24f32d22e3e1180708553e4841a5b9715d8ea85148327818ad63f6673ebfde10

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Size 3.3MB
Sample260810-1fb9yaaj2t
SHA256 24f32d22e3e1180708553e4841a5b9715d8ea85148327818ad63f6673ebfde10
MD5 e46c7b8d04bb6acff2315f3e72f66afd
SHA1 12f43837afa8506d02add554da094b568ac4c119
SHA512 613b35fc9cbe2bf85c8b94a4f53e8b3f708f6ef3b4c245a95cc0cdac7be3bc0fe90fb2a4e3d2148d6ec2492b8b6c18a70c8951e3cad6c8d045b0af0300528486
SSDEEP 49152:PZjATAK7IjnDreNwL934vsDEuJUNliAceq58uCiqHUzj23P28h0jpIMlXn:PZ0TWDreQDEuJU9mGjiO61
TLSH
T188F5AF317701C4B6D95202B0ADBDEA5F816DBD218F7414C7B3D82F6E55B19C22B32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1596	alg.exe
5720	GameInputSvc.exe
5608	GameInputSvc.exe
5624	elevation_service.exe
4816	elevation_service.exe
5576	maintenanceservice.exe
3416	msdtc.exe
2608	OSE.EXE
3404	PerceptionSimulationService.exe
1760	perfhost.exe
3668	ReFsDedupSvc.exe
1876	locator.exe
2384	SensorDataService.exe
4492	snmptrap.exe
2616	ssh-agent.exe
3344	TieringEngineService.exe
4696	AgentService.exe
4708	vds.exe
5848	vssvc.exe
4664	wbengine.exe
4756	WmiApSrv.exe
5584	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1e68878ee05f6396.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e8db0391029dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000414a5d371029dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000433f1d761029dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d3a3e751029dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d17772761029dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d5b23761029dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a7ed9381029dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e817d23c1029dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007735d391029dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5608	GameInputSvc.exe
5608	GameInputSvc.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTakeOwnershipPrivilege	5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTcbPrivilege	5720	GameInputSvc.exe
Token: SeBackupPrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3344	TieringEngineService.exe
Token: SeManageVolumePrivilege	3344	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4696	AgentService.exe
Token: SeBackupPrivilege	5848	vssvc.exe
Token: SeRestorePrivilege	5848	vssvc.exe
Token: SeAuditPrivilege	5848	vssvc.exe
Token: SeBackupPrivilege	4664	wbengine.exe
Token: SeRestorePrivilege	4664	wbengine.exe
Token: SeSecurityPrivilege	4664	wbengine.exe
Token: 33	5584	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5584	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5584	SearchIndexer.exe
Token: SeDebugPrivilege	5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	5712	2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 5608	5720	GameInputSvc.exe	90
PID 5584 wrote to memory of 264	5584	SearchIndexer.exe	111
PID 5584 wrote to memory of 1896	5584	SearchIndexer.exe	113
PID 5584 wrote to memory of 4468	5584	SearchIndexer.exe	114
PID 5584 wrote to memory of 3580	5584	SearchIndexer.exe	115
PID 5584 wrote to memory of 5756	5584	SearchIndexer.exe	116
PID 5584 wrote to memory of 2580	5584	SearchIndexer.exe	117
PID 5584 wrote to memory of 5764	5584	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e46c7b8d04bb6acff2315f3e72f66afd_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5712

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1596

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4816

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5576

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3416

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2608

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1876

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2384

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4492

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5848

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:264
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2756 2896 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2916 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2756 2896 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2916 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 110ec6a35eed842185c6b4ea80fdd87af7452ddfe1c9b0c1d6ac460bc41bc649
MD5 a022528023d097a4548d1f89de74b0ae
SHA1 b30433581e82d49b96ca7b9b7a66b3ecc642b990
SHA512 576eb1afb2bbf901e5548b9a699a50715ef552aa3328035e47b89ccea02f064da516adeb8bdeb17cc25b89ee2555a628c849a6d8643296aafc3b95057fb40749
SSDEEP 49152:0b+6Y2BuPkFKRrdE6oh7stBhuXjfS4LWxnTh0jpIMlXn:uYq6gjBO61
TLSH
T1C7D59D03F29900E9E069D178D7469133E9A2BC890B34B6DF0790B7562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 9a91f2639bea5fa842a44a8aa5642c6752df4251775d94886a55e5cb27fa3d69
MD5 b84f7875206fd961f2a1c15b6b9ca03c
SHA1 7afb7b46d99d355def766aafe5a4b909a9e21ddc
SHA512 9e3ee7868c70fad7cb0904ad31d87a41bb251fb689d8a0e5ac59064e05fa3710fac9182afdf96b8480d2b81915e6bd9dc249326431e063329d2c57d782840de6
SSDEEP 12288:G1XLsZUukxTwER52czARzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:kXYWrqczARKOW0jxuBIRIMKsLPPn
TLSH
T12A05013877D049F9ED77413DC8A28511EA7378914760EB9B03B4DA361E233989E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 b6649936e2f66a5248a10e3b41c5b47ccfb5b1b48840a83bc91f4ca76c1c8592
MD5 c85b3690cb02850075ec1a4966c0e4f8
SHA1 3f919c668b9632088f2cf1937c51116b27f7e33a
SHA512 120cf833ca402bda4f24936a3622155e63096528ef679e9868ed858e73b005407da50e9c2cec31530649f1845b7bacc6c1d9821e46336ecfc254fa50b83245a6
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CgzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPPT:uwuuOW1KOW0jxuBIRIMKsLPPnT
TLSH
T1BA05F15576946CF9E9B74139C587C136EBF2BC122A20CB1F0370C66B6F27361AE19B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 90347352ca354d87c26c05cdbc1867d9420a9ebf4ddcc97a89538e5c6dfbd365
MD5 5efe1f95b1eb102f0bfd3a8429f35e7a
SHA1 8e7f8f399c4aced0fd1267bdf0dd4b2d6c10b42e
SHA512 c666773b1e7ac95701c07eeda555c0440dae2f633a9e8f28562643266e56e83b4ca2cc98534cbccaab431d83735047730e7efc555a5ed3e205e87551832fefab
SSDEEP 49152:pe+taZ3usBWOBr4tEGp0bqx0z+n217aau1glch0jpIMlXn:Qu6JmTxd2dg61
TLSH
T10DD59E13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 611KB
SHA256 b4e418d7d32f9898d05677771cab94f89bb738528b3e432feacc5e5a051b07af
MD5 ebc1186317c3ba5dae1495efc5a1910b
SHA1 c4c8377bd3130d8b947898879dceb659fad98866
SHA512 43902b0fb6f81b5af63fda608a6b92b08ed70ac764b15d49bcdf0ab3704f01d5fd746a76a5ddf7150a6e5e4091ff97535d3a140bc919d768aefa14aa7f616731
SSDEEP 12288:Id7KzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:4KKOW0jxuBIRIMKsLPPn
TLSH
T164D42371A944FF6AFA791074A087A3609D7A38A5AF04C9D75039C27B38987C4DE00EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4f028895b7eb895b582612f95e58bfabde3d2740b6adff02cee8fbc953724c6e
MD5 aebd6074eb53fac1d0fa4b27f6137358
SHA1 073c771b57c39b2f4ece962a7622d595fcc026fd
SHA512 6ab61d5decc63f7fa08ba4c757bd11ba69d213f8c45815b48adaf06dcc19b0181b4c9305719e3ca5a538d0af3a69515f1ad8f565bb97c8838044be3e9f5616b5
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYDKOW0jxuBIRIMKsLPPn:/gb4mBIBhGF3h0jpIMlXn
TLSH
T19265AE1E22E802F5E0FAD2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 fa3c4ebe1e7a73a78010c05e919f523b96c0f8238ae5ad92944a7fa6c16ef8d5
MD5 62b536bba88590899ae5de0f397563cd
SHA1 e9798f61597d4cee2267657f251bf922edd4febd
SHA512 cd978a1aeb4dceb8f5d0cbcd55ed8141843fa01f5768f9d05be2df00b0ce86ef010300f22af8d5b5eeb204d75473a62aebe080b2af0b347f9b23ad97a7a2de74
SSDEEP 12288:LgGszXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:cGsKOW0jxuBIRIMKsLPPn
TLSH
T1E3E4233C7496BAECC93A4179D052A262BCB138A06F14D9FF04F5D2366E886D0EB34DD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 2f50b9291d8e6db655f33a73cdc0fbf561e3f117db60d3ec632a0176942d50ab
MD5 9b5b65418695f2f9fe3fbc74129cf7da
SHA1 f233084d30a5174a3672361d6d0d02c96771fa65
SHA512 d0c0f0da88aa022ecf0fb70fadae346d87f78b4a6bc8b06f1a6c988026e30f3565965a22bd4698c3c09102376133fe88710bc0be8617d093523b892780613801
SSDEEP 12288:f5zXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:f5KOW0jxuBIRIMKsLPPn
TLSH
T1FDD42374A445FFADEA791079A043A3A48DB518A1BF54CEE70079D23738C87C5EA30DE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 44f215017b99b42d3170fb0e858df772c1ea4c081dee01d228d97fc8bf68386b
MD5 5b9aa406e7ddf3b184e2582c0e8915ae
SHA1 1ec1c651151c1c156498f221ea099def1273bcfe
SHA512 4a02899cb25440d1aab6288bbcb26aa825b52b56c5722fee64cfbdfdcd96f742f3c90e45cb28d0127e9b917d7759821ea8542eb8e5dc001eb24dd936e450ebe1
SSDEEP 24576:HG88u8FpJqH1Qzria7/mQKOW0jxuBIRIMKsLPPn:m7ZFPqVva7/8h0jpIMlXn
TLSH
T14D35016576E102F0D47BD13889824663F6B2B8251364EFDF06A88B561F23BD54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 0e0072b109d6a33c5213457059365f3470d5c998de8b3c07825cb025c2ce38b7
MD5 df4790ea1fc2a7829b9549713d335fd7
SHA1 95b4ebe8ecad27968e4a1f7af847cf264b623e3c
SHA512 b1b4fb4f26c823d6558a4bd49544d54a2e37c222e661590a713962c569980edb83fbb96a82f091b234ced06a8bdb1727630ec42461cde72187430f43c82660ef
SSDEEP 12288:5HvUrBFrEjwaQyzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:5PUr+NQyKOW0jxuBIRIMKsLPPn
TLSH
T10505F12F66982CE5E67AA17DC5828319E77278621711D2CF01E0C17E1E67ED8FD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b32bf42d4c8463605eeb78e13641a316a0830cc17fe5ad4edb879a0efda835ba
MD5 65edbb8ebfeb91ffce8eb19fba9189c1
SHA1 76945d73e571687ba972329cc784c5f4c5a1a390
SHA512 f6d522b400b9026ff1d0a853810ca3f8b825e3b50ea87a585e02efa8542e2623383f4b524a2619507435b66420763f230cf7ad6fd87a30bdfb915350234b0801
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZh0jpIMlXn:CG05lO43b+61
TLSH
T1B0D5CF6A62EC11F9D1BBD17CD9C6460BEBB23415033456CF02A486A91F27FF49A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 257686df3c0c3176c127bab81bf4155202a20d11c6d2d08e2169d25bda335114
MD5 b65fafa630d03c3afb83a261d4d86fa9
SHA1 2f93a90a5551dc8b7a0ac3462618bff53df6466a
SHA512 1e3d83015ccfb2f9b1708e6d4daa9b4870d58e927175cc8e15d0ed752a133473461c8e90dfd2f7cb6b63a32af9f668c6a55a4b15f82890842b22fe2d75dc7b0b
SSDEEP 24576:fga5POZ3dpbWVM50JicR2hG0lasx2+47eidnLKOW0jxuBIRIMKsLPPn:4a5POZ3wJt2pasx2+mgh0jpIMlXn
TLSH
T1E265BF5EA6EC01D5E5B9D17DC583861AF5B1342253319BCF012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 17585d371f92130a5f61a27487d07fd525c38b3b6b635390916f18b88c643587
MD5 292395bb61327be0ef7c3073f93b06e9
SHA1 a9e1e0a371b3b60f4777bbaeace68e34c71edc31
SHA512 7fd8f4287b1d414483fd412b170c1611e12e800f53beff51b94a011f4356d7af4681f3bd51fdf2d2aeecefe73b4ce243bfba2936c03fec26c96fe5175216620b
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkbKOW0jxuBIRIMKsLPPn:3Nc/zEOVHFvh0jpIMlXn
TLSH
T1E4858C2622E901E4F5BBE1BE89779546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 fffccd709c6762c2fb24e7a065e44da2f51152625214954dc822aed0c31a3e37
MD5 98f6706c5b2955084060c13ab2a466f3
SHA1 9d30d6178e79f03ff9f8505041da05deb056f8f3
SHA512 a139aa65bf982c9a7b1ecf38537a2dbeb9c1d60a209e191c21f98e6b8f80ec03a7fdccc4bef5b3b7bccb471d0ea1d554c7980723531a914703643d407ec0a15b
SSDEEP 12288:HKHPJnJP6szeCs6Rl28dDzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:4JnJPbzB4SDKOW0jxuBIRIMKsLPPn
TLSH
T1D115D03DD29820E8E4B7C2B4815A175AFE71387D2F2169C718B4D5353F42EE0AA39F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5211d54f25593fe960882067f6b81d93c6ac425d9dbbf51857706ea2dd3c8563
MD5 3047d5981cc35609452bdb788c2677cc
SHA1 e47e47944a4121b396f2c7d72ca42009cdfea97b
SHA512 8679b99d2cc4d2f56e9722d971bf7efd026e287d6243e817dc5f366e079de3f099691425e1a6a4086a38847b165d15950b7aae5616c7e846159502b9690d95fe
SSDEEP 24576:ZCLHGL0MoeVtFumTijCmlKQWDkn0KOW0jxuBIRIMKsLPPn:ZCLHGeeV5ijCmlDWDkNh0jpIMlXn
TLSH
T1A3A56B05E7EB5184F8F3CAF5C92294169A327C549B34F7EF4A80C96A2E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 79763cd1223abfb2eae5324dad9cb9b83a627caea6491ed9d037bcf3d0e34249
MD5 d603246951d33642578b89e5860ef130
SHA1 f9d74cf05b2b01bc8320ac5bee79a3b38ece5761
SHA512 d280dd64fe0e1c3ed379443c73ed4e9242b0f44cd14885b02e700a8638c6c5b3e705501949f3ef2672773460b168c1f4297b0135108c65422a4e24261b1e99f6
SSDEEP 12288:81H7kej5ZI7+zXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:VeDIaKOW0jxuBIRIMKsLPPn
TLSH
T1DE05026C336A61F9D17B903EC1830211D6B2B4B19B119ADF06A4C57E5ED3ED8F938E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 012b29d9f6270664e523e4c05dc5778679bf2551efdc2660f785eb679fa0bc2a
MD5 92b5e73585a3f1b597a54e626ffc7051
SHA1 2091e85696cb83f3f4b660528df508cc21202a1f
SHA512 2baf4806ff021a6136d274715b3f0668bb8a241eb76eccac702d672946bdb88afe980344304f5d64fe168a1e67d02b08a7ee35f1bbe4a9fdd2d1b63cbc428f79
SSDEEP 12288:NG6ky0zXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:0ty0KOW0jxuBIRIMKsLPPn
TLSH
T1D0F412146384B9D9EABA0178D56382A08E757C20AF10D6EF04B1E63F2E757D4ED30F96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 46ae94d5694f87ee99e516b880396832a3a21147cd76cef289c9e3882ea08704
MD5 a2fc4078664fa1213c38204a51b2c318
SHA1 de3cff8536c806718a4389db1f7d50445e7b7aae
SHA512 9efea94934942afd522e9923ad58cf16eddf99e736b226eb51dc7fae1b0ea7e23af9642c536c4b3bed14d84c15e8ac8b46e7e8cb87a84ede6ccb1fd414bac551
SSDEEP 12288:mGXzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:HXKOW0jxuBIRIMKsLPPn
TLSH
T164D423B8A445FFADEA791079A04393948DB538B17F14C9EF04B5D23768893C5EA30DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 920e0c54effae8d35062ffe05a4a1792671b7088612ee54d93ec4f55e454bd59
MD5 575d79551b8c333b32f826d485f87760
SHA1 a9bd99f7f581b00e42b05b9dca16187115f14e25
SHA512 a2db0175a493982fd6b49368265dc79092c95096c51c5ecdd1d2ff15dacab9482e317a4c33c249e1455b43be37a9d146143682fc35b794dae335aa8251bac7a8
SSDEEP 12288:Ktg8XZyFDK3tT5Tr7aVLIH9lH3cZzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbyT:Ktg8UoTfaidZmKOW0jxuBIRIMKsLPPn
TLSH
T116559D1D77EA19CAE2B2D239D8621493D633B4315771C6CF2458C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 3e857bf041c619f519a4795c87ab0fd0488286d98e47e4073464039aaba75b5a
MD5 4c9e5e19056c8eacc8eb9ce26642fca7
SHA1 ad4ea33047689f3dd9142d303ef6d9310dc1bda4
SHA512 6329b9a5bee8ab88f34385c168fdd24167319cde00172dfc32eede8767a7dc6bbd6fbad5bc6bdf797490599ad7c1ba67faf86d34ace1a3e28c808a9e40e71810
SSDEEP 12288:npJcm8CNyzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:nrcmRyKOW0jxuBIRIMKsLPPn
TLSH
T1AA05015EB26E10E9E1BB813CC8824255EAB370302711A7DF01A1C77E5E57AE9BE34F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e8c120b6f7062a5bce5efd18b18c1ff4b7adc1bd793dddc529eb0ddb98e3a61f
MD5 e17eb97fe641967d36e594d29f34690e
SHA1 2176ac8aad32b56126adf6259ccc02003663b299
SHA512 99e3ff450d3062a188042989fc234f3c0231564e96440fd4ed66164c254357380f2f5b0ab1cae02b32581523f33bd4ff7ff25675628f0e90f1686ccf890078b0
SSDEEP 49152:GDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3qPh0jpIMlXn:H3Upow8sB1561
TLSH
T1CEA58C3DA2E810A8C9AAC379C54213A6EA71782D3F3055DB0174C178BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-17-0x000002626C560000-0x000002626C5C6000-memory.dmp

Download

memory/1596-18-0x000002626C560000-0x000002626C5C6000-memory.dmp

Download

memory/1596-92-0x00007FF7FD260000-0x00007FF7FD383000-memory.dmp

Download

memory/1596-16-0x000002626C560000-0x000002626C5C6000-memory.dmp

Download

memory/1596-15-0x00007FF7FD260000-0x00007FF7FD383000-memory.dmp

Download

memory/1760-108-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/1760-107-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/1760-102-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/1760-181-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/1876-126-0x000001FDCEBD0000-0x000001FDCEC36000-memory.dmp

Download

memory/1876-125-0x000001FDCEBD0000-0x000001FDCEC36000-memory.dmp

Download

memory/1876-124-0x00007FF7DBB60000-0x00007FF7DBC0E000-memory.dmp

Download

memory/1876-199-0x00007FF7DBB60000-0x00007FF7DBC0E000-memory.dmp

Download

memory/2384-214-0x00007FF7F6020000-0x00007FF7F6437000-memory.dmp

Download

memory/2384-238-0x00007FF7F6020000-0x00007FF7F6437000-memory.dmp

Download

memory/2384-134-0x000002602CEE0000-0x000002602CF46000-memory.dmp

Download

memory/2384-135-0x000002602CEE0000-0x000002602CF46000-memory.dmp

Download

memory/2384-236-0x000002602CEE0000-0x000002602CF46000-memory.dmp

Download

memory/2384-133-0x00007FF7F6020000-0x00007FF7F6437000-memory.dmp

Download

memory/2608-85-0x0000017804160000-0x00000178041C6000-memory.dmp

Download

memory/2608-84-0x0000017803F60000-0x000001780403C000-memory.dmp

Download

memory/2608-86-0x0000017804160000-0x00000178041C6000-memory.dmp

Download

memory/2616-152-0x00007FF600D40000-0x00007FF601126000-memory.dmp

Download

memory/2616-154-0x000002620E1F0000-0x000002620E256000-memory.dmp

Download

memory/2616-153-0x000002620E1F0000-0x000002620E256000-memory.dmp

Download

memory/2616-220-0x00007FF600D40000-0x00007FF601126000-memory.dmp

Download

memory/3344-234-0x00007FF7031C0000-0x00007FF703355000-memory.dmp

Download

memory/3344-162-0x0000024502E00000-0x0000024502E66000-memory.dmp

Download

memory/3344-163-0x0000024502E00000-0x0000024502E66000-memory.dmp

Download

memory/3344-161-0x00007FF7031C0000-0x00007FF703355000-memory.dmp

Download

memory/3404-169-0x00007FF797840000-0x00007FF79798A000-memory.dmp

Download

memory/3404-96-0x000001EFAE970000-0x000001EFAE9D6000-memory.dmp

Download

memory/3404-95-0x000001EFAE970000-0x000001EFAE9D6000-memory.dmp

Download

memory/3404-93-0x00007FF797840000-0x00007FF79798A000-memory.dmp

Download

memory/3416-160-0x00007FF6F5DB0000-0x00007FF6F5ECA000-memory.dmp

Download

memory/3416-74-0x00000162F3400000-0x00000162F3466000-memory.dmp

Download

memory/3416-73-0x00000162F3400000-0x00000162F3466000-memory.dmp

Download

memory/3416-72-0x00007FF6F5DB0000-0x00007FF6F5ECA000-memory.dmp

Download

memory/3668-118-0x0000020E72B80000-0x0000020E72BE6000-memory.dmp

Download

memory/3668-257-0x0000020E72B80000-0x0000020E72BE6000-memory.dmp

Download

memory/3668-259-0x00007FF710050000-0x00007FF710794000-memory.dmp

Download

memory/3668-116-0x00007FF710050000-0x00007FF710794000-memory.dmp

Download

memory/3668-115-0x0000020E72B80000-0x0000020E72BE6000-memory.dmp

Download

memory/3668-196-0x00007FF710050000-0x00007FF710794000-memory.dmp

Download

memory/4492-142-0x00007FF6C2530000-0x00007FF6C25E4000-memory.dmp

Download

memory/4492-143-0x0000029E903E0000-0x0000029E90446000-memory.dmp

Download

memory/4492-144-0x0000029E903E0000-0x0000029E90446000-memory.dmp

Download

memory/4492-217-0x00007FF6C2530000-0x00007FF6C25E4000-memory.dmp

Download

memory/4664-202-0x000001B6DDAA0000-0x000001B6DDB06000-memory.dmp

Download

memory/4664-200-0x000001B6DDAA0000-0x000001B6DDB06000-memory.dmp

Download

memory/4664-247-0x00007FF67F370000-0x00007FF67F877000-memory.dmp

Download

memory/4664-201-0x00007FF67F370000-0x00007FF67F877000-memory.dmp

Download

memory/4696-175-0x00007FF795CE0000-0x00007FF796001000-memory.dmp

Download

memory/4696-178-0x00007FF795CE0000-0x00007FF796001000-memory.dmp

Download

memory/4696-170-0x000002F5BD690000-0x000002F5BD6F6000-memory.dmp

Download

memory/4696-171-0x000002F5BD690000-0x000002F5BD6F6000-memory.dmp

Download

memory/4696-176-0x000002F5BD690000-0x000002F5BD6F6000-memory.dmp

Download

memory/4708-182-0x00000218B2980000-0x00000218B29E6000-memory.dmp

Download

memory/4708-183-0x00007FF6C48C0000-0x00007FF6C4B4B000-memory.dmp

Download

memory/4708-184-0x00000218B2980000-0x00000218B29E6000-memory.dmp

Download

memory/4708-243-0x00007FF6C48C0000-0x00007FF6C4B4B000-memory.dmp

Download

memory/4756-210-0x000001A3B1480000-0x000001A3B14E6000-memory.dmp

Download

memory/4756-215-0x00007FF65A300000-0x00007FF65A42F000-memory.dmp

Download

memory/4756-209-0x000001A3B1480000-0x000001A3B14E6000-memory.dmp

Download

memory/4756-248-0x00007FF65A300000-0x00007FF65A42F000-memory.dmp

Download

memory/4816-54-0x0000024CDEDC0000-0x0000024CDEE26000-memory.dmp

Download

memory/4816-53-0x0000024CDEDC0000-0x0000024CDEE26000-memory.dmp

Download

memory/4816-52-0x0000024CDEBC0000-0x0000024CDEC9C000-memory.dmp

Download

memory/5576-62-0x000002315B830000-0x000002315B896000-memory.dmp

Download

memory/5576-61-0x000002315B830000-0x000002315B896000-memory.dmp

Download

memory/5576-68-0x000002315B830000-0x000002315B896000-memory.dmp

Download

memory/5576-70-0x00007FF660F70000-0x00007FF6610D8000-memory.dmp

Download

memory/5576-60-0x00007FF660F70000-0x00007FF6610D8000-memory.dmp

Download

memory/5584-221-0x0000020550B20000-0x0000020550B86000-memory.dmp

Download

memory/5584-222-0x00007FF6D6630000-0x00007FF6D696F000-memory.dmp

Download

memory/5584-223-0x0000020550B20000-0x0000020550B86000-memory.dmp

Download

memory/5584-249-0x00007FF6D6630000-0x00007FF6D696F000-memory.dmp

Download

memory/5608-35-0x00007FF686AD0000-0x00007FF686B99000-memory.dmp

Download

memory/5608-123-0x00007FF686AD0000-0x00007FF686B99000-memory.dmp

Download

memory/5608-37-0x000002A086D90000-0x000002A086DF6000-memory.dmp

Download

memory/5608-36-0x000002A086D90000-0x000002A086DF6000-memory.dmp

Download

memory/5608-38-0x000002A086D90000-0x000002A086DF6000-memory.dmp

Download

memory/5624-46-0x0000029E43F70000-0x0000029E43FD6000-memory.dmp

Download

memory/5624-44-0x0000029E43DC0000-0x0000029E43E9C000-memory.dmp

Download

memory/5624-45-0x0000029E43F70000-0x0000029E43FD6000-memory.dmp

Download

memory/5712-7-0x0000000003A90000-0x0000000003AF9000-memory.dmp

Download

memory/5712-6-0x0000000003A90000-0x0000000003AF9000-memory.dmp

Download

memory/5712-1-0x0000000003A90000-0x0000000003AF9000-memory.dmp

Download

memory/5712-0-0x0000000003B40000-0x0000000003C5F000-memory.dmp

Download

memory/5720-112-0x00007FF686AD0000-0x00007FF686B99000-memory.dmp

Download

memory/5720-26-0x00007FF686AD0000-0x00007FF686B99000-memory.dmp

Download

memory/5720-29-0x000001D2A04F0000-0x000001D2A0556000-memory.dmp

Download

memory/5720-28-0x000001D2A04F0000-0x000001D2A0556000-memory.dmp

Download

memory/5720-27-0x000001D2A04F0000-0x000001D2A0556000-memory.dmp

Download

memory/5848-192-0x000001AF85DD0000-0x000001AF85E36000-memory.dmp

Download

memory/5848-244-0x00007FF762A10000-0x00007FF762EE1000-memory.dmp

Download

memory/5848-190-0x00007FF762A10000-0x00007FF762EE1000-memory.dmp

Download

memory/5848-191-0x000001AF85DD0000-0x000001AF85E36000-memory.dmp

Download