319deee9fd60852fb781b7cb2aa68dd385a0ad3d9671cfc020e7b95ae8ea4368

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Size 3.3MB
Sample261020-ysdmeset7s
SHA256 319deee9fd60852fb781b7cb2aa68dd385a0ad3d9671cfc020e7b95ae8ea4368
MD5 55b5ae026de16db9765fe88adfa1d6d4
SHA1 758af7947623e86a18c6abb3cd92afb761ec68c2
SHA512 0d52c64418fd27ac0208f71aad45e93b90e77bbf0440949dc240db6317aff6c9357487c6d355b2bbcd9587f9d020078ae00ec613292e8e6d0ae9916eccddd0ec
SSDEEP 49152:VZDATAK7IjnDreNwL934vsDEuJUNliAceq58uCiqHUzj23P2Vh0jpIMlXn:VZUTWDreQDEuJU9mGjix61
TLSH
T1B9F5AF317701C4B6D95202B0ADBDEA5F816DBD218F7414C7B3D82F6E55B19C22B32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4148	alg.exe
3212	GameInputSvc.exe
3228	GameInputSvc.exe
2052	elevation_service.exe
2776	elevation_service.exe
1424	maintenanceservice.exe
3052	msdtc.exe
2308	OSE.EXE
948	PerceptionSimulationService.exe
5196	perfhost.exe
864	ReFsDedupSvc.exe
5140	locator.exe
5244	SensorDataService.exe
5040	snmptrap.exe
4276	ssh-agent.exe
3412	TieringEngineService.exe
5684	AgentService.exe
2548	vds.exe
4280	vssvc.exe
1572	wbengine.exe
4172	WmiApSrv.exe
5008	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\da9199c09600bb.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaws.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\java.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbe2d515ce60dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5523013ce60dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049b50318ce60dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b149814ce60dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3228	GameInputSvc.exe
3228	GameInputSvc.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTakeOwnershipPrivilege	4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTcbPrivilege	3212	GameInputSvc.exe
Token: SeBackupPrivilege	864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3412	TieringEngineService.exe
Token: SeManageVolumePrivilege	3412	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5684	AgentService.exe
Token: SeBackupPrivilege	4280	vssvc.exe
Token: SeRestorePrivilege	4280	vssvc.exe
Token: SeAuditPrivilege	4280	vssvc.exe
Token: SeBackupPrivilege	1572	wbengine.exe
Token: SeRestorePrivilege	1572	wbengine.exe
Token: SeSecurityPrivilege	1572	wbengine.exe
Token: 33	5008	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeDebugPrivilege	4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	4376	2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3228	3212	GameInputSvc.exe	91
PID 5008 wrote to memory of 3300	5008	SearchIndexer.exe	113
PID 5008 wrote to memory of 5644	5008	SearchIndexer.exe	114
PID 5008 wrote to memory of 5148	5008	SearchIndexer.exe	115
PID 5008 wrote to memory of 5828	5008	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_55b5ae026de16db9765fe88adfa1d6d4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4148

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2776

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1424

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3052

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:948

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5196

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5244

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5040

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4172

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2928 2924 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2936 2948 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6249e06591bbadd7334ceaab7cc0f5455fa3671e1180e65b37add54d0bbf56aa
MD5 ca3a54bfec86bc9971301ada03f7347d
SHA1 69d183be88bd431eee16803cd86f257971137e2e
SHA512 a2b877660a7757c5b1bac5b94fe0a287787732c3615f41aca139ac6ca3ca4aa505315608c80ae9030d37721c1a62cba7d868eae8e589f119465113ce9bcd0284
SSDEEP 49152:db+632BuPkFKRrdE6oh38YBhuXjfS4LWxn4h0jpIMlXn:j3q6ZjBr61
TLSH
T1C3D59D03F29900E9E069D178D7469133E9A2BC890B34B6DF0790B7562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 dcac92de0506a80bb597fc94705bd13bc70473983fa35e8aa0b89a20e87edc28
MD5 1513cce4d41fb759a959eef21e1af54a
SHA1 008ae17b65d95daeae68e1d0bccbf18054d1c14d
SHA512 5fa17efab476d73ae9b9a10197ad9ee5916c04914ce4032faff80986c3363df30a044be576724c5eebf9d88d85cdd06cd7406d6e50e831870ff4fcbe40e81c14
SSDEEP 12288:o1XLsrKWxx/Fv4tQczAFzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:OXYG+BczAFKOW0jxuBIRIMKsLPPn
TLSH
T1B405013877D049F9ED7B413DC8A28511EA7378914760EB9B03B4D6361E233989E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 41745d3bfb5ced8e3edb80ffc7452921bbe7b8f3f19c0df4530e486712cd8a58
MD5 26d4bfd7c53432796e1c10ecc44d6f8b
SHA1 b9f67b5cbc30a67a871adc4c6fc8dafcba17b1cd
SHA512 6dffd0566142e8198342a9a1a011a369a21636731510e3ea345b1fb1c9e65d7f6e6760ab7e9a792bddd153a905aba389b0531b4072b76c048b603f2cf3ccc064
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CYzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPPn:QwuuOWFKOW0jxuBIRIMKsLPPn
TLSH
T1A005F15576945CF9EA774139C587C136EBF2BC122A20CB1F0370C66B6F27361AE19B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f4e11f6bf3edf71d421a5bbab72a69cd075f79686d3010c8c4ce2887b5619737
MD5 c2033121489667abbe657a3fac0de7db
SHA1 6f98b1f983e5c24b6cef29f36c84c623c0433c57
SHA512 381bf42e3dc4df53f183919463101b2a4f037f65932f8f71e744e49a29b3f59b6e7f19c4df01304926262aa4ada2a0522a51c7fc20251cf8f82a687fdb000a75
SSDEEP 49152:aP+taZ3usBWOBr4tEGC58+x0z+n217aau1glFh0jpIMlXn:Ku6Jmixd2df61
TLSH
T196D59E13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 611KB
SHA256 3953cb57872c34b73b44ff21755f8ca0e1bcbce412fb1eed4df9e2200a18b1c4
MD5 3c1a31bfe83ba98ae66e71c6261cc71f
SHA1 13dcb9dc56574a4aa2df00be2cdb56381d7e7b34
SHA512 8320cd6c18fbb184a50c72488355ae4e109e12efff0d79a43f10c143e9130fff91f28b105672a84f246a20b24375f20e6a9cd83c97848178e086dfb325d3db90
SSDEEP 12288:Id7pzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:4pKOW0jxuBIRIMKsLPPn
TLSH
T158D42371A948FF6DFA791074A087A3609D7A78A5AF00C8D75039D27B38987C5DE00EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 78f0badd343cd99cf32289b92b64b527743aabd9cc963548e86de37d6db87f8a
MD5 883a5f0fd5cef3a9550bdf43c469807c
SHA1 83116245ecb7a6c99ce3eb8489b7d61a940aa579
SHA512 2515370eb03bb9285126346d14f705519e7a26333bfa5195c7abcca4ca4f1d37e347e9750a48d929e76e836925183eb44ac381b75fa9499057583450b08839ec
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYsKOW0jxuBIRIMKsLPPn:lgb4mBIBhGFQh0jpIMlXn
TLSH
T10565AE1E22E802F5E0FAD2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 34b505fba6c09ad38ad300e372bb6db24392eee99bc9e404b118868a6670a43e
MD5 63fcff2963810bc6f84ed7d1eeeec82c
SHA1 ef86f8b440a69c448b24bcb7cba7106c7b3f7b47
SHA512 5919e0f35f558422cc012eb22dc748e1d7533e740c259b1d3c0670a13c7e12a365705e37bfcb69ccb1575bf522f537fa6f6f3b3dfb7e170d625461920fc236e4
SSDEEP 12288:GkGfzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:7GfKOW0jxuBIRIMKsLPPn
TLSH
T1FAE4233D7491BAECC93A4139D052A2A6BCB138A06F14D9FF04B5D23A6E886D0E734DD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 43a487291950b9abef814c2cb1234cc42dd08b8a9508e1312a587b74c592d73f
MD5 fcfbe8bd04300ef83dfeb3d4d603b5bc
SHA1 7933c848c68671f6e74c5068f0a37684aafb3425
SHA512 6972937d5919871ca4625f5b0a5f61a7bf4d5c648e3c1bdf274de20b7929a09708e12e2acfdf1cae4303c39e9b8725be0ada0f67b93e74eb5513c01015c8dfe1
SSDEEP 12288:QRzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:QRKOW0jxuBIRIMKsLPPn
TLSH
T1C4D42374A805FFADEB791079A043A3648DB518A1BF54CAE70079D23738C87D5EA30DE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fc4dd346c233913bab99c7e6e26b243f03e55101a2e80409c692ae4791808454
MD5 bb5a89d28d96089bed5a675c1c9d8535
SHA1 35b189e001327f12326cd53aba0b50ed3df37cf1
SHA512 7dfd29cb7e698ebec4ebf4a683e3cb782677afa249035eecd23bc3999ce2fd59065e3ee8e38cbbe1d213cacbe2036a71eac9212617bda6852030636f50a237ce
SSDEEP 24576:2q18T8F3JqH1DQria7/m3KOW0jxuBIRIMKsLPPn:dKgFZqVJa7/nh0jpIMlXn
TLSH
T13735016576E102F4D47BD03889824663F6B2B8251364EFDF06A88B561F23BD54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 386e1777942f5cb549a8cab9fbdd1463ce613df7121e97420675a0ea4e785420
MD5 8bb01a340987389839bab3ff81670842
SHA1 559c1d5af6846c47802ca4c6987d62631e5080f8
SHA512 6372bdfd64006db778d51bdf1d83504b2e482ca3e25636ccd4f5dd723ca73c91262700d51bd6b215990b4fd9b2d4892304e16728ce972c724a47184efae58f53
SSDEEP 12288:aHvUrBFrEjwaQOzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:aPUr+NQOKOW0jxuBIRIMKsLPPn
TLSH
T10E05F12F62982CE9E67AA17D85828319E77178621711D6CF02E0C17F1E67ED8FD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 58520266a390d83727e61a903a04661966da2e9ed92ce6954f159a9556ac1d6f
MD5 d46821bea754e9e829f806bb1980af07
SHA1 06e774be9313062da313095dc85a37856da5ab08
SHA512 661219845db84120e3988087250230ff05b081e97f457600c20249d4d8357aaf66e615b90397ab657777d21e1fd39b2b178bcb10c42372a661c0c7cc24bd0c45
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjIh0jpIMlXn:rG05lO43bx61
TLSH
T1DAD5CF6A62EC11F9D1BBD17CD9C6460BEBB23415033456CF02A486A91F27FF49A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 9df46be648b29de3f3f7b20f6a9be4960f7ace6f152c4c45a1a5b952f145457f
MD5 79855681ac9c4ae3fcb1c6519c197e3f
SHA1 3bf3cc652859a2dc3ffd12ad7b029fe6da5bd666
SHA512 7b3829649fb19ddaad50f981cc45e08c27a28d0679f20d437c74e4ac307d658b3147c7f7ace8ade32f05013ab73839dc09b8634a296bc3378be737608f465946
SSDEEP 24576:8Ea5POZ3dpbWVM50JicR2hG0lasx2+47eidnM3nEvX/7TFNUgvxD5vTZHee:Da5POZ3wJt2pasx2+mG0vzTFNfTvTZHe
TLSH
T13365BF5EA7F800D5D5B9D17DC583461AF5B2342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8bbd73b3e8853d36be96e50ed7cec72c86949dd1ff4bef1ab39af2d47b2c94d0
MD5 333012dbe680a9a5e5bc20d5d7cc184b
SHA1 e9f4b0e0d64fbc4fd8909a970a61e58c15f1d62b
SHA512 928668bbb55ef195684c9571158b472badacc4e26a028d1a61a9a299579012b8dc5100338156a187b3a6572931d351e02e0f3643497e1408c33498b40af624fa
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkrKOW0jxuBIRIMKsLPPn:uNc/zEOVHFLh0jpIMlXn
TLSH
T158858C2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 b87582021c974a39ed5e7eeaf532668329d4ec39dab3c0904cbaf8c87494b34a
MD5 fb844ae433488f5174a15940e0138fff
SHA1 0159198ee6a95f194f899bbc1ce9c04343c39f52
SHA512 921702dea1a2ff4cd358eb38aef089c30d644400e3aaec3459730be220b5b3e1a8b1576938788f021aee0105517e731b0d621a3406cef4e160c9178235e7390b
SSDEEP 12288:oXHPJnJP6szeCs6Rl28dPzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:CJnJPbzB4SPKOW0jxuBIRIMKsLPPn
TLSH
T1B215D03DD29820E8E4B7C2B4815A175AFE71387D2F2169C718B4D5353F42EE0AA39F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 cf8e95347a4b28c74f7bc83983eb4cb3cac6dc100cc42ef0414c1f279cbe15f2
MD5 637976fbb0058f7598038370633906d4
SHA1 074be6c07ea1ab6976563cfe2862205bdead030b
SHA512 a64fea8fc6dd5e6baf6e2d8b5cfc31159916302bb4970e56e5aedf1f9b39a88f3ff515fb50fc43b05be37ca8a18ce81d90382b72b7368337c78ad47932a99cb1
SSDEEP 24576:lCLHGL0MoeVtFumTijCmlKQWDkQKOW0jxuBIRIMKsLPPn:lCLHGeeV5ijCmlDWDk5h0jpIMlXn
TLSH
T1ADA56B05E7EB5184F8F3CAF5C92294169A327C549B34F7EF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 ee8e614b5f10562436eaa65ee3555f4d36b7b4b8e2dcdaa8d385f300048012fb
MD5 544e761f41fa864723eca129da16bd99
SHA1 0fc088cddce72a6627b44e41ee108f525b80063f
SHA512 e8a0c0847a041c4d68f7e9d24a73a213c16f79c3e50bfdf71e7fc5f70fa354bfa460fa289832e6077b978480f5dd1373c5cb6ca2ef2bbe054d5a940e9b1ce966
SSDEEP 12288:L1H1kgj5ZI7uzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:cgDISKOW0jxuBIRIMKsLPPn
TLSH
T1A005026C336A61F9D17B903DC1830211D6B2B4B19B119ADF06A4C57E5EA3EDCF938E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 97394f06de9d926809e6fbdaa81b34023d76ed8adeaddf8cce59abc30e3d32c4
MD5 d8b4d5b8830d002f075b08de032431dc
SHA1 03de2612aecf1034e8f30f13bd14840f08f2bd73
SHA512 21a3f291bb5fb7b36ac3d87ff3ea995d4b36f9d9e5e769f5e1ad20972b809010bcc48ac4f8e567c6fcb88dfb020879b25313cb4b90cc675d825534b579fbecd7
SSDEEP 12288:dG6kywzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:ktywKOW0jxuBIRIMKsLPPn
TLSH
T195F412146384B5D9EAB90138956382A08E757C20AF20D6EF14B1E63F3E757D4ED30F96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 e915de872baa34acf6671efdb07031197c19dc445c001e459686df0782687cef
MD5 54d78f09c29a3c49ec4eab8e6efe1f77
SHA1 cf08b31821c88829fa573ab91fb9091f31709988
SHA512 4437be826576f2f1c27273ab32cd138c27b27ccd35aa1226e2e920660af4fb4e31e8caa311899368bda454ce00be4a7c5a83221717695ddbdbd6232ae962f284
SSDEEP 12288:OLgzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:mgKOW0jxuBIRIMKsLPPn
TLSH
T10CD42378A441FFADEA791079A04363A58DB638B57F14C9EF04B5D23768883C5EA30DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 59d8df40f27b73d83069ba5168006a09cc7c99e77f44c55ef79aae8b15547f90
MD5 4808125eff3a60b7e21e244cc98c0025
SHA1 99aefebcbc2d01c3c7c9547c29eedb25c1dde7a1
SHA512 fbea4d3351422e57ee103fc9adf1a7d30aca1c4034db8bdd0039b7872223a2624427c53ef10c23427fe8310504924efb3970b7553d6cb63e75816bc6785cd419
SSDEEP 12288:Jrg9LZyFDK3tT5Tr7aVLIH9lH3c9zXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbyT:Jrg9AoTfaidZ2KOW0jxuBIRIMKsLPPn
TLSH
T1CD559D1D67EA19CAE2B2D239D8631493D633B4315771C6CF2458C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 baab7b77895373f84c2608b83e92f15ffd003c84ab9721b96e98caf9178e26ea
MD5 77e7f1e1a1c265aa18489f4edb44a131
SHA1 182a57f3a868d745d9a472d50b69890ac636389c
SHA512 707e4e9067664b4116ca364d136febd6a0a60b48843c7cff509b1dc59721b9330d8dce4e1776cd483ef55a4957ec13c68bc69fa66b85ebb3489141fdd58fea7b
SSDEEP 12288:ipJcm8CNvuXb77TbdcXYh5QLjDiZa7TFNUlevxDj1vT3JHm8EMDsj:ircmR2X3nEvX/7TFNUgvxD5vTZHee
TLSH
T15405F10EB3AA00A6E1B7817C8C864116F6B37435475267DF02A1C7BD0A57AED7D38FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 553a8978911681143f431bcf0cfd8a804e91b1dae119256a2dd22497735bbb70
MD5 7941942315408fbd12331d0d8eac6854
SHA1 d94d8a4d2fddaa7003ef264e8da8a66432259638
SHA512 26019c440b45e766be74363513127910d50409d56e2d4373a1121fc181f20c462d9f277a93a83015499d17afca417145c128b37905761a090480f228c3abd38a
SSDEEP 49152:LDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3P0vzTFNfTvTZHe:g3Upow8sBIYe
TLSH
T13EA58C3DA2E810A8D9AAC379C44213A6EA71782E3F3015DB0174C578BF1BDF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/864-117-0x00007FF6FFE50000-0x00007FF700594000-memory.dmp

Download

memory/864-118-0x00000155A4060000-0x00000155A40C6000-memory.dmp

Download

memory/864-116-0x00000155A4060000-0x00000155A40C6000-memory.dmp

Download

memory/864-187-0x00007FF6FFE50000-0x00007FF700594000-memory.dmp

Download

memory/864-256-0x00000155A4060000-0x00000155A40C6000-memory.dmp

Download

memory/864-257-0x00007FF6FFE50000-0x00007FF700594000-memory.dmp

Download

memory/948-98-0x000001CECFDA0000-0x000001CECFE06000-memory.dmp

Download

memory/948-97-0x000001CECFDA0000-0x000001CECFE06000-memory.dmp

Download

memory/948-152-0x00007FF7AA140000-0x00007FF7AA28A000-memory.dmp

Download

memory/948-95-0x00007FF7AA140000-0x00007FF7AA28A000-memory.dmp

Download

memory/1424-63-0x00000263811B0000-0x0000026381216000-memory.dmp

Download

memory/1424-68-0x00000263811B0000-0x0000026381216000-memory.dmp

Download

memory/1424-70-0x00007FF6F26C0000-0x00007FF6F2828000-memory.dmp

Download

memory/1424-62-0x00000263811B0000-0x0000026381216000-memory.dmp

Download

memory/1424-61-0x00007FF6F26C0000-0x00007FF6F2828000-memory.dmp

Download

memory/1572-245-0x00007FF7818D0000-0x00007FF781DD7000-memory.dmp

Download

memory/1572-203-0x000002576E5E0000-0x000002576E646000-memory.dmp

Download

memory/1572-204-0x000002576E5E0000-0x000002576E646000-memory.dmp

Download

memory/1572-202-0x00007FF7818D0000-0x00007FF781DD7000-memory.dmp

Download

memory/2052-44-0x00000259722D0000-0x000002597243A000-memory.dmp

Download

memory/2052-45-0x0000025972440000-0x00000259724A6000-memory.dmp

Download

memory/2052-46-0x0000025972440000-0x00000259724A6000-memory.dmp

Download

memory/2308-88-0x0000014CBD860000-0x0000014CBD8C6000-memory.dmp

Download

memory/2308-86-0x0000014CBD620000-0x0000014CBD78A000-memory.dmp

Download

memory/2308-87-0x0000014CBD860000-0x0000014CBD8C6000-memory.dmp

Download

memory/2548-217-0x00007FF7F09D0000-0x00007FF7F0C5B000-memory.dmp

Download

memory/2548-188-0x00007FF7F09D0000-0x00007FF7F0C5B000-memory.dmp

Download

memory/2548-182-0x000001750D000000-0x000001750D066000-memory.dmp

Download

memory/2548-183-0x000001750D000000-0x000001750D066000-memory.dmp

Download

memory/2776-54-0x0000022D4F5F0000-0x0000022D4F656000-memory.dmp

Download

memory/2776-56-0x0000022D4F5F0000-0x0000022D4F656000-memory.dmp

Download

memory/2776-53-0x0000022D4F360000-0x0000022D4F4CA000-memory.dmp

Download

memory/3052-76-0x000001EA92A90000-0x000001EA92AF6000-memory.dmp

Download

memory/3052-74-0x00007FF7FC600000-0x00007FF7FC71A000-memory.dmp

Download

memory/3052-75-0x000001EA92A90000-0x000001EA92AF6000-memory.dmp

Download

memory/3052-133-0x00007FF7FC600000-0x00007FF7FC71A000-memory.dmp

Download

memory/3212-26-0x00007FF7E6600000-0x00007FF7E66C9000-memory.dmp

Download

memory/3212-27-0x0000028ABD3F0000-0x0000028ABD456000-memory.dmp

Download

memory/3212-73-0x00007FF7E6600000-0x00007FF7E66C9000-memory.dmp

Download

memory/3212-28-0x0000028ABD3F0000-0x0000028ABD456000-memory.dmp

Download

memory/3212-29-0x0000028ABD3F0000-0x0000028ABD456000-memory.dmp

Download

memory/3228-35-0x00007FF7E6600000-0x00007FF7E66C9000-memory.dmp

Download

memory/3228-36-0x000001F9F1A90000-0x000001F9F1AF6000-memory.dmp

Download

memory/3228-38-0x000001F9F1A90000-0x000001F9F1AF6000-memory.dmp

Download

memory/3228-94-0x00007FF7E6600000-0x00007FF7E66C9000-memory.dmp

Download

memory/3228-37-0x000001F9F1A90000-0x000001F9F1AF6000-memory.dmp

Download

memory/3412-163-0x0000016F38800000-0x0000016F38866000-memory.dmp

Download

memory/3412-164-0x0000016F38800000-0x0000016F38866000-memory.dmp

Download

memory/3412-168-0x00007FF66EAC0000-0x00007FF66EC55000-memory.dmp

Download

memory/3412-212-0x00007FF66EAC0000-0x00007FF66EC55000-memory.dmp

Download

memory/4148-50-0x00007FF67CDC0000-0x00007FF67CEE3000-memory.dmp

Download

memory/4148-18-0x0000020E9A900000-0x0000020E9A966000-memory.dmp

Download

memory/4148-17-0x0000020E9A900000-0x0000020E9A966000-memory.dmp

Download

memory/4148-16-0x0000020E9A900000-0x0000020E9A966000-memory.dmp

Download

memory/4148-15-0x00007FF67CDC0000-0x00007FF67CEE3000-memory.dmp

Download

memory/4172-248-0x00007FF6E2770000-0x00007FF6E289F000-memory.dmp

Download

memory/4172-219-0x0000017E38220000-0x0000017E38286000-memory.dmp

Download

memory/4172-216-0x0000017E38220000-0x0000017E38286000-memory.dmp

Download

memory/4172-218-0x00007FF6E2770000-0x00007FF6E289F000-memory.dmp

Download

memory/4276-156-0x000001A7DAF30000-0x000001A7DAF96000-memory.dmp

Download

memory/4276-211-0x00007FF726110000-0x00007FF7263B3000-memory.dmp

Download

memory/4276-155-0x000001A7DAF30000-0x000001A7DAF96000-memory.dmp

Download

memory/4276-153-0x00007FF726110000-0x00007FF7263B3000-memory.dmp

Download

memory/4280-193-0x0000026B45770000-0x0000026B457D6000-memory.dmp

Download

memory/4280-192-0x00007FF7C43C0000-0x00007FF7C4891000-memory.dmp

Download

memory/4280-240-0x00007FF7C43C0000-0x00007FF7C4891000-memory.dmp

Download

memory/4280-194-0x0000026B45770000-0x0000026B457D6000-memory.dmp

Download

memory/4376-7-0x0000000003800000-0x0000000003869000-memory.dmp

Download

memory/4376-1-0x0000000003800000-0x0000000003869000-memory.dmp

Download

memory/4376-6-0x0000000003800000-0x0000000003869000-memory.dmp

Download

memory/4376-0-0x0000000003590000-0x0000000003698000-memory.dmp

Download

memory/5008-226-0x00007FF7E0B00000-0x00007FF7E0E3F000-memory.dmp

Download

memory/5008-249-0x00007FF7E0B00000-0x00007FF7E0E3F000-memory.dmp

Download

memory/5008-227-0x0000012610E10000-0x0000012610E76000-memory.dmp

Download

memory/5008-228-0x0000012610E10000-0x0000012610E76000-memory.dmp

Download

memory/5040-201-0x00007FF7B0910000-0x00007FF7B09C4000-memory.dmp

Download

memory/5040-144-0x00007FF7B0910000-0x00007FF7B09C4000-memory.dmp

Download

memory/5040-146-0x000001BB614A0000-0x000001BB61506000-memory.dmp

Download

memory/5040-145-0x000001BB614A0000-0x000001BB61506000-memory.dmp

Download

memory/5140-124-0x00007FF718060000-0x00007FF71810E000-memory.dmp

Download

memory/5140-126-0x00000155B3610000-0x00000155B3676000-memory.dmp

Download

memory/5140-189-0x00007FF718060000-0x00007FF71810E000-memory.dmp

Download

memory/5140-125-0x00000155B3610000-0x00000155B3676000-memory.dmp

Download

memory/5196-162-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/5196-104-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/5196-110-0x0000000000850000-0x00000000008B9000-memory.dmp

Download

memory/5196-105-0x0000000000850000-0x00000000008B9000-memory.dmp

Download

memory/5244-208-0x000001C95B3B0000-0x000001C95B416000-memory.dmp

Download

memory/5244-135-0x000001C95B3B0000-0x000001C95B416000-memory.dmp

Download

memory/5244-198-0x00007FF603FF0000-0x00007FF604407000-memory.dmp

Download

memory/5244-210-0x00007FF603FF0000-0x00007FF604407000-memory.dmp

Download

memory/5244-139-0x00007FF603FF0000-0x00007FF604407000-memory.dmp

Download

memory/5244-134-0x000001C95B3B0000-0x000001C95B416000-memory.dmp

Download

memory/5684-176-0x00007FF7303D0000-0x00007FF7306F1000-memory.dmp

Download

memory/5684-177-0x000002BBB5290000-0x000002BBB52F6000-memory.dmp

Download

memory/5684-172-0x000002BBB5290000-0x000002BBB52F6000-memory.dmp

Download

memory/5684-171-0x000002BBB5290000-0x000002BBB52F6000-memory.dmp

Download

memory/5684-179-0x00007FF7303D0000-0x00007FF7306F1000-memory.dmp

Download