0ad343dc95f3aa2faea1aad99da9f753f82f8752e5eae39fde7b24c08b48434b

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
Size 1.8MB
Sample260816-eg774scp21
SHA256 0ad343dc95f3aa2faea1aad99da9f753f82f8752e5eae39fde7b24c08b48434b
MD5 ad19bb217fe42fbff4fbe0b24bba3834
SHA1 922d6de427862b2599e06086b267a794e0f06108
SHA512 c3d250a7eea874e5b9d1680736700aa41b6561754dedd1ae8bd16bd5d031d8cdac3eb9efafec01f582ba2fecca6eb4671c6709535f48dfcbff875ba8a7c09b4e
SSDEEP 49152:JNZCWOLT4fXGBhm1K2MtENUJ2yRdBcEwg:XwnLTMGBBBRdJX
TLSH
T1BB856B0667F95129F1F33B71EEB992645A77BC71AE3AC50E6280025E0DB4E50DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2780	alg.exe
6140	GameInputSvc.exe
6064	GameInputSvc.exe
4356	elevation_service.exe
1884	elevation_service.exe
3496	maintenanceservice.exe
1664	msdtc.exe
2228	OSE.EXE
4232	PerceptionSimulationService.exe
3976	perfhost.exe
5964	ReFsDedupSvc.exe
4516	locator.exe
6128	SensorDataService.exe
5008	snmptrap.exe
4912	ssh-agent.exe
1320	TieringEngineService.exe
3540	AgentService.exe
4884	vds.exe
1236	vssvc.exe
1812	wbengine.exe
4352	WmiApSrv.exe
2300	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e33986eb238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9fe6c3e332ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c01d333e332ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ad48a41332ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aed09d3c332ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090486a3d332ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
6064	GameInputSvc.exe
6064	GameInputSvc.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
Token: SeTcbPrivilege	6140	GameInputSvc.exe
Token: SeBackupPrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1320	TieringEngineService.exe
Token: SeManageVolumePrivilege	1320	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3540	AgentService.exe
Token: SeBackupPrivilege	1236	vssvc.exe
Token: SeRestorePrivilege	1236	vssvc.exe
Token: SeAuditPrivilege	1236	vssvc.exe
Token: SeBackupPrivilege	1812	wbengine.exe
Token: SeRestorePrivilege	1812	wbengine.exe
Token: SeSecurityPrivilege	1812	wbengine.exe
Token: 33	2300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2300	SearchIndexer.exe
Token: SeDebugPrivilege	3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3780	2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 6064	6140	GameInputSvc.exe	93
PID 2300 wrote to memory of 2076	2300	SearchIndexer.exe	115
PID 2300 wrote to memory of 1292	2300	SearchIndexer.exe	116
PID 2300 wrote to memory of 3584	2300	SearchIndexer.exe	117
PID 2300 wrote to memory of 2528	2300	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_ad19bb217fe42fbff4fbe0b24bba3834_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3780

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2780

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:6064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1884

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3496

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1664

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2228

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4232

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3976

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5964

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4516

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6128

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5008

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2928 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2956 2976 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09f58bb9768c9cbfd470ad93b552559f72f08b131b592a378c8453a591089c84
MD5 fda0987cc0532a14580fa00ea7e92a5a
SHA1 2a2df105f320dddfecdc926f5207fe90fe6d2585
SHA512 ad602cceb236b319e78d65a1c7ec44f4c6dbb8c88b8f3fb19921793036ccca25d759f6ad1bbe67558e4e1db812f73f248f9d3c467a9e7c2212c676387b482572
SSDEEP 49152:FAo632BuPkFKRrdE6oh7stBhuXjfS4LWxnxJ2yRdBcEwg:u3q6gjBERdJX
TLSH
T1F7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 4d846699bd0628aad625d95c24e033fc863f1fd02c9efe05125073f685e01481
MD5 89b45388b3bed62ac4abd3a9e968e7dd
SHA1 a55825d1a1168129a829aaebdd3ce5b8b652db4a
SHA512 734c0f7bbce91056580474f204fa1c77b32dce73f04eca92255400f510cde4522e5575f5736a9db86a4a2929f26d6e06364172587ab693ec09cfb73f00b97a96
SSDEEP 24576:YXYGFTczAn2uw1XPqs++IBY981aJHA11:6TcCJ2yRdBcEwg
TLSH
T1ED050229B3E508F9EC67823DCC628911EA73785147A0E7DF03E4897A5F336981E3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 a135ab2a20079b88808e1e6815a856bbab529c98e71735f17f27969b9a8e2dfa
MD5 e05c6c6648307be9d9e9d48ce44b4541
SHA1 306880ebef2c8d9496dc521db9520e2e9f9d1cd3
SHA512 65f3ce4fa3f7bd47446be78331a2f1ac8082cbc1f1078eafe5dfb7771c4f6e1e588f5b0741d498f557a0a81d2d6b023b344df3ce7059cc5e6f48310aa515b636
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CW2uwVcy5XP8E7YRns++I7VH498zJTfbaJGpezA11T:QwuuOWV2uw1XPqs++IBY981aJHA11
TLSH
T1E405014A72A51CF9E9678239C9579536F7F3BC022A31D71F1760C65B6F332206D2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0be782a90b2252468dd990b6ef9bde5c222b15c0d065231b40e15fd13040fa36
MD5 f3e45bfe9de47d5b44dad44637958650
SHA1 a3e1c605eaffc26636504f7254bd594da89bee45
SHA512 b0ee44990d5f602f2ec3c6a961e1edb4959bf131549f607bed54f17642581452a81fef3c62978c14f642179028c6899f78e42b5bc4f6a7c95b921c73bb3b8df3
SSDEEP 49152:5N+taZ3usBWOBr4tEGp0bqx0z+n217aau1glSJ2yRdBcEwg:zu6JmTxd2dURdJX
TLSH
T1CCD59D13F1DA01E8D05ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 e7871f1ee70691c6afb4a609468bf5bbc0680a991c832088bf9fa45d951c062c
MD5 fd98e87241d7029fffdf796545a179c0
SHA1 c0a65648fe78d26f5a0d902a5d34170b4dd85ee7
SHA512 c0304a23cc9bc838f9393d93b5c3e76f0305273dfde338d1750b011a0cdaa6e54196cd4dbe77096af9f3babbe107734c61a32d1d12b2e818c3a5d0cf1f6623be
SSDEEP 12288:sO7p2uwVcy5XP8E7YRns++I7VH498zJTfbaJGpezA11T:3p2uw1XPqs++IBY981aJHA11
TLSH
T119D4235BF12BB8D7F86593795C1B6C3099EA3B221F60C0DBF659046EEDB18501A3231E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d422439df29dd3ee0bcded11b897da2e26b5e92208c7715b056161a1ce768d9a
MD5 17adb1310d0b0720d12423e5d5e67ffe
SHA1 1fb437e95320271db70278ae575b76029289cd4c
SHA512 517a346f4e2f5b847a5567c8b359e1a6394ff05daa75b50a67ab276a72d1971c25b62575576cfecf510af2cf31e9a7bb03fdca35659102a0b99fc2886e0dd377
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bY62uw1XPqs++IBY981aJHA11:mgb4mBIBhGFdJ2yRdBcEwg
TLSH
T11E65AE1E22EC02F5E0F9D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 7f7b1b47220abe0a5c3d754834c2a61c817f258b072bf2afa6745782535cb200
MD5 92d5ad6b3841025ce35d636e783c1240
SHA1 cf272991986fd053b76a7c656852ba5ea2886643
SHA512 f9a80e483f08e0eaf784e13980b2cfe9791c0b38281404f59a10bcf0c647ab58164cf98bda2afc67343c85d9d541c08eb03747c0692c7c7f122b39ee3ded6367
SSDEEP 12288:TFrGeR2uwVcy5XP8E7YRns++I7VH498zJTfbaJGpezA11T:JGeR2uw1XPqs++IBY981aJHA11
TLSH
T13AE4122FB0B774E5E839C33A9C276861B9F236611F2491FF56E4443ADFA18E02231659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 6a76814d902fb5d1c2abd40c98baf62db981ccc7d089a39f8f4102a7b6dc85e6
MD5 6af57f89ce4b8d7723c7546d11cd658f
SHA1 8efa5916bca6fbb0175ac28eefab6c2f7cf91b4d
SHA512 1d76c6ead996083b186df0e3c8b081d619299a9e2caa0b54ced97373836e120fa9804b040fe6dddf7653c7199c9e7ec98a8f8fd84311c72c72a47e98f5e46c5d
SSDEEP 12288:ZjF2uwVcy5XP8E7YRns++I7VH498zJTfbaJGpezA11T:hF2uw1XPqs++IBY981aJHA11
TLSH
T1F2D4235FB02BB8D6F955833E9D173C209DE52B121FA581EBB699042EDEF28D0123235D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4f42d364f99ee91a75d0e11a28ebd57850ab9a84d7f9f0370512adc875b11acf
MD5 a40a5ae78e42123a144508edb69a9f05
SHA1 bfd475c2294fc1527ff01126d5ead793ffb6c90d
SHA512 ce207e3626c9c509929394d7e5ed30e0a15502a20c05f5a5f081cb89ebfc3eaa08a913d6f52cee71ab0e7373b4efc8ba21856d489cf2339e8dca072f3f5d3793
SSDEEP 24576:hks8u8FpJqH1sKr7a7/mv2uw1XPqs++IBY981aJHA11:2LZFPqV7a7/AJ2yRdBcEwg
TLSH
T1FA35F166B6E101F1D47BD13889474A63F6B2B4250374EBDF07AC8A551F23AE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 984b79dc42a5a69cbb866d4eea8d749a16e9ad33ef2889dd6d9bb1185d9e8976
MD5 9fcecc95f549a18027924cf37d0e572c
SHA1 87081c8fc870f647e577712c4572f1d216ed8212
SHA512 69e557fc3146d1e0ae7af93ae75da1fa7ee7af7f36931b6d56e9c8ee794c4ab23e6f513bac36b43e775737be04dfb2c3efd728875c68178b63c7c8fbc506b8bf
SSDEEP 12288:a5HvUrBFrEjwaQe2uwVcy5XP8E7YRns++I7VH498zJTfbaJGpezA11T:OPUr+NQe2uw1XPqs++IBY981aJHA11
TLSH
T13405F12F62AD28E5F676E17D89434619E7B278620712D2CF02E0817E4F63DE87D3A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 e098ee757831591b254d0c3b5cfdc2b744f6b607278cee9a1262afb5783dc18f
MD5 710367ae70dcaea8697cd75edf66915c
SHA1 5dca94b5b01e509835323127b14e70f1e65943d9
SHA512 b5b3d299c158fa9909c6227d8c266a1d0b430241529633bffcb49d286758ddbc37fbb93bd21570e48cf90acb703060342f852f47719bcc1e73d44259a4f24b7d
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkJ2yRdBcEwg:KG05lO43bnRdJX
TLSH
T1CDD5CF6E62EC11F9D0BBD17CDA864A0BEBB23815033556CF02A486A91F27FF4567E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 577a69e4a1c59dfe8199a754e4f76f67c563b8d0b23876d8cc2a111e0404fc4a
MD5 53a47f95686e675deba05c73b075159a
SHA1 efb5f0f157b50df3ebcdb4b2a1a795a2efa455fa
SHA512 e40ee024f8f0e0543ebfb1a7e1a517c66bd749b637b7d94682a89c4e2a071662d0005da0c32b942de697c0b80e554f82f95f521aa2a627adbe377404e1047d92
SSDEEP 24576:FEa5POZ3dpbWVM50JicR2hG0lasx2+47eidnc2uw1XPqs++IBY981aJHA11:ua5POZ3wJt2pasx2+muJ2yRdBcEwg
TLSH
T13A65BF5EA6FC00D5E5B9D17DC5834A1AE5B1342253329BCF122182BE3F27EE85E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 832982dbcb948d30ae4a806305befa486757673c0332b2e944d8bf8ccbe15b0d
MD5 05018627b78406be081b849de88620b3
SHA1 ef0dac00dc9d29ded4b6f3a3c2be04b641cf45dd
SHA512 f3e926f33de1b3fa7195dbe9c5f27d8bd41460fb58e82f899d9f8a701a034a8f8d28a7afcbcfdd0f44f608516a25f609207e7ce67a42867e95f1348f3b90fca7
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkP2uw1XPqs++IBY981aJHA11:VNc/zEOVHFcJ2yRdBcEwg
TLSH
T16D858C1622E901E4F5BBE1BE89779946FAB17865173086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 c0c6c29fe82e67f169a63bfe807b495c4521b6f4b9b6d12e8c1a844a19fc04d9
MD5 a99eec803d5217a4db570a841e99e62d
SHA1 6e8d61a407bd8f560c8869b3293640d6f16500f4
SHA512 5d33d3cf9d860b5ac699ad280e060053cea0795f92c0b479db4de4da6162a5dd4479250491eff0acc96f282eaac75a698b6b3aab6191114f3300f284f6feaff5
SSDEEP 24576:5JnJPbzB4SQ2uw1XPqs++IBY981aJHA11:5JnJv6SQJ2yRdBcEwg
TLSH
T1EC15E13DD2A820E8E4B7C2B4811A1A59FF71387D2F2169CB59B4D4353F52EE06A35F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a3bb8b907da7cde36f3a6adaf2e7ba1fde6acb7a8adf3838cceff0270a501b11
MD5 76eed09934dc6ed9ec83995711014160
SHA1 ebf6a341ccb55d18d93e51b8797c787c7b392dbf
SHA512 a26e28378fbaaa60bd5c63400e815385b4a277983b557a64985bc7670b63eb2d3ca3f3ff92ce4f05fc0c0d38f71194418ade31762fc98a9a65ff902dc8701f1b
SSDEEP 24576:JCLHGL0MoeVtFumTijCmlKQWDkj2uw1XPqs++IBY981aJHA11:JCLHGeeV5ijCmlDWDkjJ2yRdBcEwg
TLSH
T188A56B05A7EB5184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 04a5a46776c17b5d96d0b88fb13af88d1e3e1b33f7db2f26ff6bd4739cce5904
MD5 72af7208e5a80cdb2edc737c42db309f
SHA1 27f36d57cfb54b611a67b37c0a348d7f2586e89d
SHA512 2a76d1050b616cc70d59272eac803e0d924aa8d7baac69a2cbde55dc85518dae0e945283deab92671fc4b03c8298626cb33c7700c86d9e75a85cc25d66d4eff1
SSDEEP 12288:pBWH+k6j5ZI7C2uwVcy5XP8E7YRns++I7VH498zJTfbaJGpezA11T:a6DIW2uw1XPqs++IBY981aJHA11
TLSH
T1B005015E737A20F6E06BD03EC5430811D6F2B5718B2256DF4798847E8FA3ED87939A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 ac43dfc7428decba6e11f450c59ba4947d4b8cfbb07e12813a3dcb17519dd2c1
MD5 0d3bc13e07a1b8ac6951e28b67a70642
SHA1 6ae718a5b6248e0607245bc78bc30d417ec62293
SHA512 0966771ffb7a3a0de568f9b697aed5fb0d9e0ec7f7b843f3303e7f527aff2339fa8b1ff6adae60a8ab4206dc26355c689b76707af560174b526335b531362aed
SSDEEP 12288:ZZG6kyd2uwVcy5XP8E7YRns++I7VH498zJTfbaJGpezA11T:Styd2uw1XPqs++IBY981aJHA11
TLSH
T141F4120BA3A970D5F9B94338DE2354A08EB57D215F2183EF66D0953F6F72AD0293131A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 4e7b74a0caed90954dd21750450aecddb7c35f7fc9e4a307077a66aa41d2e587
MD5 19e8e30c09cae452dd0dd1f6506df05d
SHA1 60b9b6938fc0f474d4e94ab12b9f7ede7e31a304
SHA512 5be8dfb6e5f4017ddbf72ac22e94d9ac0f20f9a119912d8111b78e8e6d883a051dd4be79cac3ac5522f7d149a1bcb2729ae03fbefdc71fd4acff96a1f959dbe0
SSDEEP 12288:gn5O2uwVcy5XP8E7YRns++I7VH498zJTfbaJGpezA11T:OO2uw1XPqs++IBY981aJHA11
TLSH
T11FD4235FB12B74E6F854937E99172D6095E63B221F6191EFB5E8083EDFB28D01232309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 7a1f94325d9681c8dabd52d528b98ed3a47e5e0605a4d55563f4f7e0676f39dc
MD5 571de60d3b2ec006aa84e8c2ea1c819e
SHA1 3641eacccbcd8bc79e45e5df8bde0c4002c23f9c
SHA512 ac3dcccd4ffe401bf15462f7f2424c5a522f9ec4dfb1e4695404c61834e719a84d4299adc32d5d46023140aa25b3570d9ba71ea91c170530889aa00608e2253a
SSDEEP 24576:OfgUwoTfaidZO2uw1XPqs++IBY981aJHA11:ogyTrZOJ2yRdBcEwg
TLSH
T171558D1DA3EA15CAE2B2D279D8631493D633B4315772D6DF2448C03A4DABED8AE70F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 f0729b764bb46d98573bd0b5d6625a9a5a5a5c033fe61899e205b6986f80c150
MD5 3b2a4e622ba2bc4c3d3150c1f1cac1f1
SHA1 c654e1f79d1abe43a150668495ecc5607edad1e5
SHA512 5609501ff33fe7597f9860b78a698e73c4cf6317b6e1ba5897b96a09c15b7eda5cc9c4605006db23af0d7a93ca6f31c84664a49f3fafb74514fedafbc24eca87
SSDEEP 12288:2qpJcm8CN/2uwVcy5XP8E7YRns++I7VH498zJTfbaJGpezA11T:brcmR/2uw1XPqs++IBY981aJHA11
TLSH
T16B05F05FB26E10E6E1B7C23C8C424915E6B374312762A3DF42A1877E8E679E93E31711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 deab131e7512933fae4bf9d901a8f9659c0f15566ed2201edeccfc79a937a4c8
MD5 aa9bedabee0bec24732edefa7be166db
SHA1 5c8bc0239e4c192d60d24bd56f0f88ad9a129bb7
SHA512 e03bfb652e6e05494c95f14cec432164a65568f8868fc494e8d2a514d0e66d1d15e04749e696f6ee64d77d3226a80e402c3901a60f5246745cd3764b12fbb16f
SSDEEP 49152:aDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3EJ2yRdBcEwg:b3Upow8sBzRdJX
TLSH
T198A58C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-277-0x000001FE2CBA0000-0x000001FE2CC06000-memory.dmp

Download

memory/1236-329-0x00007FF683370000-0x00007FF683841000-memory.dmp

Download

memory/1236-282-0x00007FF683370000-0x00007FF683841000-memory.dmp

Download

memory/1236-278-0x000001FE2CBA0000-0x000001FE2CC06000-memory.dmp

Download

memory/1320-250-0x00000245F6990000-0x00000245F69F6000-memory.dmp

Download

memory/1320-248-0x00000245F6990000-0x00000245F69F6000-memory.dmp

Download

memory/1320-249-0x00007FF7575C0000-0x00007FF757755000-memory.dmp

Download

memory/1320-306-0x00007FF7575C0000-0x00007FF757755000-memory.dmp

Download

memory/1664-159-0x00007FF6F8C40000-0x00007FF6F8D5A000-memory.dmp

Download

memory/1664-218-0x00007FF6F8C40000-0x00007FF6F8D5A000-memory.dmp

Download

memory/1664-161-0x00000141410D0000-0x0000014141136000-memory.dmp

Download

memory/1664-160-0x00000141410D0000-0x0000014141136000-memory.dmp

Download

memory/1812-286-0x00007FF66A210000-0x00007FF66A717000-memory.dmp

Download

memory/1812-288-0x000001D5B5A10000-0x000001D5B5A76000-memory.dmp

Download

memory/1812-287-0x000001D5B5A10000-0x000001D5B5A76000-memory.dmp

Download

memory/1812-331-0x00007FF66A210000-0x00007FF66A717000-memory.dmp

Download

memory/1884-138-0x0000024EDC8D0000-0x0000024EDC983000-memory.dmp

Download

memory/1884-140-0x0000024EDCAB0000-0x0000024EDCB16000-memory.dmp

Download

memory/1884-139-0x0000024EDCAB0000-0x0000024EDCB16000-memory.dmp

Download

memory/2228-172-0x0000012C3F220000-0x0000012C3F286000-memory.dmp

Download

memory/2228-173-0x0000012C3F220000-0x0000012C3F286000-memory.dmp

Download

memory/2228-171-0x0000012C3F040000-0x0000012C3F0F3000-memory.dmp

Download

memory/2300-307-0x00007FF7D8010000-0x00007FF7D834F000-memory.dmp

Download

memory/2300-309-0x00000175283D0000-0x0000017528436000-memory.dmp

Download

memory/2300-308-0x00000175283D0000-0x0000017528436000-memory.dmp

Download

memory/2300-335-0x00007FF7D8010000-0x00007FF7D834F000-memory.dmp

Download

memory/2780-135-0x00007FF757000000-0x00007FF757123000-memory.dmp

Download

memory/2780-17-0x000001AA7B430000-0x000001AA7B496000-memory.dmp

Download

memory/2780-18-0x000001AA7B430000-0x000001AA7B496000-memory.dmp

Download

memory/2780-16-0x000001AA7B430000-0x000001AA7B496000-memory.dmp

Download

memory/2780-15-0x00007FF757000000-0x00007FF757123000-memory.dmp

Download

memory/3496-148-0x000001D0579B0000-0x000001D057A16000-memory.dmp

Download

memory/3496-149-0x000001D0579B0000-0x000001D057A16000-memory.dmp

Download

memory/3496-147-0x00007FF617560000-0x00007FF6176C8000-memory.dmp

Download

memory/3496-156-0x00007FF617560000-0x00007FF6176C8000-memory.dmp

Download

memory/3496-154-0x000001D0579B0000-0x000001D057A16000-memory.dmp

Download

memory/3540-266-0x00007FF680C80000-0x00007FF680FA1000-memory.dmp

Download

memory/3540-264-0x0000019CBA1D0000-0x0000019CBA236000-memory.dmp

Download

memory/3540-260-0x0000019CBA1D0000-0x0000019CBA236000-memory.dmp

Download

memory/3540-259-0x0000019CBA1D0000-0x0000019CBA236000-memory.dmp

Download

memory/3540-258-0x00007FF680C80000-0x00007FF680FA1000-memory.dmp

Download

memory/3780-1-0x0000000002C90000-0x0000000002CF9000-memory.dmp

Download

memory/3780-7-0x0000000002C90000-0x0000000002CF9000-memory.dmp

Download

memory/3780-0-0x00000000029F0000-0x0000000002AFB000-memory.dmp

Download

memory/3976-195-0x0000000000740000-0x00000000007A9000-memory.dmp

Download

memory/3976-189-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3976-190-0x0000000000740000-0x00000000007A9000-memory.dmp

Download

memory/3976-239-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4232-182-0x000001AD382B0000-0x000001AD38316000-memory.dmp

Download

memory/4232-183-0x000001AD382B0000-0x000001AD38316000-memory.dmp

Download

memory/4232-180-0x00007FF712E30000-0x00007FF712F7A000-memory.dmp

Download

memory/4232-229-0x00007FF712E30000-0x00007FF712F7A000-memory.dmp

Download

memory/4352-297-0x00007FF655540000-0x00007FF65566F000-memory.dmp

Download

memory/4352-298-0x000001DEDC760000-0x000001DEDC7C6000-memory.dmp

Download

memory/4352-299-0x000001DEDC760000-0x000001DEDC7C6000-memory.dmp

Download

memory/4352-334-0x00007FF655540000-0x00007FF65566F000-memory.dmp

Download

memory/4356-129-0x000001E1DBB10000-0x000001E1DBBC3000-memory.dmp

Download

memory/4356-131-0x000001E1DBD30000-0x000001E1DBD96000-memory.dmp

Download

memory/4356-130-0x000001E1DBD30000-0x000001E1DBD96000-memory.dmp

Download

memory/4516-257-0x00007FF6E92B0000-0x00007FF6E935E000-memory.dmp

Download

memory/4516-211-0x0000019CD4400000-0x0000019CD4466000-memory.dmp

Download

memory/4516-210-0x0000019CD4400000-0x0000019CD4466000-memory.dmp

Download

memory/4516-209-0x00007FF6E92B0000-0x00007FF6E935E000-memory.dmp

Download

memory/4884-269-0x00007FF7264E0000-0x00007FF72676B000-memory.dmp

Download

memory/4884-327-0x00007FF7264E0000-0x00007FF72676B000-memory.dmp

Download

memory/4884-271-0x0000020EE3E40000-0x0000020EE3EA6000-memory.dmp

Download

memory/4884-270-0x0000020EE3E40000-0x0000020EE3EA6000-memory.dmp

Download

memory/4912-296-0x00007FF6D1D60000-0x00007FF6D2003000-memory.dmp

Download

memory/4912-241-0x0000020D01200000-0x0000020D01266000-memory.dmp

Download

memory/4912-242-0x0000020D01200000-0x0000020D01266000-memory.dmp

Download

memory/4912-240-0x00007FF6D1D60000-0x00007FF6D2003000-memory.dmp

Download

memory/5008-231-0x00000163E4FC0000-0x00000163E5026000-memory.dmp

Download

memory/5008-230-0x00007FF6531A0000-0x00007FF653254000-memory.dmp

Download

memory/5008-294-0x00007FF6531A0000-0x00007FF653254000-memory.dmp

Download

memory/5008-232-0x00000163E4FC0000-0x00000163E5026000-memory.dmp

Download

memory/5964-336-0x00000201922A0000-0x0000020192306000-memory.dmp

Download

memory/5964-255-0x00007FF7DA170000-0x00007FF7DA8B4000-memory.dmp

Download

memory/5964-339-0x00007FF7DA170000-0x00007FF7DA8B4000-memory.dmp

Download

memory/5964-203-0x00000201922A0000-0x0000020192306000-memory.dmp

Download

memory/5964-202-0x00000201922A0000-0x0000020192306000-memory.dmp

Download

memory/5964-201-0x00007FF7DA170000-0x00007FF7DA8B4000-memory.dmp

Download

memory/6064-123-0x000001DCEEAF0000-0x000001DCEEB56000-memory.dmp

Download

memory/6064-177-0x00007FF7EB540000-0x00007FF7EB609000-memory.dmp

Download

memory/6064-120-0x00007FF7EB540000-0x00007FF7EB609000-memory.dmp

Download

memory/6064-121-0x000001DCEEAF0000-0x000001DCEEB56000-memory.dmp

Download

memory/6128-220-0x000001E3D5A40000-0x000001E3D5AA6000-memory.dmp

Download

memory/6128-314-0x000001E3D5A40000-0x000001E3D5AA6000-memory.dmp

Download

memory/6128-315-0x00007FF6F4B80000-0x00007FF6F4F97000-memory.dmp

Download

memory/6128-219-0x000001E3D5A40000-0x000001E3D5AA6000-memory.dmp

Download

memory/6128-221-0x00007FF6F4B80000-0x00007FF6F4F97000-memory.dmp

Download

memory/6128-285-0x00007FF6F4B80000-0x00007FF6F4F97000-memory.dmp

Download

memory/6140-113-0x000002938E7C0000-0x000002938E826000-memory.dmp

Download

memory/6140-112-0x000002938E7C0000-0x000002938E826000-memory.dmp

Download

memory/6140-111-0x00007FF7EB540000-0x00007FF7EB609000-memory.dmp

Download

memory/6140-114-0x000002938E7C0000-0x000002938E826000-memory.dmp

Download

memory/6140-146-0x00007FF7EB540000-0x00007FF7EB609000-memory.dmp

Download