Overview

overview

8

Static

static

3

2026-08-08...op.exe

windows10-2004-x64

8

2026-08-08...op.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 02:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_bfbb8d00d5cf335e7ecaa2741264a801_darkgate_elex_rhadamanthys_stop.exe
  • Size 1.7MB
  • Sample260808-c96tmsgl3x
  • SHA256 ffa19a824c5ac0495f7ba56e4f90670e9d505f3d60b52dbb1887f2d034bfd34b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_bfbb8d00d5cf335e7ecaa2741264a801_darkgate_elex_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_bfbb8d00d5cf335e7ecaa2741264a801_darkgate_elex_rhadamanthys_stop.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3156
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
      2⤵
        PID:5316
      • C:\ProgramData\Adobe\ARM\S\3122\AdobeARMHelper.exe
        "C:\ProgramData\Adobe\ARM\S\3122\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\3122" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5444
        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\3122" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2596
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4960
    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      1⤵
      • Executes dropped EXE
      PID:2132
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
        PID:1332
      • C:\Windows\system32\fxssvc.exe
        C:\Windows\system32\fxssvc.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:3948
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:460
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:2776
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        PID:3616
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:4940
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:2268
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:4216
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4892
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:1132
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1816
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:5116
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3388
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:1224
        • C:\Windows\System32\OpenSSH\ssh-agent.exe
          C:\Windows\System32\OpenSSH\ssh-agent.exe
          1⤵
          • Executes dropped EXE
          PID:4124
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:2292
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3804
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:1480
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4860
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5096
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:1124
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1916
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:404
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 904
            2⤵
            • Modifies data under HKEY_USERS
            PID:1644

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 3d536f72d931a3ffb619a2268a1b50648ccaa1a666c94eb31e04b920867e555f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 845KB
              • SHA256 7cdf439e02040eb46324956fc8da1b3d8db32ddb2372b08f7d94a06d7e60ba68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.1MB
              • SHA256 6ce4e951be9cfccb7a00c3196fd046e33eea761523f60a66fa3cfd81f250f292
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 2aecc534e262331995cc2293b13abe4ff0ef2c77d2c27d89c2baf4ee7f36fc34
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 18707cfd11585b5573fe5392730ccb6eabac7f356add3f457128568d3150b8b3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 599KB
              • SHA256 902311e0e0fddc168abd6236f63a3dea6f9ca618e6726b48c194dd390ce68009
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 859KB
              • SHA256 c682c0d18e1bd84578a9d36a88cfa1233c49dd7cb819606d4772f7413d6b63dc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.7MB
              • SHA256 314d33c65495b8be592601a9b44dad5b6d368a4c4f67a764b22f35841bbb50ca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 928KB
              • SHA256 025a2300109ae656b30b34c4dd7d4f8b49d5d052e320904824ca7de4a899a697
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 200c27eb39f750dbf2e448af4ac491b52ecd445f807c2d4a77f12666ffb9ba36
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 6b52f6930f5c11f6db3dc966362da224399d20b689996b06c562879063ecf8be
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 c62f757405baebb716348727c4b23311a17be9ec717e5cb1494c67d6ed3ec943
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 825KB
              • SHA256 a2157eb821569f585a15e2dba6a99a6f7b27c6c7067295c14b826f101d8ef23c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 675KB
              • SHA256 c88101010d873b0e6a53582c1e4cfb5e2a26086f11eff893300380e728b38ad8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 d0b53c371e9eb2e1374cffd90f101d10921a6beb5a34b97b96358e4338e41043
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 93f6f92d4fc467dadac1aa6fbdc352aba7400aa6d2dbe0a0a6a6ca8ca5aa7217
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 0b580d4879954fe81a80a1f8a58af5502f10d6f1ec43515019ad2e3cc95a9194
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 f98b4fcae5444f7ac6c4e383ec1e0f8fc1f85f8825ba9533d895f58742c58847
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 b87bf18d68249a2f8aee825c312d68e940a49a6dfb395cc7013646c5929ce88e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 718KB
              • SHA256 729e2bfecc384fea896a38b4e7b32c383b77256655778639bd10a27fb0b8b935
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 102B
              • SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 1KB
              • SHA256 9881cce9ae239e68777778dff064e622e03536aba1e56aef2d174dd6acf98fb8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.msi
              • Path C:\ProgramData\Adobe\ARM\S\3122\AdobeARM.msi
              • Size 1.0MB
              • SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARMHelper.exe
              • Path C:\ProgramData\Adobe\ARM\S\3122\AdobeARMHelper.exe
              • Size 413KB
              • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrManifest2.msi
              • Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
              • Size 18KB
              • SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 471B
              • SHA256 81865d0c7df6370bfa0c53908b27b8bd1cdaea30c20f767cefd73b6b5376ddb8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 727B
              • SHA256 fb74d9f0489a4501b6e7c4861cc4e0eb5c90193c1f543a0b10b456021f2a8822
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 727B
              • SHA256 2da08ffe4508c77daca6de8a86c2f4165c7b84d228022544331cfa5e59ce5ebb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 727B
              • SHA256 db1d5f399aac10e28e8c58ab6e8a9f1876422832b762d6231faa4f663e92885e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 400B
              • SHA256 656ca39765063a8016207df7426f05631df0abfe543afd077cad7ddcc26846d4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 404B
              • SHA256 b1299f6f1c0ac772256ee1719ab7152f7cd4040994f3400dff824a8965cbf32d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 404B
              • SHA256 26fcf0161ea3ee54ec87f80b40a1f7048978ec1a101dc959f6e4c4320738602e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 412B
              • SHA256 f4ffa896aa80ff46453b380b3800f57821f3848b5bddc55854830fae77e22416
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 1KB
              • SHA256 1eff4319f0239c79c7292dc0f6e865790de868c6a5e35e5b30424e175dbbdebb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 1KB
              • SHA256 6f3526f14d969529ce630b3690e7ec4b5e73da5f425634d3c640ddd48bad87b1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
              • Size 251KB
              • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp77CB.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp77CB.tmp
              • Size 5KB
              • SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpACF6.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpACF6.tmp
              • Size 5KB
              • SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpADB3.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpADB3.tmp
              • Size 3KB
              • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TmpB44B.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpB44B.tmp
              • Size 5KB
              • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpE497.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpE497.tmp
              • Size 5KB
              • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrServicesUpdater2_x86.exe
              • Path C:\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
              • Size 846KB
              • SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 606KB
              • SHA256 2e96252f8c9de4a0bd1faae0c3583f721b99b787ee66cca785e93163f790ed3b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 3534691c2136157e9b67465fd42202437ce7abb06ca0c023746fcda17034c58f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 677KB
              • SHA256 a8ae8a1e90fa4b4565da30f957d3f0691c2ece8d57693aabb9a78ce5d0a48b67
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 22f2696d646b634b0c20543a24634ff3604cbff9d5b1b6d891a0833e6397cee3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 596KB
              • SHA256 9981983034bf6ff3a93d9f1f77d4bdb651e24b2e86346d3d4a2be0a81cf0dd59
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 959KB
              • SHA256 6af96bdf512db794980991cd4a47f0816b6949af1a0126ce8706ef77612fa170
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 689KB
              • SHA256 5ad79640570359558b7f0217497d07391936f61bfcddcf2a5a8e3f9b8ab797f3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.5MB
              • SHA256 50d41c93ed28cfcb86bdbe7160c6772d9a628fe992a4df45a980710d42e8e7be
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 83786c2d3a1a105f7b71fb6c3db62f8c3d94e7016005b9751e052b776f5e8a5a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 2ae1547daabff8d3cdd19768f71a5f7b0a6055b11f94907712365cc23645a74a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 903KB
              • SHA256 a374fb0dc62f56925d49472135c71f04175609c16d2b4d0d6712b11a555b912b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 0c41971d00d6c96acb7bb26162f639114589ccc5376a45e4dd91bbbd7dc26b78
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 678KB
              • SHA256 a11776eee50f80197a234aa93e7e5c38b15bd37cbcbdea95a23ce656b7aacbe4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 730KB
              • SHA256 09192508571780ebf2e2739a39e22da36968388c106aebe337081193c3399dce
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 601KB
              • SHA256 e8b8add9fcd8770713dc2e821172b4de5c1c873591803af72b92f80214d3af23
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 a002a68fb5cd639b429a0d1a15ad703213463d94267133ac649ce00fbf4cddd5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 790KB
              • SHA256 ff14dfd48c4d01fb4b8dfe7dbb7ba8beb97caa3ef0ce5ed1366a72e5abd6646e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 d875ee897c20516c7e1d7bfff701f5e88a4decfa3d66cda41098b96575c87cdf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 f0ce2cf31e8531e6b991fd7aefbfa930ed014a02943a0b5947ed25aa7ea899ff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 895KB
              • SHA256 bb2b40ac5a4b76c5e12da35ce9fae5c2aeb50ac04c7b0ec5afaf55bcd8e302c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 653KB
              • SHA256 c10bee7552b238601efacec8ccc54211322a49e28a24a6cbe8b19dfb45038c96
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/460-131-0x00000153609F0000-0x0000015360AEB000-memory.dmp
              Download

              memory/460-133-0x0000015360510000-0x0000015360576000-memory.dmp
              Download

              memory/460-132-0x0000015360510000-0x0000015360576000-memory.dmp
              Download

              memory/1124-295-0x0000012214440000-0x00000122144A6000-memory.dmp
              Download

              memory/1124-294-0x0000012214440000-0x00000122144A6000-memory.dmp
              Download

              memory/1124-293-0x00007FF687BE0000-0x00007FF687D1A000-memory.dmp
              Download

              memory/1124-376-0x00007FF687BE0000-0x00007FF687D1A000-memory.dmp
              Download

              memory/1132-202-0x000001CB79E40000-0x000001CB79EA6000-memory.dmp
              Download

              memory/1132-203-0x000001CB79E40000-0x000001CB79EA6000-memory.dmp
              Download

              memory/1132-201-0x00007FF70B850000-0x00007FF70B8F7000-memory.dmp
              Download

              memory/1132-263-0x00007FF70B850000-0x00007FF70B8F7000-memory.dmp
              Download

              memory/1480-327-0x00007FF60BC70000-0x00007FF60BF2D000-memory.dmp
              Download

              memory/1480-266-0x00007FF60BC70000-0x00007FF60BF2D000-memory.dmp
              Download

              memory/1644-570-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-575-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-568-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-569-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-572-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-573-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-571-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-577-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-579-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-578-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-576-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1644-574-0x00000239A5600000-0x00000239A5610000-memory.dmp
              Download

              memory/1816-267-0x00007FF7C73A0000-0x00007FF7C780C000-memory.dmp
              Download

              memory/1816-279-0x00007FF7C73A0000-0x00007FF7C780C000-memory.dmp
              Download

              memory/1816-211-0x00007FF7C73A0000-0x00007FF7C780C000-memory.dmp
              Download

              memory/1816-209-0x0000023559B80000-0x0000023559BE6000-memory.dmp
              Download

              memory/1816-210-0x0000023559B80000-0x0000023559BE6000-memory.dmp
              Download

              memory/1816-277-0x0000023559B80000-0x0000023559BE6000-memory.dmp
              Download

              memory/1916-348-0x000001C28A9B0000-0x000001C28A9C0000-memory.dmp
              Download

              memory/1916-377-0x00007FF6C0720000-0x00007FF6C0A73000-memory.dmp
              Download

              memory/1916-332-0x000001C28A780000-0x000001C28A790000-memory.dmp
              Download

              memory/1916-364-0x000001C292D70000-0x000001C292D78000-memory.dmp
              Download

              memory/1916-328-0x00007FF6C0720000-0x00007FF6C0A73000-memory.dmp
              Download

              memory/1916-325-0x000001C289830000-0x000001C289896000-memory.dmp
              Download

              memory/1916-326-0x000001C289830000-0x000001C289896000-memory.dmp
              Download

              memory/2132-111-0x00007FF737ED0000-0x00007FF737FB3000-memory.dmp
              Download

              memory/2132-112-0x0000023AB8E90000-0x0000023AB8EF6000-memory.dmp
              Download

              memory/2132-114-0x0000023AB8E90000-0x0000023AB8EF6000-memory.dmp
              Download

              memory/2132-180-0x00007FF737ED0000-0x00007FF737FB3000-memory.dmp
              Download

              memory/2268-173-0x00000271F9190000-0x00000271F91F6000-memory.dmp
              Download

              memory/2268-172-0x00000271F8F70000-0x00000271F906B000-memory.dmp
              Download

              memory/2268-174-0x00000271F9190000-0x00000271F91F6000-memory.dmp
              Download

              memory/2292-245-0x00000190CCA60000-0x00000190CCAC6000-memory.dmp
              Download

              memory/2292-290-0x00007FF751650000-0x00007FF7517DE000-memory.dmp
              Download

              memory/2292-246-0x00000190CCA60000-0x00000190CCAC6000-memory.dmp
              Download

              memory/2292-244-0x00007FF751650000-0x00007FF7517DE000-memory.dmp
              Download

              memory/2776-139-0x00000227A8400000-0x00000227A84FB000-memory.dmp
              Download

              memory/2776-141-0x00000227A85D0000-0x00000227A8636000-memory.dmp
              Download

              memory/2776-140-0x00000227A85D0000-0x00000227A8636000-memory.dmp
              Download

              memory/3156-0-0x0000000003190000-0x000000000329C000-memory.dmp
              Download

              memory/3156-1-0x0000000003380000-0x00000000033E9000-memory.dmp
              Download

              memory/3156-7-0x0000000003380000-0x00000000033E9000-memory.dmp
              Download

              memory/3388-281-0x00007FF7D1AD0000-0x00007FF7D1DF3000-memory.dmp
              Download

              memory/3388-228-0x000001A92B610000-0x000001A92B676000-memory.dmp
              Download

              memory/3388-226-0x000001A92B610000-0x000001A92B676000-memory.dmp
              Download

              memory/3388-227-0x00007FF7D1AD0000-0x00007FF7D1DF3000-memory.dmp
              Download

              memory/3616-150-0x00000174079A0000-0x0000017407A06000-memory.dmp
              Download

              memory/3616-148-0x00007FF6DB3F0000-0x00007FF6DB557000-memory.dmp
              Download

              memory/3616-157-0x00007FF6DB3F0000-0x00007FF6DB557000-memory.dmp
              Download

              memory/3616-155-0x00000174079A0000-0x0000017407A06000-memory.dmp
              Download

              memory/3616-149-0x00000174079A0000-0x0000017407A06000-memory.dmp
              Download

              memory/3804-260-0x000001CB4CA80000-0x000001CB4CAE6000-memory.dmp
              Download

              memory/3804-253-0x000001CB4CA80000-0x000001CB4CAE6000-memory.dmp
              Download

              memory/3804-259-0x00007FF7AFC70000-0x00007FF7B0098000-memory.dmp
              Download

              memory/3804-262-0x00007FF7AFC70000-0x00007FF7B0098000-memory.dmp
              Download

              memory/3804-254-0x000001CB4CA80000-0x000001CB4CAE6000-memory.dmp
              Download

              memory/3948-121-0x0000018B57D50000-0x0000018B57DB6000-memory.dmp
              Download

              memory/3948-126-0x0000018B57D50000-0x0000018B57DB6000-memory.dmp
              Download

              memory/3948-120-0x00007FF730360000-0x00007FF7305E7000-memory.dmp
              Download

              memory/3948-128-0x00007FF730360000-0x00007FF7305E7000-memory.dmp
              Download

              memory/3948-122-0x0000018B57D50000-0x0000018B57DB6000-memory.dmp
              Download

              memory/4124-283-0x00007FF71C280000-0x00007FF71C46E000-memory.dmp
              Download

              memory/4124-237-0x0000026D0D7C0000-0x0000026D0D826000-memory.dmp
              Download

              memory/4124-236-0x0000026D0D7C0000-0x0000026D0D826000-memory.dmp
              Download

              memory/4124-235-0x00007FF71C280000-0x00007FF71C46E000-memory.dmp
              Download

              memory/4216-182-0x0000017B82280000-0x0000017B822E6000-memory.dmp
              Download

              memory/4216-183-0x0000017B82280000-0x0000017B822E6000-memory.dmp
              Download

              memory/4216-181-0x00007FF6DCCC0000-0x00007FF6DCDA9000-memory.dmp
              Download

              memory/4216-250-0x00007FF6DCCC0000-0x00007FF6DCDA9000-memory.dmp
              Download

              memory/4860-271-0x000001EFF1F10000-0x000001EFF1F76000-memory.dmp
              Download

              memory/4860-270-0x000001EFF1F10000-0x000001EFF1F76000-memory.dmp
              Download

              memory/4860-275-0x00007FF6FA660000-0x00007FF6FAB3C000-memory.dmp
              Download

              memory/4860-369-0x00007FF6FA660000-0x00007FF6FAB3C000-memory.dmp
              Download

              memory/4892-255-0x0000000000400000-0x00000000004AD000-memory.dmp
              Download

              memory/4892-189-0x0000000000400000-0x00000000004AD000-memory.dmp
              Download

              memory/4892-190-0x0000000000590000-0x00000000005F9000-memory.dmp
              Download

              memory/4892-195-0x0000000000590000-0x00000000005F9000-memory.dmp
              Download

              memory/4940-162-0x0000028B1FF10000-0x0000028B1FF76000-memory.dmp
              Download

              memory/4940-160-0x00007FF6BCF30000-0x00007FF6BD043000-memory.dmp
              Download

              memory/4940-161-0x0000028B1FF10000-0x0000028B1FF76000-memory.dmp
              Download

              memory/4940-243-0x00007FF6BCF30000-0x00007FF6BD043000-memory.dmp
              Download

              memory/4960-21-0x000001D02CF00000-0x000001D02CF66000-memory.dmp
              Download

              memory/4960-147-0x00007FF655FD0000-0x00007FF6560B6000-memory.dmp
              Download

              memory/4960-15-0x00007FF655FD0000-0x00007FF6560B6000-memory.dmp
              Download

              memory/4960-16-0x000001D02CF00000-0x000001D02CF66000-memory.dmp
              Download

              memory/4960-17-0x000001D02CF00000-0x000001D02CF66000-memory.dmp
              Download

              memory/5096-373-0x00007FF623700000-0x00007FF623C2A000-memory.dmp
              Download

              memory/5096-284-0x00007FF623700000-0x00007FF623C2A000-memory.dmp
              Download

              memory/5096-285-0x0000022202040000-0x00000222020A6000-memory.dmp
              Download

              memory/5096-286-0x0000022202040000-0x00000222020A6000-memory.dmp
              Download

              memory/5116-220-0x000001FD4C3C0000-0x000001FD4C426000-memory.dmp
              Download

              memory/5116-219-0x000001FD4C3C0000-0x000001FD4C426000-memory.dmp
              Download

              memory/5116-276-0x00007FF6F2560000-0x00007FF6F260A000-memory.dmp
              Download

              memory/5116-218-0x00007FF6F2560000-0x00007FF6F260A000-memory.dmp
              Download