6c9c88aa1b0c9d34653dd96989bc62908be701aeedb0b31933618ec455917dfd

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Size 3.3MB
Sample260930-sax1fstyhx
SHA256 6c9c88aa1b0c9d34653dd96989bc62908be701aeedb0b31933618ec455917dfd
MD5 f5ee0bee0bbe4ec923a7d3864317d681
SHA1 411c46779e5f91df7941a97cac46f6cd60b26f4f
SHA512 b1dc44d1997faa6fd7b7d9fbb453985d177503aa4cf160965c4e7059a395d7831709c10c6569b854d8c271326a2c4944f342377eecbc2272521ce730241c4a8a
SSDEEP 49152:YZOATAK7IjnDreNwL934vsDEuJUNliAceq58uCiqHUzj23P22h0jpIMlXn:YZ9TWDreQDEuJU9mGjic61
TLSH
T1BFF5AF317701C4B6D95202B0ADBDEA5F816DBD218F7414C7B3D82F6E55B19C22B32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1620	alg.exe
2816	GameInputSvc.exe
4880	GameInputSvc.exe
5624	elevation_service.exe
4636	elevation_service.exe
3244	maintenanceservice.exe
5620	msdtc.exe
1580	OSE.EXE
5032	PerceptionSimulationService.exe
5544	perfhost.exe
1736	ReFsDedupSvc.exe
2572	locator.exe
4964	SensorDataService.exe
1184	snmptrap.exe
3692	ssh-agent.exe
5360	TieringEngineService.exe
4072	AgentService.exe
2936	vds.exe
5792	vssvc.exe
3332	wbengine.exe
3872	WmiApSrv.exe
3152	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
	\??\F:\	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c23933ebb68fd3f0.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b271b9eeeb50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009dfa2eeeb50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000975834efeb50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065ddfef0eb50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007a67af0eb50dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4880	GameInputSvc.exe
4880	GameInputSvc.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTakeOwnershipPrivilege	2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTcbPrivilege	2816	GameInputSvc.exe
Token: SeBackupPrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5360	TieringEngineService.exe
Token: SeManageVolumePrivilege	5360	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4072	AgentService.exe
Token: SeBackupPrivilege	5792	vssvc.exe
Token: SeRestorePrivilege	5792	vssvc.exe
Token: SeAuditPrivilege	5792	vssvc.exe
Token: SeBackupPrivilege	3332	wbengine.exe
Token: SeRestorePrivilege	3332	wbengine.exe
Token: SeSecurityPrivilege	3332	wbengine.exe
Token: 33	3152	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3152	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3152	SearchIndexer.exe
Token: SeDebugPrivilege	2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	2892	2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4880	2816	GameInputSvc.exe	90
PID 3152 wrote to memory of 5320	3152	SearchIndexer.exe	112
PID 3152 wrote to memory of 1164	3152	SearchIndexer.exe	113
PID 3152 wrote to memory of 5768	3152	SearchIndexer.exe	114
PID 3152 wrote to memory of 3760	3152	SearchIndexer.exe	115
PID 3152 wrote to memory of 2368	3152	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1620

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4636

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3244

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1580

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5032

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2572

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4964

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1184

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3872

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2860 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2916 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8a8012203ddfa8c0b2f20967d78a9dec721d5325c7878e1906df60c1b1c05648
MD5 a0fa68316213117be513c38bbb892e09
SHA1 241daf8e356aa94ddff494c6b09bea20a8d5f9f4
SHA512 d8a323a8226d9e5784a93c447a15b1fb0be152a5fabdd60634d19814c8e2c9be39e73a2304a385a7633272d2356308a603ebb2a5bdea55ad957adab7b0f1569a
SSDEEP 49152:FePi32BuPkFKRrdE6oh7stBhuXjfS4LWxnUh0jpIMlXn:R3q6gjBz61
TLSH
T168D59D03F29900E9E069D178D7469133E9A2BC890B34B6DF0790B7562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 22f68ac828846a2f38b07d30d5e3d71cc9ddb9e5ce8c786aac2d23e5a0d3c79d
MD5 1a9ec0fad6d94b9a9b701ebbcbd9e5c6
SHA1 5847fef8a378edd904d56e5f6244adbb0bd04743
SHA512 1b0efe7ecec25b4722a662e0bf55256237246b9fa17e60e63562adf7b8a460c0a288631acd6708961cd015aceee4d8d88675e1941d1df9bc9f7931bb315928bf
SSDEEP 12288:L1XLsGBWkxyMFwyWczA44JzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:xXYQDsczA9KOW0jxuBIRIMKsLPPn
TLSH
T10205F13877D049F9ED77413DC8A28511EA7378914760EB9B03B4D6361E233989E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 cf99062530ab6f7395b751e906fb9c1b5df6da65693278dbfb02f1da189ccbb7
MD5 92a0dbd7136153f5b7922ff5d0203557
SHA1 1a2fcc05736b1b20ec351b295e408ec1f94a3f10
SHA512 d3e6f751f333b0630ab384f87a0d82f6a4d973a1c60cd1209f9fbc943af6e46f632168472ba0fe09532ededdaa2354d9514d340c617413689b0654e99bfe9cc3
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CizXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPPn:QwuuOW3KOW0jxuBIRIMKsLPPn
TLSH
T1DF05F15576946CF9E9B74139C587C136EBF2BC122A20CB1F0370C66B6F27361AE19B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cdbe15cadad327ae2ba3307074b5c5e257a39600aeabb7b0e2e59a62dca60acd
MD5 04cfcc58586faf55dcf294c07ad42e9b
SHA1 3e54016ad49e026b4118e8938d009e4b2f070636
SHA512 39b9eca1d987e864b8fdaa6d8c1c2d20aa12edab2324edcb630652b860aff39896677fd368470f59343081c30859fe851637340ec84abf69170993f28eadcb78
SSDEEP 49152:zw+taZ3usBWOBr4tEGp0bqx0z+n217aau1glIh0jpIMlXn:Yu6JmTxd2dc61
TLSH
T109D59E13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 611KB
SHA256 446c16914c84602b4c50fcc22c8e8fd2aa79179db343f26b4088706784eddca4
MD5 369db6b7072debae79eaf5c2e84837ae
SHA1 dba441acdffc87d6cf9295aa0284559d2a6f014c
SHA512 b8a564645bcc9c802ca49063293a1f0d1c804e30f39fd17e7c17224bfef1c4cf44a78cf77206f0d1ad63065b144d627284777eeede7ac1d897a4668329bf420c
SSDEEP 12288:Id79zXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:49KOW0jxuBIRIMKsLPPn
TLSH
T192D42371A948FF6EFA791074A087A3249D7A78A5AF00C8DB5035D27B38947C4EE00E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 35c5b16d9c494a60a93fe8dadeceb5b31a902861dde413697a8969d2bbe59a83
MD5 62db9e230570bf488fd43ebf15a203b3
SHA1 fe780be11c81c9368433e6a4d4e69a143ebd078e
SHA512 cb8d92c20578ca22ee0c354315b5d23d1ca19b60b4d85389c4296ee98074a5966e65be62bada4fb7c1c17bb5106ea7f98531cd3c53d3ab3af9367ecbc06b8f26
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYdKOW0jxuBIRIMKsLPPn:0gb4mBIBhGFhh0jpIMlXn
TLSH
T18665AE1E22E802F5E0FAD2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 f36fb69ff31ebdf554fbe353727d5e5a3d96dbdcc39071a1ac52955b389dc8e1
MD5 f0b2b71da4640e5022aacc83720794e8
SHA1 816df6f19b04c8822b4f743974b0ad8a684e1f23
SHA512 f8f311ffb5d11b5eb4de5110aa4aacc423487d5e4b6397dfa423e6a3dbed51c8274d8ab7a77ba2039c3cda29bb4ed92e9fbabaef583a18b04dc25388be63030c
SSDEEP 12288:10GKgzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:OGKgKOW0jxuBIRIMKsLPPn
TLSH
T1BDE4237C7491BAECC93A41399052A2A2BCB138B06F14D9FF04F5D2366E846E0EB34DD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 b9103bc006226a999cda87f2200febfd363d0a7a81f3cff43d4aee147c3f648a
MD5 2c5f0b7c5d23e608139bd3e0a171bfd7
SHA1 f7e3570220c12bb27d39f5d3337e9d5e5c4066d3
SHA512 9daac471402f272e9962dbae9b9ede7de251ca04c0e26604f0ac9eaa7a96a597ae7145863c07bcca02873a354fe3cf446b87ddce5ec7533778ae601affe95708
SSDEEP 12288:RPzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:RPKOW0jxuBIRIMKsLPPn
TLSH
T142D42374A445FFADEA791079A043A3648DB518A1BF44CAE70079D23738C87D9EA30DE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0ea185319408d257a46510021689f8c7498a90b59a4395bb4ba07c91f2a1db13
MD5 688034cf09cfc0b7f172f00412c25baa
SHA1 fe6a890ec3138a4cacdf9682d0234c6496b8a414
SHA512 1c58c6d1d161a8438d222389dd7137ad0bad5967c8cb9a18e874424dec675efd6c183171dc677d961e58809b78d2bdf14e4b2d16b68e34ca5fd20fcbcdb9ba15
SSDEEP 24576:HG88u8FpJqH1Qzria7/mMKOW0jxuBIRIMKsLPPn:m7ZFPqVva7/Qh0jpIMlXn
TLSH
T1D035016576E102F0D47BD13889824663F6B2B8251364EFDF06A88B561F23BD54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 fa8fb5c98e49a8e601b3899dfcd925a025752c5c356ab901b6675de4e06d2e63
MD5 7cb2a64d73344112aa338c9634df24c6
SHA1 6af7273b1930def01b4b43f02bf016d560089097
SHA512 4e2cde632046f45d04aefa45b49bc8d7f4a489e7e6b6a7c74d7222c428a6a19676163879c19fed3d475d21715e169c2917d638a1ca5cae78f49fa43034e84dc5
SSDEEP 12288:3HvUrBFrEjwaQlzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:3PUr+NQlKOW0jxuBIRIMKsLPPn
TLSH
T1D005F12F62982CE5E67AA17DC5828319E77278621711D2CF02E0C17E1E57ED8FD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 726d7552fd5fef42c24e8622cd83911062ab6a75919d79b86636acedbcff385a
MD5 9f58998cdf6b4bc86c2734eb67543c68
SHA1 3a51879f0c7ca1ec5dc0c84c35ead0bd0f64aa89
SHA512 f869409045a429b163e4cfc871cf4d3c574afa00ff1c91934a0c61913f0a992c9ad29a567c0e585d21b946a8ce7b834620b35a18c210e3dc7dba535d9de3b6a6
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/h0jpIMlXn:vG05lO43b861
TLSH
T188D5CF6A62EC11F9D1BBD17CD9C6460BEBB23815033456CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 52dca44e92f9dacedc50e92c2ae482051f4418d80ba3698946e4f3eed47af0e2
MD5 7fb24b509a0c60492b46c59096592b1b
SHA1 fb2694fadbc6dd92e8beffd76cef2dba4c063470
SHA512 c538c4eb614539f31445e18f3d74651017de20ae2760a4b41889642829fac363ce4a5691e4834e8842d42089df762bf16701bfb949d22cb26b30771dea95ceac
SSDEEP 24576:EJa5POZ3dpbWVM50JicR2hG0lasx2+47eidnZKOW0jxuBIRIMKsLPPn:6a5POZ3wJt2pasx2+mqh0jpIMlXn
TLSH
T1A065BF5EA6EC01D5E5B9D17DC583861AF5B1342253319BCF012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 52c576b75d4652a0668a8515c7525786b4168036322785725dd44f7ddcdf18a4
MD5 9afe33bb1209639174c74df794d7fa69
SHA1 17ab5a2a9b5a0bdd90f8a6e1ffab926e0a978674
SHA512 e7a9811fee431f4ce78b5ff16e0a0ab0d0b57009129fa35619dfb4cf2ab6c20d4f964eae7029651d2406f0678ec758af3c5d15a78a1801b552b2fff0ce3f8717
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7FkWKOW0jxuBIRIMKsLPPn:kNc/zEOVHFqh0jpIMlXn
TLSH
T114858C2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 1539cd2bf10f247eef4278ae1bc00b0610995d594aaf38296a4f76469940938d
MD5 616ba083950e71c26604cafedad70be9
SHA1 1d076a994b32799b8bfde9b24ed55f1c5eefb6ad
SHA512 84194a168563f4f4db8afd408241b886928bf89f94d4cdf21efcca8c2dcddecfd6dfc526428f55d7a81578bff0a5a1203b5f83f9ee50381912caf647fb32efe0
SSDEEP 12288:4SHPJnJP6szeCs6Rl28dTzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:NJnJPbzB4STKOW0jxuBIRIMKsLPPn
TLSH
T1E815D03DD29820E8E4B7C2B4815A175AFE71387D2F2169C718B4D5353F42EE0AA39F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2b03fb13d25bb79f11b2a82e881738ffec6cc91524ab8d4dd53fd4dba763694f
MD5 3b8f06210bf21190b7e82823383310ab
SHA1 7b9bf2d1e4dfa259b10a3090384bf9d2dcfc6d1f
SHA512 88eeff6d0d0f9d9a59ef29e88608342fecf31ee5dc8b26560550a9431af8ea42d15e1de4198019bcae8b6f14d302f0a943d7e15f353febb78b307e31dd8888a4
SSDEEP 24576:iuGHGL0MoeVtFumTijCmlKQWDkBKOW0jxuBIRIMKsLPPn:iuGHGeeV5ijCmlDWDk8h0jpIMlXn
TLSH
T194A56B05E7EB5184E8F3CAF5C92294169E327C549B34F7EF4A80C96A2E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 b7e095d4f9d5c4c8e8c02d79d0c509c3dc5bb997cedac5f813ac5cd97242ca7c
MD5 1a18a5ba019ff5682bede871f6652403
SHA1 eeaaccadd820ea4b4eeb6c67f1c65bc2e5699123
SHA512 0f78a66143a57894e3496e7108f60b930996fb2b56361cc0170029fa331f80cfde5c05c30ac125a25791f9b27bec5edfe4cc523ad6122f5fe38cc0952c98dd3a
SSDEEP 12288:Y1HKkiX5ZI7jzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:qivIfKOW0jxuBIRIMKsLPPn
TLSH
T19C05026C336A21F9D17B903EC1830211D6B2B4B19B119ADF06A4C57E5E93EDCF938E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 24ddaa9f05c12f6da6cd7b1dc3068faba73621bbe5cf42f56624b255f424fff2
MD5 9f3c1979d6b66d0677c8ad7a67049ade
SHA1 bf98ff3acb9793b548a0d9a1b22b9f3552b18a39
SHA512 34e5e47911a7ca9f1cc42c0ecde056445f93bea75957475f9fef4a4ea4419f9b9688165e40e15acb4c3c372757f982b5500f13fe505bdf9f0e596b26a8963a7a
SSDEEP 12288:sS6ky99zXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:NtybKOW0jxuBIRIMKsLPPn
TLSH
T1B0F412146384B9D9EAB91138D56382A08E757C20AF10D6EF00B1E63F2E757D4E930F96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 a7d248040376fb23f02b27bf7393bbe264940ca6aae42f3d69661bc861f10e4e
MD5 d415750a867a2406de4e744409af35e4
SHA1 f7aca6e6a284b109dba1f3daf95a8c0a2d12d30c
SHA512 98ed553fe1ad763647fb40dd3bfcc839d81ab530f5e5f77062470258bfef88f6ee5db8fa737d58faeb94d1f2ec395839a6c4210eb5eb998d1fa856a6930cf500
SSDEEP 12288:sKWGzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:JWGKOW0jxuBIRIMKsLPPn
TLSH
T10BD42378A441FFADEA791079A043A3A58D7638B16F14C9EF04B5D23768887C5EB30DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 03c5dacc2d818c218f81346aff830846620fc17494aff79ad29a646022712f4e
MD5 453cf672a98b52c1417a9760040241e0
SHA1 2819c5286494bc05b29fc5aabe85dc1dce55adc7
SHA512 c260dd0dd0e98269428a7ce3bb7a63c941417268ffc4b85ddbd32437759b637de2a5652fbd32816edceab6ae3e2619f3330fac46b98e598787c2eff602fc6929
SSDEEP 12288:8ygKCZyFDK3tT5Tr7aVLIH9lH3c3zXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbyT:8ygKHoTfaidZMKOW0jxuBIRIMKsLPPn
TLSH
T133559D1D77EA19CAE2B2D239D8621493D633B4315771C6CF2458C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 768dd90280a0d963e3128148c8eede9b08a346c75fe09fc0742a1e65f156afe1
MD5 e5478325f6eea0f565617328f89b7310
SHA1 4efe9ae9e50c35b111cb9c25a99833cced7e5d74
SHA512 04993962974437f059c0881db547e7572b2d4a698b2bfed2af6881670cc924b1162f01ea818dfe202796d58df629d587e6c278ec8bd0c5edb273130fbd420f73
SSDEEP 12288:FpJcm8CNTzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:FrcmRTKOW0jxuBIRIMKsLPPn
TLSH
T14F05015EB26E10E9E1BB813CC8824255EAB37430271197DF01B1C37E5E57AE9BE34B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 38a46b8a12f5b226d2f27e2b6375a3d6a033992296be7e1ce9765e755aabaae6
MD5 af44a5da78cd8290b1099bcafb24db5c
SHA1 735f99981caad02787bcee67d24bb63fc4ef2758
SHA512 044bf96f54d04f7f0d1e399fd3c7fcd7526b286b42dfd5fd31ddbff66d7e23a951b3cf16d5dd63242c6113aa31721fc0f6d13527816b8fba396e1a71f606402f
SSDEEP 49152:IDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3qh0jpIMlXn:V3Upow8sB761
TLSH
T123A58C3DA2E810A8C9AAC379C54213A6EA71782D3F3055DB0174C178BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-144-0x0000026FD60F0000-0x0000026FD6156000-memory.dmp

Download

memory/1184-143-0x0000026FD60F0000-0x0000026FD6156000-memory.dmp

Download

memory/1184-142-0x00007FF788AB0000-0x00007FF788B64000-memory.dmp

Download

memory/1184-207-0x00007FF788AB0000-0x00007FF788B64000-memory.dmp

Download

memory/1580-87-0x0000016A13910000-0x0000016A13976000-memory.dmp

Download

memory/1580-86-0x0000016A13910000-0x0000016A13976000-memory.dmp

Download

memory/1580-85-0x0000016A136B0000-0x0000016A1383B000-memory.dmp

Download

memory/1620-72-0x00007FF6ACBE0000-0x00007FF6ACD03000-memory.dmp

Download

memory/1620-15-0x00007FF6ACBE0000-0x00007FF6ACD03000-memory.dmp

Download

memory/1620-17-0x000001816A160000-0x000001816A1C6000-memory.dmp

Download

memory/1620-16-0x000001816A160000-0x000001816A1C6000-memory.dmp

Download

memory/1620-18-0x000001816A160000-0x000001816A1C6000-memory.dmp

Download

memory/1736-117-0x00007FF6A9F40000-0x00007FF6AA684000-memory.dmp

Download

memory/1736-251-0x000001E890AF0000-0x000001E890B56000-memory.dmp

Download

memory/1736-190-0x00007FF6A9F40000-0x00007FF6AA684000-memory.dmp

Download

memory/1736-253-0x00007FF6A9F40000-0x00007FF6AA684000-memory.dmp

Download

memory/1736-116-0x000001E890AF0000-0x000001E890B56000-memory.dmp

Download

memory/1736-119-0x000001E890AF0000-0x000001E890B56000-memory.dmp

Download

memory/2572-126-0x000001DF7A420000-0x000001DF7A486000-memory.dmp

Download

memory/2572-197-0x00007FF748D40000-0x00007FF748DEE000-memory.dmp

Download

memory/2572-125-0x000001DF7A420000-0x000001DF7A486000-memory.dmp

Download

memory/2572-124-0x00007FF748D40000-0x00007FF748DEE000-memory.dmp

Download

memory/2816-91-0x00007FF6F7800000-0x00007FF6F78C9000-memory.dmp

Download

memory/2816-27-0x00007FF6F7800000-0x00007FF6F78C9000-memory.dmp

Download

memory/2816-26-0x000001BC47A80000-0x000001BC47AE6000-memory.dmp

Download

memory/2816-29-0x000001BC47A80000-0x000001BC47AE6000-memory.dmp

Download

memory/2892-1-0x00000000036B0000-0x0000000003719000-memory.dmp

Download

memory/2892-6-0x00000000036B0000-0x0000000003719000-memory.dmp

Download

memory/2892-0-0x0000000003740000-0x00000000037F6000-memory.dmp

Download

memory/2892-7-0x00000000036B0000-0x0000000003719000-memory.dmp

Download

memory/2936-184-0x000001C89BBC0000-0x000001C89BC26000-memory.dmp

Download

memory/2936-182-0x00007FF69A5D0000-0x00007FF69A85B000-memory.dmp

Download

memory/2936-226-0x00007FF69A5D0000-0x00007FF69A85B000-memory.dmp

Download

memory/2936-183-0x000001C89BBC0000-0x000001C89BC26000-memory.dmp

Download

memory/3152-225-0x000002B74BA20000-0x000002B74BA86000-memory.dmp

Download

memory/3152-231-0x00007FF70DF30000-0x00007FF70E26F000-memory.dmp

Download

memory/3152-227-0x000002B74BA20000-0x000002B74BA86000-memory.dmp

Download

memory/3152-249-0x00007FF70DF30000-0x00007FF70E26F000-memory.dmp

Download

memory/3244-60-0x00007FF78C9F0000-0x00007FF78CB58000-memory.dmp

Download

memory/3244-67-0x000002F324830000-0x000002F324896000-memory.dmp

Download

memory/3244-69-0x00007FF78C9F0000-0x00007FF78CB58000-memory.dmp

Download

memory/3244-62-0x000002F324830000-0x000002F324896000-memory.dmp

Download

memory/3244-61-0x000002F324830000-0x000002F324896000-memory.dmp

Download

memory/3332-202-0x0000027C56C60000-0x0000027C56CC6000-memory.dmp

Download

memory/3332-201-0x0000027C56C60000-0x0000027C56CC6000-memory.dmp

Download

memory/3332-200-0x00007FF66C810000-0x00007FF66CD17000-memory.dmp

Download

memory/3332-245-0x00007FF66C810000-0x00007FF66CD17000-memory.dmp

Download

memory/3692-153-0x000002A7F08F0000-0x000002A7F0956000-memory.dmp

Download

memory/3692-154-0x00007FF7655C0000-0x00007FF7659A6000-memory.dmp

Download

memory/3692-155-0x000002A7F08F0000-0x000002A7F0956000-memory.dmp

Download

memory/3692-218-0x00007FF7655C0000-0x00007FF7659A6000-memory.dmp

Download

memory/3872-219-0x00007FF6D0FA0000-0x00007FF6D10CF000-memory.dmp

Download

memory/3872-213-0x000001D121260000-0x000001D1212C6000-memory.dmp

Download

memory/3872-214-0x000001D121260000-0x000001D1212C6000-memory.dmp

Download

memory/3872-248-0x00007FF6D0FA0000-0x00007FF6D10CF000-memory.dmp

Download

memory/4072-172-0x00007FF7FF5C0000-0x00007FF7FF8E1000-memory.dmp

Download

memory/4072-170-0x000001BF46980000-0x000001BF469E6000-memory.dmp

Download

memory/4072-173-0x000001BF46980000-0x000001BF469E6000-memory.dmp

Download

memory/4072-177-0x000001BF46980000-0x000001BF469E6000-memory.dmp

Download

memory/4072-178-0x00007FF7FF5C0000-0x00007FF7FF8E1000-memory.dmp

Download

memory/4636-54-0x000001E0D3860000-0x000001E0D38C6000-memory.dmp

Download

memory/4636-53-0x000001E0D3860000-0x000001E0D38C6000-memory.dmp

Download

memory/4636-52-0x000001E0D35B0000-0x000001E0D373B000-memory.dmp

Download

memory/4880-113-0x00007FF6F7800000-0x00007FF6F78C9000-memory.dmp

Download

memory/4880-38-0x000001C701650000-0x000001C7016B6000-memory.dmp

Download

memory/4880-37-0x000001C701650000-0x000001C7016B6000-memory.dmp

Download

memory/4880-36-0x000001C701650000-0x000001C7016B6000-memory.dmp

Download

memory/4880-35-0x00007FF6F7800000-0x00007FF6F78C9000-memory.dmp

Download

memory/4964-206-0x00007FF606CF0000-0x00007FF607107000-memory.dmp

Download

memory/4964-220-0x00007FF606CF0000-0x00007FF607107000-memory.dmp

Download

memory/4964-134-0x0000026D0B230000-0x0000026D0B296000-memory.dmp

Download

memory/4964-133-0x0000026D0B230000-0x0000026D0B296000-memory.dmp

Download

memory/4964-138-0x00007FF606CF0000-0x00007FF607107000-memory.dmp

Download

memory/4964-210-0x0000026D0B230000-0x0000026D0B296000-memory.dmp

Download

memory/5032-97-0x000001F75B490000-0x000001F75B4F6000-memory.dmp

Download

memory/5032-169-0x00007FF637870000-0x00007FF6379BA000-memory.dmp

Download

memory/5032-96-0x000001F75B490000-0x000001F75B4F6000-memory.dmp

Download

memory/5032-94-0x00007FF637870000-0x00007FF6379BA000-memory.dmp

Download

memory/5360-221-0x00007FF781F20000-0x00007FF7820B5000-memory.dmp

Download

memory/5360-162-0x0000016AA6750000-0x0000016AA67B6000-memory.dmp

Download

memory/5360-163-0x0000016AA6750000-0x0000016AA67B6000-memory.dmp

Download

memory/5360-161-0x00007FF781F20000-0x00007FF7820B5000-memory.dmp

Download

memory/5544-103-0x0000000000A00000-0x0000000000A69000-memory.dmp

Download

memory/5544-181-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/5544-108-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/5544-109-0x0000000000A00000-0x0000000000A69000-memory.dmp

Download

memory/5620-73-0x00007FF7E6490000-0x00007FF7E65AA000-memory.dmp

Download

memory/5620-74-0x0000018F990D0000-0x0000018F99136000-memory.dmp

Download

memory/5620-152-0x00007FF7E6490000-0x00007FF7E65AA000-memory.dmp

Download

memory/5620-75-0x0000018F990D0000-0x0000018F99136000-memory.dmp

Download

memory/5624-46-0x000002B7DA040000-0x000002B7DA0A6000-memory.dmp

Download

memory/5624-44-0x000002B7D9DE0000-0x000002B7D9F6B000-memory.dmp

Download

memory/5624-45-0x000002B7DA040000-0x000002B7DA0A6000-memory.dmp

Download

memory/5792-192-0x00007FF717DC0000-0x00007FF718291000-memory.dmp

Download

memory/5792-193-0x00000185D5EB0000-0x00000185D5F16000-memory.dmp

Download

memory/5792-241-0x00007FF717DC0000-0x00007FF718291000-memory.dmp

Download

memory/5792-191-0x00000185D5EB0000-0x00000185D5F16000-memory.dmp

Download