Overview

overview

8

Static

static

3

2026-08-08...op.exe

windows10-2004-x64

8

2026-08-08...op.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 04:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_0b528c7657cef9b0f0f5ce6c07e42e40_darkgate_elex_rhadamanthys_stop.exe
  • Size 1.7MB
  • Sample260808-erecsas1ht
  • SHA256 00164eb7970b043eeb70de3335e91e592b771fd1c88db934c14c02f950fcff41
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_0b528c7657cef9b0f0f5ce6c07e42e40_darkgate_elex_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_0b528c7657cef9b0f0f5ce6c07e42e40_darkgate_elex_rhadamanthys_stop.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
      2⤵
        PID:5240
      • C:\ProgramData\Adobe\ARM\S\19355\AdobeARMHelper.exe
        "C:\ProgramData\Adobe\ARM\S\19355\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\19355" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5956
        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\19355" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:6104
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4216
    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      1⤵
      • Executes dropped EXE
      PID:5036
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
        PID:4844
      • C:\Windows\system32\fxssvc.exe
        C:\Windows\system32\fxssvc.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2848
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:2916
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:3968
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:3252
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:996
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:4392
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:1584
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4584
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:2732
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4784
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:5004
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:400
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:4940
        • C:\Windows\System32\OpenSSH\ssh-agent.exe
          C:\Windows\System32\OpenSSH\ssh-agent.exe
          1⤵
          • Executes dropped EXE
          PID:4512
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:724
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4988
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:3252
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1140
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1188
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:4432
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:940
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:2384
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 904
            2⤵
            • Modifies data under HKEY_USERS
            PID:1992

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              AdobeARM.exe
              • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
              • Size 1.7MB
              • SHA256 abc3f8c71e6a43837b3118b4aad860d437a6eb1232f7eac9fe53c71bca614544
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 c16fe6283d59f6274abd6fa572ac1926f4e5968b92c88b1bb3c4849f20bc1d49
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 845KB
              • SHA256 5d5cb4ed686fb5e640674292bd793c6e46fc7ae17610084b4f42faf6bed0fe75
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.1MB
              • SHA256 6844dc5ee3d1d414c9883abdb1c943c69359b5365722cf6eb7b8968b3c8c4199
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 5a949c2f2d1e8c8c94f7938b3305e15c4a9cbd471755092ecc45837cc14cced6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 d9690d73a360cd635ebea9b5a174b6bc676bb106c2ab71241a95ec06d6a6bd5a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 599KB
              • SHA256 4251909921495d091b9a2618a03ce7a63ca9ac25176ed5735b060b67ed3cf4e6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 859KB
              • SHA256 2d01ced4329de90dee51bef3238ff86bb108f366c680afb965b05fa47714db82
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.7MB
              • SHA256 b61984e98ab5e714cf80589949da7564298cf6a9a05711b54f7c9e813e6891d8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 928KB
              • SHA256 d6fd5ef831097fe402927fcf33d2baf8f3d5e903a02b33fce50afcf8bb77f5f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 71332487759483c4648a2966267ca3f60c5b7bf8a8d0f8af9335872415be0552
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 73cac95615ac50a392eab7f729c410e5b40faeb576e4d5390fbfa04e9496e58d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 2692760ef63b203da60d7d10c0dac20584b780d454544822581bbedf1fe82177
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 825KB
              • SHA256 61397bd3bdca4a958bba21b5813ebc583661714f5890ca7313affae6d21f5509
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 675KB
              • SHA256 9884b3a0ccfca10b6f8bd3b525b6e8ca19a1f52e2cabf2b8cb13378f0da90ae5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 b08b1bedb6937777d0cbd9bdb4c6a905abf78a635f6c4d985c741cea4f20aea6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 3d4369588ef04a9ec606f8a5727272b1f606dca088f2f4f9a725716effd0c711
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 3b698d9ae99189a7f25b7fe7924cb17f7d83640828b77eac69818f613b11ce46
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 718KB
              • SHA256 6dd2c96e6a9571322bab248dfbfe26655db44b62839d0a16e6215bb70c268284
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 102B
              • SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 824B
              • SHA256 c62557ca2d044a3b9ebd39042dcf529c783de02b64e466462aa6cb35d24135a9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 1KB
              • SHA256 62fe661f576be28ca40c9f7395263d450a412e2e7cf950e4587410b4bb0b06d0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.msi
              • Path C:\ProgramData\Adobe\ARM\S\19355\AdobeARM.msi
              • Size 1.0MB
              • SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARMHelper.exe
              • Path C:\ProgramData\Adobe\ARM\S\19355\AdobeARMHelper.exe
              • Size 413KB
              • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrManifest2.msi
              • Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
              • Size 18KB
              • SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              1A374813EDB1A6631387E414D3E73232
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232
              • Size 176KB
              • SHA256 2731ab89b51d2130f23f3769e4fa5f2489c04c858ecb59ea126fc1cd0049ccd9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              616AD1AB067CFD351D6C0EF6F3E12F40
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
              • Size 1KB
              • SHA256 9d9e8ad7b7e2bebe98dee283adb6496263f945acb2db3f3af94b1b8b1228f195
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 727B
              • SHA256 2da08ffe4508c77daca6de8a86c2f4165c7b84d228022544331cfa5e59ce5ebb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              BA74182F76F15A9CF514DEF352303C95
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BA74182F76F15A9CF514DEF352303C95
              • Size 737B
              • SHA256 69cc6f68cdd946a740d7937f9c2974d4a92a4b4e5cf49a13303bea12475ca92e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              1A374813EDB1A6631387E414D3E73232
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232
              • Size 306B
              • SHA256 5c0fe41aa2d42bbf8dd488888d97e6c602db5654279bd4b1bd080cfec1748bec
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              616AD1AB067CFD351D6C0EF6F3E12F40
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
              • Size 252B
              • SHA256 bb6cc4d34dd8c1034c2f29b6272066d3c52965bf06f3de4c520430676d8fcf7c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 404B
              • SHA256 34d53f9dca61311c2fe5dd87c5680b9cdb0e0dd0bd86ececb1ecc7ae6500c1d6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              BA74182F76F15A9CF514DEF352303C95
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95
              • Size 248B
              • SHA256 3880fe4d85ba3244e70cbd2c8c85d8b1e5d9fe8e2b9d3f591eca76ef7a277a78
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 1KB
              • SHA256 2bfab0fd60750a85cb81efdae3e1082ccb3a61e3bbd17dd6edf36e4c620cb7f5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 1KB
              • SHA256 5ce310dac9249ff44c4414261f95c11776e815b6421344c1707510255083cd84
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
              • Size 251KB
              • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpB7AE.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpB7AE.tmp
              • Size 5KB
              • SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpD903.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpD903.tmp
              • Size 5KB
              • SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpD9CF.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpD9CF.tmp
              • Size 3KB
              • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TmpDFCB.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpDFCB.tmp
              • Size 5KB
              • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpFF7.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpFF7.tmp
              • Size 5KB
              • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              f6be0ab279c0b0e8.bin
              • Path C:\Users\Admin\AppData\Roaming\f6be0ab279c0b0e8.bin
              • Size 12KB
              • SHA256 243ac7de10eb3cfbba1bf928bc2ee6098e1b20a269576dfbf9637d3896ebdfc3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 606KB
              • SHA256 8358ca953fc07fce5f25e1862b3c3048b03dd5909432d2d43df8da58d42df239
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 39097ebba38013e177df3310714b575b7c34664e5b0c65d009201dd6720a0128
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 677KB
              • SHA256 9e7bbd2dc57f5b36cdbc5639736b7567e3a8ff8f1761d986a2c30a24b7e7ea63
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 c67b6f41a11ec7fc17a12d0bf1efada456fdc0a1d3617b7d6e9ef988a45db990
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 596KB
              • SHA256 4dfbb7289feb937eb8601b1f857627f419e3855f761781a787f6c36a1509e0fc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 959KB
              • SHA256 5613d967377da1dcdcb42e1b7b3922501669121cfbaf1ea66805ce35b5123f90
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 689KB
              • SHA256 8873bf888d12426d79506f150f1d145d540d4677db8048268eefe56b6c8c9792
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.5MB
              • SHA256 d7e0060fefcfb0878795cf7d2f4625178dd1346acbc24bc3b70fc8f2cabc220a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 aa94c80c2be50e003ad657ad944d475f7fa69025a92cda83854a78bfd7b2ff0a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 101cb2a484447185ce901012516143a59319df3794116a28a7e6c79031e8c364
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 903KB
              • SHA256 d8cdfbdd8f6e762beceefa9dfa04490a1b178a3545ed7fb2e7f1985491d36097
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 30f3b0fb4325bd08d9ff25a0ceb89b8951ec47579a6542eb84ff78e971af5e24
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 678KB
              • SHA256 f41f23cba4fd82eb1aa23facdfc8e7e1e185ecaa66edb35237b88f68760cdf83
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 730KB
              • SHA256 40d757b334fe4fdf1417073b4e2bddfa2ca8618d19724b49c6b0c184060ce0e5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 601KB
              • SHA256 73e67e806509957432318f888ee0279418047b7188d7d8fe0bc4470d87976365
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 219a81d1653f2013426c262e9e474c3c39b1ea01b79df9aa68d22cd0ec47c70e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 790KB
              • SHA256 29e6df67f5819b9554123b3e406b9da6dd8783a86bc7c1f8ca566d5e6616945b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 cf50590aeb9a99b7b480c895ea588482279a1ba9c91d767d928bd92ef0df5cb7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 6bff28d559516acfa56fdca26928a204ba56d8205d60ac4f5a991fe0b816a942
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 895KB
              • SHA256 349fee6b7dcf3000edd11a7257c1fd2f7e4044473f3264cc97b8b506991f7da6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 653KB
              • SHA256 29a3a05a8adfb98dbecb51175912cf5795b63cb1eacd08e434f168118904f42d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/400-226-0x000002C252E20000-0x000002C252E86000-memory.dmp
              Download

              memory/400-224-0x00007FF7C79B0000-0x00007FF7C7CD3000-memory.dmp
              Download

              memory/400-285-0x00007FF7C79B0000-0x00007FF7C7CD3000-memory.dmp
              Download

              memory/400-225-0x000002C252E20000-0x000002C252E86000-memory.dmp
              Download

              memory/724-243-0x000002D51CC90000-0x000002D51CCF6000-memory.dmp
              Download

              memory/724-294-0x00007FF7FDDA0000-0x00007FF7FDF2E000-memory.dmp
              Download

              memory/724-241-0x000002D51CC90000-0x000002D51CCF6000-memory.dmp
              Download

              memory/724-242-0x00007FF7FDDA0000-0x00007FF7FDF2E000-memory.dmp
              Download

              memory/940-297-0x00007FF65DEF0000-0x00007FF65E243000-memory.dmp
              Download

              memory/940-369-0x0000020F61F50000-0x0000020F61F58000-memory.dmp
              Download

              memory/940-352-0x00007FF65DEF0000-0x00007FF65E243000-memory.dmp
              Download

              memory/940-298-0x0000020F57340000-0x0000020F573A6000-memory.dmp
              Download

              memory/940-299-0x0000020F57340000-0x0000020F573A6000-memory.dmp
              Download

              memory/940-303-0x0000020F582A0000-0x0000020F582B0000-memory.dmp
              Download

              memory/940-319-0x0000020F583A0000-0x0000020F583B0000-memory.dmp
              Download

              memory/940-337-0x0000020F60890000-0x0000020F60898000-memory.dmp
              Download

              memory/996-247-0x00007FF73CE00000-0x00007FF73CF13000-memory.dmp
              Download

              memory/996-159-0x0000028639C60000-0x0000028639CC6000-memory.dmp
              Download

              memory/996-160-0x0000028639C60000-0x0000028639CC6000-memory.dmp
              Download

              memory/996-158-0x00007FF73CE00000-0x00007FF73CF13000-memory.dmp
              Download

              memory/1140-272-0x00007FF7A0C50000-0x00007FF7A112C000-memory.dmp
              Download

              memory/1140-347-0x00007FF7A0C50000-0x00007FF7A112C000-memory.dmp
              Download

              memory/1140-267-0x00000269463A0000-0x0000026946406000-memory.dmp
              Download

              memory/1140-268-0x00000269463A0000-0x0000026946406000-memory.dmp
              Download

              memory/1188-279-0x00007FF6A87B0000-0x00007FF6A8CDA000-memory.dmp
              Download

              memory/1188-350-0x00007FF6A87B0000-0x00007FF6A8CDA000-memory.dmp
              Download

              memory/1188-278-0x00000222F7BF0000-0x00000222F7C56000-memory.dmp
              Download

              memory/1188-277-0x00000222F7BF0000-0x00000222F7C56000-memory.dmp
              Download

              memory/1584-178-0x00007FF79FA10000-0x00007FF79FAF9000-memory.dmp
              Download

              memory/1584-180-0x0000027F79D30000-0x0000027F79D96000-memory.dmp
              Download

              memory/1584-179-0x0000027F79D30000-0x0000027F79D96000-memory.dmp
              Download

              memory/1584-250-0x00007FF79FA10000-0x00007FF79FAF9000-memory.dmp
              Download

              memory/1992-470-0x000001D4150C0000-0x000001D4150D0000-memory.dmp
              Download

              memory/1992-469-0x000001D4150C0000-0x000001D4150D0000-memory.dmp
              Download

              memory/1992-472-0x000001D4150C0000-0x000001D4150D0000-memory.dmp
              Download

              memory/1992-473-0x000001D4150C0000-0x000001D4150D0000-memory.dmp
              Download

              memory/1992-468-0x000001D4150C0000-0x000001D4150D0000-memory.dmp
              Download

              memory/1992-474-0x000001D4150C0000-0x000001D4150D0000-memory.dmp
              Download

              memory/1992-471-0x000001D4150C0000-0x000001D4150D0000-memory.dmp
              Download

              memory/1992-477-0x000001D4150C0000-0x000001D4150D0000-memory.dmp
              Download

              memory/1992-476-0x000001D4150C0000-0x000001D4150D0000-memory.dmp
              Download

              memory/1992-475-0x000001D4150C0000-0x000001D4150D0000-memory.dmp
              Download

              memory/2732-201-0x000001C03BC50000-0x000001C03BCB6000-memory.dmp
              Download

              memory/2732-200-0x000001C03BC50000-0x000001C03BCB6000-memory.dmp
              Download

              memory/2732-199-0x00007FF6F5650000-0x00007FF6F56F7000-memory.dmp
              Download

              memory/2732-264-0x00007FF6F5650000-0x00007FF6F56F7000-memory.dmp
              Download

              memory/2772-1-0x0000000002A00000-0x0000000002A69000-memory.dmp
              Download

              memory/2772-0-0x00000000027C0000-0x00000000028CC000-memory.dmp
              Download

              memory/2772-6-0x0000000002A00000-0x0000000002A69000-memory.dmp
              Download

              memory/2848-120-0x000001ADA7120000-0x000001ADA7186000-memory.dmp
              Download

              memory/2848-118-0x00007FF7FC820000-0x00007FF7FCAA7000-memory.dmp
              Download

              memory/2848-124-0x000001ADA7120000-0x000001ADA7186000-memory.dmp
              Download

              memory/2848-126-0x00007FF7FC820000-0x00007FF7FCAA7000-memory.dmp
              Download

              memory/2848-119-0x000001ADA7120000-0x000001ADA7186000-memory.dmp
              Download

              memory/2916-131-0x000002DB734D0000-0x000002DB73536000-memory.dmp
              Download

              memory/2916-130-0x000002DB734D0000-0x000002DB73536000-memory.dmp
              Download

              memory/2916-129-0x000002DB732B0000-0x000002DB733AB000-memory.dmp
              Download

              memory/3252-263-0x00007FF7D4C40000-0x00007FF7D4EFD000-memory.dmp
              Download

              memory/3252-146-0x0000015AC3AD0000-0x0000015AC3B36000-memory.dmp
              Download

              memory/3252-154-0x00007FF630E30000-0x00007FF630F97000-memory.dmp
              Download

              memory/3252-147-0x0000015AC3AD0000-0x0000015AC3B36000-memory.dmp
              Download

              memory/3252-343-0x00007FF7D4C40000-0x00007FF7D4EFD000-memory.dmp
              Download

              memory/3252-152-0x0000015AC3AD0000-0x0000015AC3B36000-memory.dmp
              Download

              memory/3252-145-0x00007FF630E30000-0x00007FF630F97000-memory.dmp
              Download

              memory/3968-138-0x00000230EDBD0000-0x00000230EDC36000-memory.dmp
              Download

              memory/3968-137-0x00000230EDA00000-0x00000230EDAFB000-memory.dmp
              Download

              memory/3968-139-0x00000230EDBD0000-0x00000230EDC36000-memory.dmp
              Download

              memory/4216-14-0x00007FF774F30000-0x00007FF775016000-memory.dmp
              Download

              memory/4216-15-0x0000020CDB150000-0x0000020CDB1B6000-memory.dmp
              Download

              memory/4216-157-0x00007FF774F30000-0x00007FF775016000-memory.dmp
              Download

              memory/4216-16-0x0000020CDB150000-0x0000020CDB1B6000-memory.dmp
              Download

              memory/4392-170-0x000001C9566E0000-0x000001C9567DB000-memory.dmp
              Download

              memory/4392-171-0x000001C9568B0000-0x000001C956916000-memory.dmp
              Download

              memory/4392-172-0x000001C9568B0000-0x000001C956916000-memory.dmp
              Download

              memory/4432-351-0x00007FF78DE00000-0x00007FF78DF3A000-memory.dmp
              Download

              memory/4432-288-0x0000024D85260000-0x0000024D852C6000-memory.dmp
              Download

              memory/4432-287-0x00007FF78DE00000-0x00007FF78DF3A000-memory.dmp
              Download

              memory/4432-286-0x0000024D85260000-0x0000024D852C6000-memory.dmp
              Download

              memory/4512-292-0x00007FF6382A0000-0x00007FF63848E000-memory.dmp
              Download

              memory/4512-235-0x000002AA606F0000-0x000002AA60756000-memory.dmp
              Download

              memory/4512-234-0x000002AA606F0000-0x000002AA60756000-memory.dmp
              Download

              memory/4512-233-0x00007FF6382A0000-0x00007FF63848E000-memory.dmp
              Download

              memory/4584-191-0x00000000007C0000-0x0000000000829000-memory.dmp
              Download

              memory/4584-186-0x00000000007C0000-0x0000000000829000-memory.dmp
              Download

              memory/4584-194-0x0000000000400000-0x00000000004AD000-memory.dmp
              Download

              memory/4584-262-0x0000000000400000-0x00000000004AD000-memory.dmp
              Download

              memory/4784-335-0x000001EC894A0000-0x000001EC89506000-memory.dmp
              Download

              memory/4784-207-0x000001EC894A0000-0x000001EC89506000-memory.dmp
              Download

              memory/4784-212-0x00007FF6A6350000-0x00007FF6A67BC000-memory.dmp
              Download

              memory/4784-208-0x000001EC894A0000-0x000001EC89506000-memory.dmp
              Download

              memory/4784-338-0x00007FF6A6350000-0x00007FF6A67BC000-memory.dmp
              Download

              memory/4784-273-0x00007FF6A6350000-0x00007FF6A67BC000-memory.dmp
              Download

              memory/4988-258-0x000001BC571B0000-0x000001BC57216000-memory.dmp
              Download

              memory/4988-252-0x000001BC571B0000-0x000001BC57216000-memory.dmp
              Download

              memory/4988-259-0x00007FF7C3FA0000-0x00007FF7C43C8000-memory.dmp
              Download

              memory/4988-256-0x00007FF7C3FA0000-0x00007FF7C43C8000-memory.dmp
              Download

              memory/4988-251-0x000001BC571B0000-0x000001BC57216000-memory.dmp
              Download

              memory/5004-216-0x00007FF618EA0000-0x00007FF618F4A000-memory.dmp
              Download

              memory/5004-217-0x0000023453B80000-0x0000023453BE6000-memory.dmp
              Download

              memory/5004-276-0x00007FF618EA0000-0x00007FF618F4A000-memory.dmp
              Download

              memory/5004-218-0x0000023453B80000-0x0000023453BE6000-memory.dmp
              Download

              memory/5036-25-0x00000288090C0000-0x0000028809126000-memory.dmp
              Download

              memory/5036-27-0x00000288090C0000-0x0000028809126000-memory.dmp
              Download

              memory/5036-24-0x00007FF68D290000-0x00007FF68D373000-memory.dmp
              Download

              memory/5036-193-0x00007FF68D290000-0x00007FF68D373000-memory.dmp
              Download