB
                • SHA256 282aeda4508e9a785a69cf14ff3af4382795aae5e001e07ee16b8069a268480b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TieringEngineService.exe
                • Path C:\Windows\System32\TieringEngineService.exe
                • Size 936KB
                • SHA256 0c9daa4d7f838ec6c595d67184a2861f0444ba7d7c2844f7f7e03e772178b96a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSSVC.exe
                • Path C:\Windows\System32\VSSVC.exe
                • Size 2.0MB
                • SHA256 a3755005c7415e633972696d036c6cbbf6a8c1ac7cfd271b48d5c1e40c9f0f3a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                alg.exe
                • Path C:\Windows\System32\alg.exe
                • Size 780KB
                • SHA256 2a0bf4e401fe1c54f311957a9b92275ab676134db307b5bf3a1adce0fd34d0b1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msdtc.exe
                • Path C:\Windows\System32\msdtc.exe
                • Size 764KB
                • SHA256 d5eec3572c2d8fc17b114abe9c453eaf7634bd821bd90148389ffd65f0389510
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                snmptrap.exe
                • Path C:\Windows\System32\snmptrap.exe
                • Size 636KB
                • SHA256 672cf26e35391f0b32779a0f2339213f7c09e77c9171ec132a4dd1476f0069ff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vds.exe
                • Path C:\Windows\System32\vds.exe
                • Size 1.2MB
                • SHA256 b459a16903a0f599e1903273220fa7af4a294acb5508b56ea83c0db28bf73e2c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WmiApSrv.exe
                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                • Size 796KB
                • SHA256 4090cb296df222c38fc4199eedba7cab1f9e998afef19b85d363b2359bcc3b90
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wbengine.exe
                • Path C:\Windows\System32\wbengine.exe
                • Size 2.1MB
                • SHA256 58a4ccda5f5d7ce55ad2d994ca69f888b8f9aa5ed148af9b219531de8805afa8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 a5a1e3d13699bda65bcfb4bf1510f1da35907dc45937c49fa5387578b592833c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                • Size 992KB
                • SHA256 556578378d4ea11c644f45d7e381683ba0e6c462f96b6586d007e09f2375c2bf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msiexec.exe
                • Path C:\Windows\system32\msiexec.exe
                • Size 772KB
                • SHA256 d3e292638d511b83fdc2db4f1a239916e14662c894bec4d33374f6614937e432
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/708-156-0x00007FF63DBC0000-0x00007FF63DD28000-memory.dmp
                Download

                memory/708-154-0x00000214F9DF0000-0x00000214F9E56000-memory.dmp
                Download

                memory/708-148-0x00000214F9DF0000-0x00000214F9E56000-memory.dmp
                Download

                memory/708-149-0x00000214F9DF0000-0x00000214F9E56000-memory.dmp
                Download

                memory/708-147-0x00007FF63DBC0000-0x00007FF63DD28000-memory.dmp
                Download

                memory/960-239-0x00007FF7544F0000-0x00007FF754793000-memory.dmp
                Download

                memory/960-305-0x00007FF7544F0000-0x00007FF754793000-memory.dmp
                Download

                memory/960-242-0x000002BACF510000-0x000002BACF576000-memory.dmp
                Download

                memory/960-241-0x000002BACF510000-0x000002BACF576000-memory.dmp
                Download

                memory/1056-267-0x00007FF65B8A0000-0x00007FF65B94E000-memory.dmp
                Download

                memory/1056-210-0x00000167C3FD0000-0x00000167C4036000-memory.dmp
                Download

                memory/1056-209-0x00007FF65B8A0000-0x00007FF65B94E000-memory.dmp
                Download

                memory/1056-211-0x00000167C3FD0000-0x00000167C4036000-memory.dmp
                Download

                memory/1912-203-0x00007FF6E8310000-0x00007FF6E8A54000-memory.dmp
                Download

                memory/1912-362-0x00007FF6E8310000-0x00007FF6E8A54000-memory.dmp
                Download

                memory/1912-360-0x00000269440E0000-0x0000026944146000-memory.dmp
                Download

                memory/1912-201-0x00000269440E0000-0x0000026944146000-memory.dmp
                Download

                memory/1912-202-0x00000269440E0000-0x0000026944146000-memory.dmp
                Download

                memory/1912-256-0x00007FF6E8310000-0x00007FF6E8A54000-memory.dmp
                Download

                memory/2040-174-0x000002697DBF0000-0x000002697DC56000-memory.dmp
                Download

                memory/2040-172-0x000002697D9A0000-0x000002697DAC7000-memory.dmp
                Download

                memory/2040-173-0x000002697DBF0000-0x000002697DC56000-memory.dmp
                Download

                memory/2060-131-0x000001B555890000-0x000001B5558F6000-memory.dmp
                Download

                memory/2060-130-0x000001B555890000-0x000001B5558F6000-memory.dmp
                Download

                memory/2060-129-0x000001B555640000-0x000001B555767000-memory.dmp
                Download

                memory/2064-257-0x000001B463EB0000-0x000001B463F16000-memory.dmp
                Download

                memory/2064-263-0x000001B463EB0000-0x000001B463F16000-memory.dmp
                Download

                memory/2064-259-0x000001B463EB0000-0x000001B463F16000-memory.dmp
                Download

                memory/2064-265-0x00007FF7E8AF0000-0x00007FF7E8E11000-memory.dmp
                Download

                memory/2064-258-0x00007FF7E8AF0000-0x00007FF7E8E11000-memory.dmp
                Download

                memory/2068-274-0x00007FF6B36B0000-0x00007FF6B393B000-memory.dmp
                Download

                memory/2068-269-0x000001C9850A0000-0x000001C985106000-memory.dmp
                Download

                memory/2068-328-0x00007FF6B36B0000-0x00007FF6B393B000-memory.dmp
                Download

                memory/2068-270-0x000001C9850A0000-0x000001C985106000-memory.dmp
                Download

                memory/2996-232-0x000001C8F1B50000-0x000001C8F1BB6000-memory.dmp
                Download

                memory/2996-231-0x000001C8F1B50000-0x000001C8F1BB6000-memory.dmp
                Download

                memory/2996-230-0x00007FF77B5B0000-0x00007FF77B664000-memory.dmp
                Download

                memory/2996-292-0x00007FF77B5B0000-0x00007FF77B664000-memory.dmp
                Download

                memory/3176-114-0x000002B5E3ED0000-0x000002B5E3F36000-memory.dmp
                Download

                memory/3176-112-0x000002B5E3ED0000-0x000002B5E3F36000-memory.dmp
                Download

                memory/3176-111-0x00007FF64BE10000-0x00007FF64BED9000-memory.dmp
                Download

                memory/3176-146-0x00007FF64BE10000-0x00007FF64BED9000-memory.dmp
                Download

                memory/3176-113-0x000002B5E3ED0000-0x000002B5E3F36000-memory.dmp
                Download

                memory/3248-329-0x00007FF75B660000-0x00007FF75BB31000-memory.dmp
                Download

                memory/3248-279-0x000001826C2C0000-0x000001826C326000-memory.dmp
                Download

                memory/3248-278-0x000001826C2C0000-0x000001826C326000-memory.dmp
                Download

                memory/3248-277-0x00007FF75B660000-0x00007FF75BB31000-memory.dmp
                Download

                memory/3276-180-0x00007FF6B4820000-0x00007FF6B496A000-memory.dmp
                Download

                memory/3276-182-0x000001F836C20000-0x000001F836C86000-memory.dmp
                Download

                memory/3276-183-0x000001F836C20000-0x000001F836C86000-memory.dmp
                Download

                memory/3276-229-0x00007FF6B4820000-0x00007FF6B496A000-memory.dmp
                Download

                memory/3588-297-0x0000020DE4C80000-0x0000020DE4CE6000-memory.dmp
                Download

                memory/3588-296-0x00007FF6ABD50000-0x00007FF6ABE7F000-memory.dmp
                Download

                memory/3588-298-0x0000020DE4C80000-0x0000020DE4CE6000-memory.dmp
                Download

                memory/3588-354-0x00007FF6ABD50000-0x00007FF6ABE7F000-memory.dmp
                Download

                memory/3856-15-0x00007FF70F550000-0x00007FF70F673000-memory.dmp
                Download

                memory/3856-17-0x000002076A9E0000-0x000002076AA46000-memory.dmp
                Download

                memory/3856-135-0x00007FF70F550000-0x00007FF70F673000-memory.dmp
                Download

                memory/3856-18-0x000002076A9E0000-0x000002076AA46000-memory.dmp
                Download

                memory/3856-16-0x000002076A9E0000-0x000002076AA46000-memory.dmp
                Download

                memory/4108-284-0x00007FF75BBD0000-0x00007FF75BFE7000-memory.dmp
                Download

                memory/4108-314-0x00007FF75BBD0000-0x00007FF75BFE7000-memory.dmp
                Download

                memory/4108-312-0x00000292B6800000-0x00000292B6866000-memory.dmp
                Download

                memory/4108-219-0x00007FF75BBD0000-0x00007FF75BFE7000-memory.dmp
                Download

                memory/4108-221-0x00000292B6800000-0x00000292B6866000-memory.dmp
                Download

                memory/4108-220-0x00000292B6800000-0x00000292B6866000-memory.dmp
                Download

                memory/4336-0-0x00000000030A0000-0x0000000003109000-memory.dmp
                Download

                memory/4336-6-0x0000000003150000-0x000000000328F000-memory.dmp
                Download

                memory/4336-7-0x00000000030A0000-0x0000000003109000-memory.dmp
                Download

                memory/4372-140-0x000002A373F90000-0x000002A373FF6000-memory.dmp
                Download

                memory/4372-139-0x000002A373F90000-0x000002A373FF6000-memory.dmp
                Download

                memory/4372-138-0x000002A375000000-0x000002A375127000-memory.dmp
                Download

                memory/4968-190-0x0000000000730000-0x0000000000799000-memory.dmp
                Download

                memory/4968-195-0x0000000000730000-0x0000000000799000-memory.dmp
                Download

                memory/4968-236-0x0000000000400000-0x00000000004AE000-memory.dmp
                Download

                memory/4968-189-0x0000000000400000-0x00000000004AE000-memory.dmp
                Download

                memory/5352-322-0x00007FF757B20000-0x00007FF757CB5000-memory.dmp
                Download

                memory/5352-250-0x0000023A23EE0000-0x0000023A23F46000-memory.dmp
                Download

                memory/5352-248-0x00007FF757B20000-0x00007FF757CB5000-memory.dmp
                Download

                memory/5352-249-0x0000023A23EE0000-0x0000023A23F46000-memory.dmp
                Download

                memory/5840-287-0x00000220AC670000-0x00000220AC6D6000-memory.dmp
                Download

                memory/5840-330-0x00007FF6C6470000-0x00007FF6C6977000-memory.dmp
                Download

                memory/5840-288-0x00000220AC670000-0x00000220AC6D6000-memory.dmp
                Download

                memory/5840-286-0x00007FF6C6470000-0x00007FF6C6977000-memory.dmp
                Download

                memory/5956-120-0x00007FF64BE10000-0x00007FF64BED9000-memory.dmp
                Download

                memory/5956-122-0x000001D744120000-0x000001D744186000-memory.dmp
                Download

                memory/5956-123-0x000001D744120000-0x000001D744186000-memory.dmp
                Download

                memory/5956-121-0x000001D744120000-0x000001D744186000-memory.dmp
                Download

                memory/5956-169-0x00007FF64BE10000-0x00007FF64BED9000-memory.dmp
                Download

                memory/6024-306-0x0000022892AE0000-0x0000022892B46000-memory.dmp
                Download

                memory/6024-355-0x00007FF6BEFD0000-0x00007FF6BF30F000-memory.dmp
                Download

                memory/6024-308-0x0000022892AE0000-0x0000022892B46000-memory.dmp
                Download

                memory/6024-307-0x00007FF6BEFD0000-0x00007FF6BF30F000-memory.dmp
                Download

                memory/6088-159-0x00007FF7F6500000-0x00007FF7F661A000-memory.dmp
                Download

                memory/6088-160-0x0000021BAA580000-0x0000021BAA5E6000-memory.dmp
                Download

                memory/6088-161-0x0000021BAA580000-0x0000021BAA5E6000-memory.dmp
                Download

                memory/6088-218-0x00007FF7F6500000-0x00007FF7F661A000-memory.dmp
                Download