Overview

overview

8

Static

static

3

2026-08-27...op.exe

windows10-2004-x64

8

2026-08-27...op.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/08/2026, 18:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-27_4da86b0ac42c236bd9b488dc0ff1830f_darkgate_elex_rhadamanthys_stop.exe
  • Size 1.8MB
  • Sample260827-wm5slsysaw
  • SHA256 eb4fbd67333b98148bfc15d1ee0a343706b3f99694f472a9f860cecaaf0d778d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4da86b0ac42c236bd9b488dc0ff1830f_darkgate_elex_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4da86b0ac42c236bd9b488dc0ff1830f_darkgate_elex_rhadamanthys_stop.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
      2⤵
        PID:5212
      • C:\ProgramData\Adobe\ARM\S\5513\AdobeARMHelper.exe
        "C:\ProgramData\Adobe\ARM\S\5513\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\5513" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2300
        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\5513" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2004
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1736
    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      1⤵
      • Executes dropped EXE
      PID:4624
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
        PID:5040
      • C:\Windows\system32\fxssvc.exe
        C:\Windows\system32\fxssvc.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:4976
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:464
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        PID:5024
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:3384
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:2216
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:4288
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4608
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:4140
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1672
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:1776
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3356
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:4592
        • C:\Windows\System32\OpenSSH\ssh-agent.exe
          C:\Windows\System32\OpenSSH\ssh-agent.exe
          1⤵
          • Executes dropped EXE
          PID:3180
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:3768
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2176
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:3136
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2864
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5096
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:1060
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:316
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:2328
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 904
            2⤵
            • Modifies data under HKEY_USERS
            PID:3544

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 d838f4cbfb2743b9cc5865e6f4062fa8170f97f268f6850361f251bccd2f4c94
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 849KB
              • SHA256 b741904fe1a7a90999791a1d72588349574a5f8f21172af0ff41c0d708a038ef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.1MB
              • SHA256 6f459ab2758ccd16d9100e720e77be26ac73d3ff86a1363f3f63bbf251769c50
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 549ab1b43e071836f47a7b19f5252e95d24df5ebb4a744b182b1d974a8a5ae67
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.3MB
              • SHA256 96591154877bb118317e8f6114b0575e44fbc3c673db9cce6d82e90dc993f41f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 603KB
              • SHA256 3e1f601b3ce8e4c1ca48a1b16ebbdd9e5d47d9e44450c5ddde05722df5bd0829
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 863KB
              • SHA256 815e01c85a6c2b7366ea6d0d7316f2ce80254928332f440ab4364c87d3b35933
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.7MB
              • SHA256 51ed9c69f2de0049ff77f2add1f1037a500647260750a26705ae19c6e7f07b04
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 932KB
              • SHA256 7c734c280c600e333c75402c911cdb369a8282019bf186efb17e8091f8dc1a4c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 45720152544e0b76cd3a0a9dd2ac68ff2f005b911447eb01104fe0bce4fe64f1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 6af979dd543ec2817e734c92f020907d558456f298077e83f01867308899508f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 d29b480356ff3fb96a1decceffd105e1bd0b596044f018a934cfe45cc7ee7821
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 829KB
              • SHA256 29944c500eb19966e60b58024bc00428284d01d9a1291d5ac44cdefd32199885
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 679KB
              • SHA256 febe72fbd2c44df337a6cf512e5355f9c92a666c0c8dfa112866eff8024effea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 18bd28dfe7f0fb0d26f945aafa10faaa7bad023bcdd54eb1b4fc5185a0d43c97
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 59aa0ffe1c57c7cf062985c7d38c15a0c5bef256ae830af0e6a84307ee04246a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 83922569a7b64c3544c99123cb702e4245027a080089208cb72a7e699e82efdc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 fcdaa205227f762ecffceb2dcfa956c341743fe3d843726afc58e0ac1f8922c1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 722KB
              • SHA256 122fa1ed2f2b4f70579a5004b7f8ae9ec85431b0e1cf0c31bbea9f3153d7a51f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 102B
              • SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 1KB
              • SHA256 8332bc7a147f6bf4912cc1a92d6be1b4e71fc96fb842d123c4f3d0337986dd95
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.msi
              • Path C:\ProgramData\Adobe\ARM\S\5513\AdobeARM.msi
              • Size 1.0MB
              • SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARMHelper.exe
              • Path C:\ProgramData\Adobe\ARM\S\5513\AdobeARMHelper.exe
              • Size 413KB
              • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrManifest2.msi
              • Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
              • Size 18KB
              • SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 471B
              • SHA256 ac9e62618c7e7b4a2737437a8285c56cf173f64a98c2406362451ff9a1b44ca7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 727B
              • SHA256 61914701bd281b23e4cc02389a2378446ecde21f17cd56eba86b70f0292084fa
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 727B
              • SHA256 4d43b7824787b1201e3ea886ddc9c42541669be2c66f6a6436450ed4e46084ae
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 727B
              • SHA256 42c795ac457d598f973f5d4e902c8b408de120b2a898ee6259b5bd08ad5fc3fa
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 400B
              • SHA256 e3b80bf46f344d752c72e772a3b409fb3720bef9c4f720b94e531e8449c21527
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 404B
              • SHA256 30e365f01c55e46b894f41272fe36f41878e18eba9c0bc735cea6fffe5faad63
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 404B
              • SHA256 eb621d22a26a2b5ae1151ca0e3ad8fb00317ab5cb541b36f377004b7c94ef393
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 412B
              • SHA256 c91faf7c3edf9d5581800c3e63805ac820047b4e98ac48e24e1ae0b0b4115120
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 1KB
              • SHA256 170f649a40bf838916e674ee9ebf6e729e32d8afcd595c1c1f29799b21c34854
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 1KB
              • SHA256 55d9c28fdb3ec909f2de4651e9405bdbec08b32907faca0302db21353332254b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
              • Size 251KB
              • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp4C56.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp4C56.tmp
              • Size 5KB
              • SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp8942.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp8942.tmp
              • Size 5KB
              • SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp8A5C.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp8A5C.tmp
              • Size 3KB
              • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Tmp9133.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp9133.tmp
              • Size 5KB
              • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpBE23.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpBE23.tmp
              • Size 5KB
              • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrServicesUpdater2_x86.exe
              • Path C:\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
              • Size 846KB
              • SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 610KB
              • SHA256 7aff2defe1f7f1e1920152f120f55977140c83bcba54d86eba2e5fd1aa55ba3e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.8MB
              • SHA256 7f06e9a3267101fb136b1aa6845d1a5ba05f6366cdc46b62b828a12274f53941
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 681KB
              • SHA256 702f306b34b0a580918883d06a568e3224e7ac8d96f6b43d88d0d46617aa2c22
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 53e740c2e7ee2b3c607a0c4a88d0e236614f39d440deec6f17fe5c16126cfc98
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 600KB
              • SHA256 30d12e78e5ad5b3026da6e29fd78aacb8c5ee6723595f6d941541135348a009c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 963KB
              • SHA256 89bb4dd60a0ec617ed5ad50bf7d298e41fabb0afb028df1bc376e38d68f8d474
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 693KB
              • SHA256 fb5728f51a59c87d2be70e45307bdfc770c8a77f954e8616347cd95d9200b8b9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.5MB
              • SHA256 cb1cc27f5c2b93026d661177b54b2264c87051c6300ad2c8751232ea432cb0b8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 f9cf58a839f397fd216fe4b961ec7c06bb52ce10bbc348e75d72c08be4bf317e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 8303285309142a52a91daff82982ea51e0cb99dc0fc63c9b6db88950bb131c56
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 907KB
              • SHA256 42b4358b2186c2058d5cb6bf3c40024834381140a4429eb80eddcaff54708eba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 e9f3647dfa790a90c86fc1ffba7c2e87a933b6f705abd40c377067f75148fc53
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 682KB
              • SHA256 2d19ae759e8f180b4c4e3f305a63036b99531aaa95beba3849b845c448a0ef39
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 734KB
              • SHA256 d2812e48b8e7d3173f7640ce9b235b7521d1a6a3396f640c6dab393a20a7cb96
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 605KB
              • SHA256 81a21df5efbf2d74011fd1a072602955d786a9051f21aae0f38060d0ca861d17
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 82f2a7a9c5d7a495b25b340deb277fda26a5dee40a0cf809506126686481f38b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 794KB
              • SHA256 fcfd660e79521910dbaf88861ff363ce51f53b78f7be2da28a377445cf3f3f6f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 97e26757e74a8d4dfb5dfc3af3fe500c2ea525624f4bbd7db79ba11a6b58705c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 2a7a5c221607fd4d4b1a9f9df09e1c0b01a45ac1f6a0b6e9476875fc4987e3a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 899KB
              • SHA256 f060ca1fbf4cd5656ca626990bbb1d5a212dc0f44ea2b11d519e7630c5f4f68c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 657KB
              • SHA256 861898288078381665705ec9fccf5bfb5703292fcc702765b36009975ef8a7e4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/316-374-0x000002480D450000-0x000002480D458000-memory.dmp
              Download

              memory/316-324-0x00007FF609F90000-0x00007FF60A2E4000-memory.dmp
              Download

              memory/316-325-0x0000024802760000-0x00000248027C6000-memory.dmp
              Download

              memory/316-323-0x0000024802760000-0x00000248027C6000-memory.dmp
              Download

              memory/316-345-0x00000248039E0000-0x00000248039F0000-memory.dmp
              Download

              memory/316-329-0x00000248037B0000-0x00000248037C0000-memory.dmp
              Download

              memory/316-361-0x000002480BDA0000-0x000002480BDA8000-memory.dmp
              Download

              memory/316-377-0x00007FF609F90000-0x00007FF60A2E4000-memory.dmp
              Download

              memory/464-142-0x000001B130F00000-0x000001B130F66000-memory.dmp
              Download

              memory/464-140-0x000001B130F00000-0x000001B130F66000-memory.dmp
              Download

              memory/464-139-0x000001B130CD0000-0x000001B130DD2000-memory.dmp
              Download

              memory/856-7-0x00000000031B0000-0x0000000003219000-memory.dmp
              Download

              memory/856-0-0x0000000002F90000-0x0000000003074000-memory.dmp
              Download

              memory/856-2-0x00000000031B0000-0x0000000003219000-memory.dmp
              Download

              memory/1060-376-0x00007FF6F2DF0000-0x00007FF6F2F2B000-memory.dmp
              Download

              memory/1060-316-0x00007FF6F2DF0000-0x00007FF6F2F2B000-memory.dmp
              Download

              memory/1060-314-0x000001D0A9AF0000-0x000001D0A9B56000-memory.dmp
              Download

              memory/1060-313-0x000001D0A9AF0000-0x000001D0A9B56000-memory.dmp
              Download

              memory/1672-211-0x000001D0E6920000-0x000001D0E6986000-memory.dmp
              Download

              memory/1672-267-0x00007FF783660000-0x00007FF783ACD000-memory.dmp
              Download

              memory/1672-309-0x00007FF783660000-0x00007FF783ACD000-memory.dmp
              Download

              memory/1672-307-0x000001D0E6920000-0x000001D0E6986000-memory.dmp
              Download

              memory/1672-210-0x00007FF783660000-0x00007FF783ACD000-memory.dmp
              Download

              memory/1672-209-0x000001D0E6920000-0x000001D0E6986000-memory.dmp
              Download

              memory/1736-15-0x00007FF751450000-0x00007FF751537000-memory.dmp
              Download

              memory/1736-149-0x00007FF751450000-0x00007FF751537000-memory.dmp
              Download

              memory/1736-18-0x00000297B7AC0000-0x00000297B7B26000-memory.dmp
              Download

              memory/1736-16-0x00000297B7AC0000-0x00000297B7B26000-memory.dmp
              Download

              memory/1736-17-0x00000297B7AC0000-0x00000297B7B26000-memory.dmp
              Download

              memory/1776-220-0x000001E6153C0000-0x000001E615426000-memory.dmp
              Download

              memory/1776-219-0x00007FF774BC0000-0x00007FF774C6B000-memory.dmp
              Download

              memory/1776-291-0x00007FF774BC0000-0x00007FF774C6B000-memory.dmp
              Download

              memory/1776-218-0x000001E6153C0000-0x000001E615426000-memory.dmp
              Download

              memory/2176-259-0x00007FF63EDE0000-0x00007FF63F209000-memory.dmp
              Download

              memory/2176-255-0x0000023983D60000-0x0000023983DC6000-memory.dmp
              Download

              memory/2176-254-0x0000023983D60000-0x0000023983DC6000-memory.dmp
              Download

              memory/2176-262-0x00007FF63EDE0000-0x00007FF63F209000-memory.dmp
              Download

              memory/2176-260-0x0000023983D60000-0x0000023983DC6000-memory.dmp
              Download

              memory/2216-174-0x0000013524840000-0x00000135248A6000-memory.dmp
              Download

              memory/2216-173-0x0000013524840000-0x00000135248A6000-memory.dmp
              Download

              memory/2216-172-0x0000013524660000-0x0000013524762000-memory.dmp
              Download

              memory/2492-128-0x00007FF65FF80000-0x00007FF660208000-memory.dmp
              Download

              memory/2492-120-0x00007FF65FF80000-0x00007FF660208000-memory.dmp
              Download

              memory/2492-121-0x000002006C980000-0x000002006C9E6000-memory.dmp
              Download

              memory/2492-122-0x000002006C980000-0x000002006C9E6000-memory.dmp
              Download

              memory/2492-126-0x000002006C980000-0x000002006C9E6000-memory.dmp
              Download

              memory/2864-294-0x00007FF6D41D0000-0x00007FF6D46AD000-memory.dmp
              Download

              memory/2864-292-0x00000293AB630000-0x00000293AB696000-memory.dmp
              Download

              memory/2864-293-0x00000293AB630000-0x00000293AB696000-memory.dmp
              Download

              memory/2864-370-0x00007FF6D41D0000-0x00007FF6D46AD000-memory.dmp
              Download

              memory/3136-367-0x00007FF68A730000-0x00007FF68A9EE000-memory.dmp
              Download

              memory/3136-266-0x00007FF68A730000-0x00007FF68A9EE000-memory.dmp
              Download

              memory/3180-236-0x000001CA0D3B0000-0x000001CA0D416000-memory.dmp
              Download

              memory/3180-310-0x00007FF689040000-0x00007FF68922F000-memory.dmp
              Download

              memory/3180-237-0x000001CA0D3B0000-0x000001CA0D416000-memory.dmp
              Download

              memory/3180-235-0x00007FF689040000-0x00007FF68922F000-memory.dmp
              Download

              memory/3356-300-0x00007FF693080000-0x00007FF6933A4000-memory.dmp
              Download

              memory/3356-228-0x00007FF693080000-0x00007FF6933A4000-memory.dmp
              Download

              memory/3356-226-0x000001F735230000-0x000001F735296000-memory.dmp
              Download

              memory/3356-227-0x000001F735230000-0x000001F735296000-memory.dmp
              Download

              memory/3384-161-0x00000229F79C0000-0x00000229F7A26000-memory.dmp
              Download

              memory/3384-162-0x00000229F79C0000-0x00000229F7A26000-memory.dmp
              Download

              memory/3384-243-0x00007FF7248E0000-0x00007FF7249F4000-memory.dmp
              Download

              memory/3384-160-0x00007FF7248E0000-0x00007FF7249F4000-memory.dmp
              Download

              memory/3544-576-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3544-574-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3544-573-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3544-572-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3544-571-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3544-578-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3544-577-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3544-575-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3544-569-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3544-570-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3544-568-0x0000018B6C8D0000-0x0000018B6C8E0000-memory.dmp
              Download

              memory/3768-244-0x00007FF7DFF30000-0x00007FF7E00BF000-memory.dmp
              Download

              memory/3768-315-0x00007FF7DFF30000-0x00007FF7E00BF000-memory.dmp
              Download

              memory/3768-246-0x00000197022F0000-0x0000019702356000-memory.dmp
              Download

              memory/3768-245-0x00000197022F0000-0x0000019702356000-memory.dmp
              Download

              memory/4140-203-0x00000236E3530000-0x00000236E3596000-memory.dmp
              Download

              memory/4140-202-0x00000236E3530000-0x00000236E3596000-memory.dmp
              Download

              memory/4140-201-0x00007FF6ED350000-0x00007FF6ED3F8000-memory.dmp
              Download

              memory/4140-263-0x00007FF6ED350000-0x00007FF6ED3F8000-memory.dmp
              Download

              memory/4288-181-0x00007FF6C5E00000-0x00007FF6C5EEA000-memory.dmp
              Download

              memory/4288-250-0x00007FF6C5E00000-0x00007FF6C5EEA000-memory.dmp
              Download

              memory/4288-182-0x000002AA5D780000-0x000002AA5D7E6000-memory.dmp
              Download

              memory/4288-183-0x000002AA5D780000-0x000002AA5D7E6000-memory.dmp
              Download

              memory/4608-190-0x00000000008D0000-0x0000000000939000-memory.dmp
              Download

              memory/4608-189-0x0000000000400000-0x000000000054A000-memory.dmp
              Download

              memory/4608-253-0x0000000000400000-0x000000000054A000-memory.dmp
              Download

              memory/4608-195-0x00000000008D0000-0x0000000000939000-memory.dmp
              Download

              memory/4624-112-0x0000022471910000-0x0000022471976000-memory.dmp
              Download

              memory/4624-114-0x0000022471910000-0x0000022471976000-memory.dmp
              Download

              memory/4624-111-0x00007FF710280000-0x00007FF710364000-memory.dmp
              Download

              memory/4624-180-0x00007FF710280000-0x00007FF710364000-memory.dmp
              Download

              memory/4976-131-0x0000012D78D90000-0x0000012D78E92000-memory.dmp
              Download

              memory/4976-132-0x0000012D78FC0000-0x0000012D79026000-memory.dmp
              Download

              memory/4976-133-0x0000012D78FC0000-0x0000012D79026000-memory.dmp
              Download

              memory/5024-157-0x00007FF61A5A0000-0x00007FF61A708000-memory.dmp
              Download

              memory/5024-148-0x00000187EB500000-0x00000187EB566000-memory.dmp
              Download

              memory/5024-155-0x00007FF61A5A0000-0x00007FF61A708000-memory.dmp
              Download

              memory/5024-154-0x00000187EB500000-0x00000187EB566000-memory.dmp
              Download

              memory/5024-147-0x00000187EB500000-0x00000187EB566000-memory.dmp
              Download

              memory/5096-301-0x00007FF730D20000-0x00007FF73124B000-memory.dmp
              Download

              memory/5096-302-0x0000015089FC0000-0x000001508A026000-memory.dmp
              Download

              memory/5096-303-0x0000015089FC0000-0x000001508A026000-memory.dmp
              Download

              memory/5096-373-0x00007FF730D20000-0x00007FF73124B000-memory.dmp
              Download