e5402e78b469cb9ea076c5e24eb5653dca0feb72b850f06347b5911cb238d450

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Size 3.5MB
Sample260629-2bd4eagw6t
SHA256 e5402e78b469cb9ea076c5e24eb5653dca0feb72b850f06347b5911cb238d450
MD5 53dc00b0d924c399f0f7e4eb8a7ae4ac
SHA1 174059841f02b30e17d50f7b0189ca19b98b6365
SHA512 dc878801c98c314e187cca31ef6de935d48a90f2cba05bd1a99761b11f6f1888ef5bdcd341ba612264375cd762830a485ded86b53eb7994ee6ff8ddbfd506289
SSDEEP 98304:R4Z/RUixPo/hVxtVNDO57g4NRvMJRQjUXdWPt:RVi6/Hf4NRvPAXc
TLSH
T19806F132B1038136C2F51230D02ADB96402A6D78973548DFABD93E2D7F7D1D39A75A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Indicator Removal: Clear Persistence 1 TTPs 53 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe\debugger	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dkjkgbbld	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{44866EA7-7756-400D-86F4-BF0A7D19CBAC}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{305D3479-95D9-486B-ACC7-0986FA326BCD}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1788	2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
Token: SeShutdownPrivilege	4948	explorer.exe
Token: SeCreatePagefilePrivilege	4948	explorer.exe
Token: SeShutdownPrivilege	4948	explorer.exe
Token: SeCreatePagefilePrivilege	4948	explorer.exe
Token: SeShutdownPrivilege	4948	explorer.exe
Token: SeCreatePagefilePrivilege	4948	explorer.exe
Token: SeShutdownPrivilege	4948	explorer.exe
Token: SeCreatePagefilePrivilege	4948	explorer.exe
Token: SeShutdownPrivilege	4948	explorer.exe
Token: SeCreatePagefilePrivilege	4948	explorer.exe
Token: SeShutdownPrivilege	4948	explorer.exe
Token: SeCreatePagefilePrivilege	4948	explorer.exe
Token: SeShutdownPrivilege	4948	explorer.exe
Token: SeCreatePagefilePrivilege	4948	explorer.exe
Token: SeShutdownPrivilege	4948	explorer.exe
Token: SeCreatePagefilePrivilege	4948	explorer.exe
Token: SeShutdownPrivilege	4948	explorer.exe
Token: SeCreatePagefilePrivilege	4948	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
1216	sihost.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe
4948	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5912	StartMenuExperienceHost.exe
1780	SearchHost.exe
4948	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 4948	1216	sihost.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_53dc00b0d924c399f0f7e4eb8a7ae4ac_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- Indicator Removal: Clear Persistence
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4948

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 221B
SHA256 7f3537d7e61fa30e49f7d89852434fc5db8bd9362acba22e46781650de91750d
MD5 6351d167c215bd65e4794e533dabd57f
SHA1 2a4ba5b8248d190314fdb1c414bf03f0199f73da
SHA512 fe12014c32ce5104d05e585545c1b25a82974462e6c8d5a35a0ce68b14a8906c306caf1719a45a44940fe693eae213fafdb186c6d29c43b878aa97d4d94be779
TLSH
T12FD0BC7AF8BCC9883590848286447FCBCCD300CC2D18208E3327E24EAA20CD089A8E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 83ca106f120bd26bcf5c08c8e3e1bedfaf3ca7fc219d5e39743c3cbbe9280c48
MD5 d3f10d479b4509093a99dce3fa01f3fd
SHA1 907cc285447f6cb65ffd5cb6a686d97ad48db799
SHA512 bffd0070f23dda05fbe495dbea02d472e4de6c42b9dbba63074b1b8396be205f0416b573d5ba6cda50d4b8189f24003fe9bf12895da9c0b62ac55e95333aec64
TLSH
T1F141807EFCFD89D97580D1828B056F8BCCC300CC6958319E3726E54EAB21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 aef3de6150aec2f1f768b65ee0d49109f3e4a1776dfd3a3689dce969e58293e1
MD5 ada89d9c4fd49b0ec52bdbc09f489a5d
SHA1 9aedadfd8b0eb69edebb288068b0b84785452d41
SHA512 25992c1027828bdad05d35ea37f94e4d8459f8f3306e5d1532529c3c1876d5a3dcc8f671c329a96fee958544c93c933a93ccea41b229d1d21ab333032d187131
TLSH
T18A41807EFCFD89D97580D1828B056F8BCCC300CC6958319E3726E54EAB22CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 f417705338d7eae0ec20984221f7c888cd050d57d9356e49f0f4b77873877921
MD5 f0cb4d412fa85dfbc5c621983691045d
SHA1 bc2d6c87333b12b1ab1f8d5844a60a37cc1f778e
SHA512 22df567f0412ef66cb61215f3a1163143bb35cca0e1a19d8d72fc9e9f0ee7e3ea0a5367a9740d5fa019a8ad8a1dffc5f164f96154151b322fdbc9d44a896cd87
TLSH
T15341817EFCFD89D97580D1828B056F8BCCC300CC695831DE3726E54EAB22CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 248B
SHA256 1cde91cfab3fb613a4ac8d3082b28795bd8f3a2a3e8ddc208284eadafcca5b0e
MD5 d8deffb6813334f3cc36ed5f0617cf46
SHA1 e3b7772720890d1ba6f92aa8dbd87cf0de0551f8
SHA512 39134031b03584b8891859e47bccbb99220e96e3a4de0c8d9791b48fe3503a1736a0fe19d748c8b8e120e978c395173dac5be10f3f07744cb8fc6f047f67c193
TLSH
T15AD0A27AF8BCC9983690848286457FCBCCD300CC2D18208E3327E24EAA21CD089A4E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 97b90116f17c31567a45922c14dbed2ae07a1873f4b582a7941809d55dcb5491
MD5 b22e4fa7dccff9e015ea6a6990595d54
SHA1 59e57f6848e4ab8b3756b33b1af1a3095bc9c003
SHA512 318478ef39da2e1d101e5a7a4a00b7bc3b165df338ab3cb136015d3711df21f76c80b8c8e9b0e73067ce069eb9efcbef50bc7cec7db886eb43d8301a39fb465c
TLSH
T1D641827EFCFD99997580D1828B056F8BCCC300CC695831DE3726E54EAB22CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 dd2baa37efec600665dcab07a161e554017c88f8af8cdde52034157aba8ebacc
MD5 8344d6ab691adcf77b0092473e9ab1f1
SHA1 bd875acc2a10a3453448a1bf892387e282fe2840
SHA512 0c48b251fb1698136e8875a53c144ac868da40c4813013ce3ffae33087c7cb8de8f7fee879c6abc1b65698a33d7640d35b82528900cf9450e1bb6b8ee296a8f0
TLSH
T17941847EFCFD99997580D1828B156F8BCCC300CC695831DE3726E54EAB21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 99fc616a411a6c411ff331f0db661306e6e35b1820429716805d7ffbe1a02a4d
MD5 7494394b2fb3a57b66e57c02b7a64306
SHA1 af07221865fa5be8f7c63bb8be155c982d6cfaf6
SHA512 19225dcdb383bae3d9c71aea71359959ad353c5e79c33105b29a6691be1248d9d2d523048e4424f52a67ea391b149c32b13ec202dda978367ddbd9aea0a03162
TLSH
T1EA41847EFCFD999975C0D1828B156F8BCCC300CC695831DE3726E54EAB21CD089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 7c2100b3729af66ca1e5023a5ac00d54b0738d7660266bc20a460cf47ed043ce
MD5 3e5f065d69dd1f8829f379a9491f1255
SHA1 b7d1d14116d61303de6f51e733d1daf0806adb9b
SHA512 5c86cc8b8d917aa3c068f8cbae0f216596a36069539bd458379d436ce2e41be910e79578ae780e2dd089d97c09120ab7b9a814cc2e040d15e39ef7bf1b4da7d4
TLSH
T1C341757EFCFD999976C0D1828B156F8BCCC300CC695831DE3726E54EAB21CD089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 2KB
SHA256 8c38dd1de3e5bb58dc74a0eb916b55432de38d8ca0917455613db21a8cbc991a
MD5 76a0e09ddb3e1a5fabc53b3153ee6e8f
SHA1 1a5d02777dba7861a7617882f0ca79df3af2c559
SHA512 0ea683494260fe80a15894f7bcae0fe53a964267fd2dbf5c2df59510d082f89d705f9c2efe3fb8bc3a026eeae85b0bc9c5998dacb791ed13762aff3640f836cb
TLSH
T1B441757EFCFD999976C0D1828B156F8BCCC300CC695931DE3726E54EAB22CD089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 2KB
SHA256 c11f0f1515855fd7ec675183ab7eae570731b768e7f56a8dfb6bc774ae3b39dd
MD5 a5ef4c0b7bebb080a242a0e9c084d090
SHA1 e866a767b47ba1f6a4c5de2279a41e20788a2c86
SHA512 7057898925bd5bc8c4ec335cb4399a3f73e66774cc8af4418682f02bd0b14e0966548ac4a4ecf5d4782e3e8bb2601f8b6902bf2a9fb31cf289b6d00f6300db48
TLSH
T1F241747EFCBD99997680D1828B156F8BCCC300CC6959219E3726E54EAB22CD089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 2KB
SHA256 72eed2ce2386fd0f0d87535cc25a068376c87d99c43fd6ac4e71bc4a2936c2f1
MD5 e476b7f38acebf561b6843a556ad80b6
SHA1 6079230f43abd24c056dd7f912e4b1a0b0516ad1
SHA512 bb1184daefe9143a8ea789e387737fbba806ad83eec933da0527c5cb073ad067ebcd14276018ff680bf84f1f0ee71bd8e743211d7bce0239179b2bba21671399
TLSH
T12A41737EFCFD999976C0D1828B156F8FCCC300CC6959219E3726E54EAB22CD089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 2KB
SHA256 a63be71498d7375ab9728b4a0d94886bb14e7952dae33dde2fac4c478de120d9
MD5 96b1f0934db70f9704785826609c95a2
SHA1 1b5bfb0455b3c2a30dfb302014abe37e1a88ef10
SHA512 3ebe9d3bd02f060eb94063d6e9bd90da27e90fd337d3ed65584124424e9ab42adad513fe7f031ed35d20859fbb71c40aae462c1aa0e0ef286c557cf398286975
TLSH
T15641847EFCFD999976C0D1828B156F8FCCC300CC6919318E3726E14EAB22CD089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 2KB
SHA256 a0b2ef6ca700859215a28d219537136d01f32d57000cc9dc9fdc251dd85e7164
MD5 715d3027c14c841155581e22f789927e
SHA1 8b41de447db13258a14d135bc6aa3b4cba5f654e
SHA512 c20a2b759be1052f47e24619b5ae27410eabdf359391f749f0104aa4db80e40c5f4daef9bdd078ebd08213c1864e2185da5ad698d738569ba0aa7d7a1e578f59
TLSH
T16841857EFCFD999976C0D1828B156F8FCCC300CC6919318E3726E15EAB22CD089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 84B
SHA256 fc84f0a26bc187c452a379e178a89fcb1c9142f891ce7e18c5f8a5b5872b69ed
MD5 7e7ea2283a62ef8264335481ca63614d
SHA1 204afb050f268c46d5839a25fb5ffe5e5a1448aa
SHA512 d2b46c87a8e0180246ece028d62001a90c41b8c7c8508eaa9a25db1420d41f354ad3c1bcb57c7341bc0beeb836ffb31b6020b7796cfa78db8e418b6643973146
TLSH
T1B5A0017AB8BD889834A5C48293406E8BCCC700DC2D08608F732BE78AAA0089189E8F51
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 275B
SHA256 aaf6db3d8b609669206ebc34048c402b763d7bfe17a5d6b644a6c2014f13e7c9
MD5 bd419765e9e9d7041748d0c06395bbe2
SHA1 e6a3edc7eaa5b2ca1242e629707803b02190d8ed
SHA512 40c0225f35ba834cd1c7744e8fb3e0f45987a7100b5cf4508c409815a540204e47fdae98982242a3848240adbd1b90ce6a2436daa4c6557164f3daaf91b9535e
TLSH
T116D0967EF8BCC9993590848286457FCBCCD300CC2D18208E3327E14EAA21CD089A4E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 2KB
SHA256 bb70fe1ebc06d920de4334dbdad4b26ba348317bc7dc11f4a9eebdf3fb42946b
MD5 b1bb0e1c52b601009dc882e276a18ff5
SHA1 11400c8272ad233d4f6c4522ea78fe187a6de6d4
SHA512 08d8b1b8cb800b94416e34f42971035656c6b5b10019e4ada74571b63a9763495eedc04f768d8f500066536d4b5e740741c863d09b4701acc1588f0db2bc53ab
TLSH
T1BC41857EFCFD999976C0D1828B156F8FCCC300CC6919318E3726E55EAB21CD089A6E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 2KB
SHA256 eff8a6c7424542e1aad43528819ab7bd63e462f7b486f8f97390a2fa2558e591
MD5 9efad4548261ebe59076586b2ed94414
SHA1 1940771c2d3fb6b05f75aa46abdd90252f8eafc7
SHA512 5e4c297e6850d3f495764dd33e109ad59a8d8cd650576c511769d8d1b61f81f21d951799657b18a9d1b4041df7eb680855cce05e52928a2a3c158e043996b5cb
TLSH
T1E441857EFCFD999976C0D1828B156F8FCCC300CC6919318E3726E55EAB21CD089A6E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 2KB
SHA256 3c50759143f2130799fc0beb7e4a7cfca9b4577c779e72b2901ad7ec3154bb16
MD5 84af766994b3d8c95325ae5a5d9dc701
SHA1 744d691f0924caadc446ed9b69c9c48d457def79
SHA512 30581078be78680714aebc153d78d977c7330b8a2fbec038c84257847e28cd61a1804a4432734d28e14532de7344a66ac7fed003c53a5cc5c3d2a9c9fa41132d
TLSH
T18841857EFCFD999976C0D1828B156F8FCCC300CC6919318E3726E55EAB21CD089A6E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 2KB
SHA256 e598a65d0b575cad0a574db8633faa96a7fa939264d7da89a4da085a84f01899
MD5 8feaa5d1df024c5a5a84bee9bb5f69cb
SHA1 f7fe5c6c117741ae037b984a0245b92d58a8970c
SHA512 6082b3cd1cdf746db3b843832b82c296b01627121206b3d18ff6c4ac5a921ba38443754e43c33d17b913b216c5e271b7a60d60209d6b46be51b3162943d7bf00
TLSH
T17241847EFCFD999976C0D1828B156F8FCCD300CC6919318E3726E55EAB21CD089A6E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 302B
SHA256 c86cbea71f49deda6070524767d76ce1cdbc641850ddd61c492574c62e823867
MD5 260f6ecb66ae52d59aa180453d3907a1
SHA1 265ca05f800e9113d4b2af9d62e9ec778f08350c
SHA512 cf319b8530fdd43b6bb01bff5b5432c9c9ac881f53819f06980fada540cce2883ae1880cff128a3f2e6aa769c6b6d2675e3b87eb5746e7b65dd86679a8612f3f
TLSH
T1EEE0827EF8BCC999369084828645BFCBCCD300CC2D18208E3327E14EAA21CD089A4E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 330B
SHA256 30bffea149cdf5bfbedcb36ded17535196f198aa9723fb697a60ab2dff674fe6
MD5 7a8b4e7a9c6fff31ded24eee9e697257
SHA1 a9900d3b77819460e876725f016b0fa518b11367
SHA512 52183acc17173e6494c3d1099dcbc85abc3140887437696902d4d0b3f4fa6ec583679822b79400992a39df912cd42cad8fa5e79fa448ce33c7eabacfb147f5fe
TLSH
T157E07E7EFCBCC999369084828745BFCBCCD300CC2D18208E3327E14EAA21CD089A4E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 357B
SHA256 9e2e82a0714a3f88094615a695e04d8d1574bcb38ef738c6e926d4b957b618bf
MD5 8e5ce8d9630f1cc56cb0ddbd41c1d621
SHA1 3ba2462c5a83eccd2edf93edf3a000619846bd71
SHA512 ee42eea00cdfd537f0af76b3b21fd495f1f49897876c5d66a06fa8315994bb605e130b4f7a23d0a6446fed7f7995c7473eb33e95bf34cf54a3026e96251fa9de
TLSH
T1E5E07A7EFCBCC999369085828745BFCBCCD300CC6D18208E3327E14EAA21CD089A4E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 384B
SHA256 0b49dd81ac18eacbc93dac0c752f1fe4154cd127870a3d5d1908b346658a2e2e
MD5 9116b35cff342fffef1b111b7e9319a5
SHA1 ab5f648511c2a1d1533abeace6aea1f2d014ad3c
SHA512 a53775c72e7a38eb6875107ed7eb5925a2cc98546e5af64a82e924a45e4fb84d610df0e330288aaefd14aeb21bb34f72575194cd5a51ffbb7881209abc3defc1
TLSH
T14FE0687EFCBCC999369085828745BFCBCCD300CC6D18208E3327E14EAA21CD089A8E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 439B
SHA256 cf64a79f4c2e11a3b20147fbbc94cd2380bd99af5ee98cb1a299ed11d4ec20d7
MD5 066befebd6060e8f1bb81c0c8582ca7f
SHA1 95e986c171a8b6d591575f4de20d338e7b0f119e
SHA512 4d82248271c57b35168e1087f85fbd9b5517de46008d1e8cc04afe543f2c660ed21dba04263161cd52a683545ec6550eb5797c1ba0b39d5f31aa8cd93405da3d
TLSH
T182F0567EFCBC8A993591C5829745AFCBCCD300CD6D18208E3327E14EAA21CD089A4E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 466B
SHA256 03f2ed172fe8299fb5e08f175a5a5b8919cdc8e3e30c3df60cb2bd7f0915fff0
MD5 6f8d3521505e61d93b302ce5d217c0f8
SHA1 8f3e4ac1289e02a9c9468bdf29cad66cd05aad67
SHA512 6fd3420bb4cf4a802b7c5ddb0bec39fd80637d40834377568714d2e965162595b515253b7b0d8e696810ac736cc18be08f5e72bcc901f66edf516d46f757ef8e
TLSH
T1E1F0547EFCBC8A993591C5829745AFCBCCD300CD6D18208E3327E54EAA21DE089A4E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 493B
SHA256 c445649840538e41b8586c59b3510ebcf6ca724f37b51ae0cd5331288b897a9b
MD5 158b1629394a51bc44cb3773100ad4ff
SHA1 e7a5be759f7e83bf76217364d0bb98f228819087
SHA512 1036389db19b57113391c24cf86ee415a312968b2f529ee339ca9f58b038b4411b8c6dc711a6c0e1a6a378dc365f6316c26e7d67c9aa5ac0d7ee9d0c10c02d97
TLSH
T15BF0587EFCBC89993591C5829745AFCBCCD300CD6D18208E3327E54EAA21DE089A4E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 520B
SHA256 d8bee157e92140034017f420b6c8efc7c754bca24924e75ba5b6dab0eaada7ce
MD5 cfdb36c9b45f7f9019cf04eef02b8612
SHA1 7ca6b548a374168b50f5c79b6ffaba348adb66db
SHA512 960fddded12258821fbabdd16e3aae03ca55800fae46b7a332ddc299baeac2a211bcba31c3c06859dd46921bca74ec01c5be76ec96b3dfaf62170a7e16bfbb14
TLSH
T164F0467EFCBC89993591C5929B45AFCBCCD300CD6D18308E3327E54EAA21DE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 548B
SHA256 34eccf53bac9a0f41a370f379634c2d8802c05ecc3255009f8b31a15a7a3ae22
MD5 5c6666966f0f5dee87704b790c50e92d
SHA1 2da3df16eb7b6b1564ae2ea6d0d770a12b00bc1f
SHA512 7166f01950594d0fea16e5c92539046cdd8127ff24297305cf9445f8d712c6fab7e8d883ccbe37b53cfa97146fd1e0502e47953ff4c6b831a8d1fcd94c717d09
TLSH
T1C7F0477AFCBC89993591C5929B456FCBCCD300CD6D18208E3327E54EAA21DA089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 575B
SHA256 037178ae26bafc1b425d5fde761be99a20a24ed031dc240d9f9baf90ab0068de
MD5 5ad6b58f612b8a56601cb1ade82599df
SHA1 140e9e44356a5afcf9ee4c4ec9feecbc776d505b
SHA512 36baade5ccfe6456585d3522f6bb26473dab2f8810b1cd39bbe212bc601c285c7f3fe711f7c486e1b5944f80aa1c6c75ec84dd1818fa702eca4883ddac9a6ff9
TLSH
T1CAF0457AFCBCD9993591C5929B457FCBCCD300CD6D18208E3327E54EAA21DE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 602B
SHA256 69849a1eaf44dcbd5caeda42d953acecdd86576920584ecada8845b039c61a0d
MD5 163a15d1d20264358437bec162821f01
SHA1 f58d2bf2649c636b30684f887a0f74f224864aa6
SHA512 6b41fe8a1be74205529f3de96db65174bda7160a129fe71b25fdbfea220c79b40a47d295f44837ef6611808289240509aeec90f55f5a579d6afb867311e97da9
TLSH
T1B4F0447AFCBCD9993591C5929B457FCBCCD300CD6D18208E3327E54EAA21DE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 629B
SHA256 f5f0495eb3b9c513d93903939d6948ce66e53aa4157583a2d639cd9cd8bc7bcb
MD5 a8fbba44063fc9a11e12b1dcee01c13a
SHA1 7bbf75d6ef8112ee00cdea80c20a2b3a01e73366
SHA512 cdab9e69bc3b2a3fc80c28e0f7b69ee479721973be7084d6435babef6ecda119e5c95842c40179adbd50d1dddd0e3f9a08a26b4b91a9dd0985d053e0c29c4550
TLSH
T127F0723AFCBCC99935C1C0828B057FCBCCC300CD2D18208E3327E14EAA21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 117B
SHA256 f5c79ff952fcd80f3f8ace223ee8eed63c63be6d0db3978d651d5aca7eea4f49
MD5 b754db6d732c4961fc535cf8f8e3c61d
SHA1 c55388bde2d3ed51b5d47776060afe1b58a964c2
SHA512 e4f02e6ae7670f7768539cdf1fb3119a14f92552154d8a47201e81a445e9a4522e820c65495c195dc1a290353b6580d5ac4ef47fb5b9b793ad4e131a2870466d
TLSH
T1DAB0087AB8BD89983495958692406B9BCCD711DC2D08608E7326E68AAA1089189A8E51
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 657B
SHA256 a4f293d76a2311b5fc1cc8a7a0e6320a55818b278656615e9839b5e3b5e8f4c0
MD5 8dd15390ad06c9d7c5fc6bb01929c7ed
SHA1 60f5b94970f2c7d529590164a6abe2df1e592e4d
SHA512 35fbdd80de248acba78701943b3e11d2b98e36dfb905365ab1238e79c627c060a56b2cf1866785b4872463181dce388bf4d70d02321f0eccb41ecd4d2108757a
TLSH
T18101713AFCBCCA9935C1C0828B057FCBCCC300CD2D18208E3327E14EAA21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 684B
SHA256 fa491ee41014b2313c647e888de7e2bd98d633eca1a38df12befb8a630958691
MD5 28721d50ef2627dcffd674bbdc776cbe
SHA1 61861c59131914da1d8aebefc3d435e7d3a83881
SHA512 214a64c8a99ec95bd4546da8093f8d63a360e293b955b103809ed09c28ac4d035a9203c5b480d3666b83b9ff36888209c198b2451c2fb48714ce1ca815e3dbaa
TLSH
T11401733AFCBCC99975C1C0828B057FCBCCC300CD2D18208E3327E14EAA21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 711B
SHA256 f2628c71814502e61dfff6af0cab711f1bd206ce85d9caeb46f81f7f929835a6
MD5 5122efa266def88eccc1dead3ea2e1e8
SHA1 058a310d9620bbd6095993b808f4c63727696b70
SHA512 a8149ae0666c8dfd8cafe0a7ac9ed18cbee6f7e92eea043b73e5834612060a9e2d5959594b1f0d407fb6a6f762e0a020a1a156197fbb2a10afb76e36e617577a
TLSH
T1DC01623AFCBCC99975C1C1828B057FCBCCC300CD6D18208E3327E14EAA21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 738B
SHA256 1455ded7492514d09559f04202ebb8797dac49206ab6464aad2e9579d136a5b8
MD5 075dca18ecb6c9537ce0a10c0d91ded5
SHA1 2dff59507cda740edf1b988ce0aaced8ff1ade16
SHA512 e4d4e77cf4e3277f9a578196f9ec6f776326de7184466a3257f2d8cfdbe82c8c2d7502b87e3ab6d99fe917eb8d2b001d5cdfb2eec2db8fdfc955ff5365ce2b44
TLSH
T16001603AFCBCC9997581C1828B056FCBCCC300CD6918209E3326E14EAA21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 766B
SHA256 107d33062e544951b381fa0d8bc9fb31aa96404560bc1bebe0ddcd361f589660
MD5 0b32a342a430f0e666f2107016486729
SHA1 c78a58334be446a4efd0e8f2180aaff2c6c73f76
SHA512 645effbd2676d36503e4acea9b30cd865118d76ce66b49336a4c41cee27f0337adf893b001748f05e7e857592f1e39fab40c8dac42cf980ce635facae0f5b54a
TLSH
T17B016F7AFCBCDA997581C1829B456FCBCCC300CD6918209E3326E14EAA21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 793B
SHA256 a698a38e7ebfc67c453d011bfd7fffe4eaf34350d963d4339a883b974f15595d
MD5 3581cbcbfc964eb271342b25c5f62cf8
SHA1 524762487cd7a44084f9132e36796df13ef4254d
SHA512 cb663ffee1467059ed3fe518fa876d814ea6661872d3064ab9a1b3e1c6a28f9a4ce581200fe7996e90e6a734e049181bb63fa0c4c8dd63a1b1a8e6ed80aad327
TLSH
T14A016E7AFCBCDA997581D1829B456FCBCCC300CD6918309E3326E15EAA21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 56B
SHA256 17e606a0afc1c24d8697b9456b1e39b050456ef9d2ec40e069324d8be7993e95
MD5 a0a9cf70062335ab46484b20fdb90c3d
SHA1 a2159560af6e34a1eda52b9f287ee90f3ced0a62
SHA512 588751dd8abacd8569f4cb4b707c4d42ae80cd3beb83f7d0006a08ca5f03025154c22619ca0d4fa7dee31f57c5e3ce749f6e2b34bf79c821c15f6e303fd6a163
TLSH
T1B090026AB87988582465804292406A878CC700DC2D04608F7315E68AAA0048188E8F51
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 820B
SHA256 6b4d57479529ee8a855e640803edfc0d05e74813fce8f5a6ad29f7744f13c6b4
MD5 6174cde4eca2082c63384726095511dd
SHA1 220d59f5424131f7cf65e4672c2eab8ea722f7f9
SHA512 4ddf31ac6424d37e51359d82c49632ea16a57bf3c111acf7a8e7007a4872b292eccf187ae5c8d16f98fb899a752c4965c78380e20211f47df80853a637e88b2c
TLSH
T14A015D7AFCBCDA997581D1829B456FCBCCC300CD6918309E3326E55EAA21DE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 847B
SHA256 8728130d11076ed9d9b5ec450b6076ca13e703f628e61b85224a4c0c2a6b7846
MD5 00e639a8163f13899a8352d80113700a
SHA1 234ba734fb98e8a1be835ddbb3d7dc7046d40988
SHA512 4c7806ac53f47576695ecbb8b04308bd0a48c4b5bebf02392beb3f48c06e7b566d785d69f1e834459e65871c2092a4fac2974b303584b66fed90d6cf798e1d40
TLSH
T19E015C7AFCBCDA997581D1829B456FCBCCC300CD6D18309E3326E55EAB21DE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 875B
SHA256 984e148e095751697914bb7067a953e13e4595f7b6b1f78c7f2633c0a720f286
MD5 257ad610fbdbf805a06a245d6c879084
SHA1 bd82538a66373142ad4512ae0575c99a5d87c8ad
SHA512 0e0806f1601dc0880d7f9f9e9d92e481bc646977d698fa840d6460a2bab014ae2f936624b245094973af9410f5fab9f76612473b9e95a6b201250fbb058549e1
TLSH
T110118B7AFCBCCA997581D0829B056FCBCCC300CC2D18309E3326E14EAB21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 902B
SHA256 6608996523eb0ffd6d3ae9d89fb8a9fd6a58459ba04b2d3ce7f3e6fda9e2446f
MD5 9eec4e2a08c091e098d154d70671617c
SHA1 737dfb7739d76d24733178bd22bf7fa70dba8d8e
SHA512 1e52e327e5689aeebfad91cd8950f35feb9f6ba88c159fe5cce98068d45ebe24b58d74c76f8dcc575c5238109a089e06ea939b95350245daa303062550db44f1
TLSH
T1DF117A7AFCBCCA997581D0829B056FCBCCC300CC2918309E3326E14EAB21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 929B
SHA256 982a83818142375d64c58e3c4f9e4eaf9f03bab1ba33ae5555f106b0129eaf87
MD5 1dd4d9696bb8fe75495b5d30d96f9d72
SHA1 d0e1712bfcf693bae03503a779a9b46d65ee116a
SHA512 e2ebaa44f806e5e4c624b1b40cfe787978f817e89a5f38a15aa612531a464f4c90fab987112a4102db8eabaa68e7282e015d5bdd4a91e7ef31366d75366459d5
TLSH
T1B211797AFCBCDAD97581D0829B056FCBCCC300CC2918309E3326E14EAB21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 956B
SHA256 8e5d04ee3b532530e696c7f6614076d4ad8c59c14631ecbca537d1c12aeaf424
MD5 d5634f1819b03789e13b60d89c1fae66
SHA1 629fcebadf199e095a0653c0446e852b878ff64d
SHA512 aab5d7895150a5dff2dab3e60821b15f1d4da664d4cd87fee6e149bde7d06256470417840755313026b9aa4b8d4928028b5a750a61e984aba1581841447a19ab
TLSH
T1B8117E7AFCBCD9D97581D0829B056FCBCCC300CC2918309E3326E14EAB21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 984B
SHA256 4726866a25137ee0b725b354f1672d6184a776870e98695da3b691c71c3e3fa0
MD5 13f3b2a6f81615f3bd25142de1a0e559
SHA1 bb2db023f65ede05eb0b9323b3f7e068f882a0ec
SHA512 076c912b337effdd70e7c29dcf1497fac2c19401ca4248ab7fc90b02b5b62689d3df8583e880abdf05748e5a8a5d285f82fa66802c5a5c3eb8a13e7704c562c6
TLSH
T1B3117F7AFCBCD9D97581D0829B056FCBCCC300CC2918309E3326E14EAB21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1011B
SHA256 97265e150ab93b791afbd5cbc9e68c2922d7382a62e361e5e0688839be034ee5
MD5 e9e5c4ea500c854ca6b8cee0e54aa6bb
SHA1 a12fb6ffd119f7b2fb21398a449e9cc1bad0b0a2
SHA512 77de385fcf26e424b67ecfabc22bf7aeff7930ef0abbfd514d1ea70a6e1f870e33ede910224d9ae8fb9a2aba1ec1cc771972318810ae5dedbc95e7ae07eb95f1
TLSH
T1B111717AFCBCD9D975D1D0829B056FCBDCC300CC2958309E3726E14EAB21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 29aa55e7a30f527a4b5e4a60cc7d4a5dd939f1a6d88bc65acc531b2a8547a7ba
MD5 6a5f85e2d4fa74c227e868849c3f6163
SHA1 d535fa54ff1dcdb503edda1df863d03dfa2d58b4
SHA512 813a37d6e8b3ad162d186f1fbc3eb240aa5d5d0df72ac91e4d260f23db7ab25bc137ffc2f175e9533668d485941fb765ff2eeb6cd12ea1dde635cc5a0b15bfc2
TLSH
T12F11627AFCBCD9D975D1D0829B056FCBDCC300CC2959309E3726E14EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 251a11ab2dc4b80967bb1cd529d2cc18bc72103c4de7ea4033e9b0f1ce9d5584
MD5 b474b488d5528d11fdb66b827805aee0
SHA1 f9102122ea977545e33c39b2a7d4cbf2cf9b5131
SHA512 3dc9d6008c3165dd9520762bb86bc641d4d972984357ac30382e482fd51ef74d11af77b44766f7784ed9f314573b2d842167d96daa5fb128e6e249b106aa544f
TLSH
T1B311927AFCBCC9D975C0D0828B056FCBCCC300CC2918308E3326E14EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 2607b071c35ef83461799602f125e1d05ccae183d8ff08eaae0230bd1fcd8386
MD5 1df32991ddb6e0d3e63a4e491af319f2
SHA1 e9da2a10bef34db44ccee86a1771d81644c85ce0
SHA512 fcaa8431d1c73c3e30ea27b59c3442416651252237831043f0c37f6b4b378a5b4d7b6f7f1e06ea6bb23370b5f50326b89b9482422f8dfe07015adf771def784e
TLSH
T17A11817AFCBCC9D975C0D0828B056FCBCCC300CC2918309E3326E14EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 d267274307dcecfade46010b753a02f75492d33f459cad9bd25857d1c67e8c25
MD5 a628b17111b931f1ae6ea88e161ba439
SHA1 b6e7575e6cfd23f3796330da04c8b63a90f1ab33
SHA512 05709260d957d5ced4abb8e154f6338618bfcd61363fe3bf12c286b6fda931ece077d0f943485c79a8ad24ead5ddf758c4ecc53c70911387d5af025f83b44139
TLSH
T16C21827AFCBCC9D97580D0828B056FCBCCC300CC2918209E3326E14EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 55815929f4e9dfcc678e230da91cc566587a03933ed783e96abc57fd6c130799
MD5 dd23ca5780f932491ba6c17fc3e6f9e8
SHA1 becbdc4a45d809454f4991f1ae418195ba0ef21f
SHA512 021daf30f6c022b61fbe4cd38ec25a58195ae77ce4deb5eb4313e3979995d26bda4052679d2471c98974504f3aa5241797e49ff09c2b6e79ef35dfdcdad6d40f
TLSH
T15A21817AFCBCC9D97581D0828B056FCBCCC300CC2918209E3326E54EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 01b643cdea0bcc723375430a9f59b6fafa90235b10b800097756ecb5c564996d
MD5 7fd5cdf747335d1b9d029780f8a8f5eb
SHA1 de7c58b3c66b4f529770a21038213ed1e34fe298
SHA512 5117b675ec7943c1cb7e997691fc883ec1fd345e1837fca725bb0cf3a3c39c12e1d079680252addcb48a3aca3c73cb99d0cac4f84f7fc02218885dabb285355c
TLSH
T1F121807AFCBDC9D97581D0828B056FCBCCC300CC6D18309E3326E54EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 139B
SHA256 e54588c014c33f910a2bf77809f8c69dbd5b4f15bdd847e084b741bde3405f82
MD5 008762700be15d77aab60be6b3c8c517
SHA1 c87690a5eb20e16be4b4cc31e8423cd7496df58d
SHA512 0ba5531b8196f0d131b15546a438addae99e6a2efa260a5c11cbbc75ef2e9ded63d2dad9ab4dc477e65faf85cd57efc3e2bf8b088e3f9e3cc1c34ea064ecdad7
TLSH
T1DEC0013AB8BC8A883090848282406A8BCCC300CC2D08208E3327E28AAA1089089A8E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 b65099b5cd9a3dcade4a7419d56029f52b479e96bb211a86db67010cea24fa01
MD5 1388d846e341034911ce119f286e8152
SHA1 c87e6937036c71c75132d8c0d809026e0644b18d
SHA512 8c549f124ca865daea5a77c7578a0725c2b3c19561d9301d818e97ab331110b9a7a2f2ef6175e611a5bcf101bd433b9682074724d5b0da446697fd79250c4dfa
TLSH
T10B21807AFCBDC9D97581D0828B056FCBCCC300CC6D18309E3726E54EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 7aae13ddf6210ebcbb27b92e4850cbbc544ec914320bfa2e76ad35a8348deab2
MD5 ef167c31c67d7eee4db42ea3d47ac1c4
SHA1 a7aebc00886251ee976a9aaec1231e6ffe7b3d37
SHA512 7d4cb4813d02a4e1dd9c4fae4534743adc04d786ac297f1a22b6c506aad4c60fee7f0aaf0a3bbb8edbcc4d3be108e3726d594c5a12d0ecd62506eb9ad47bd092
TLSH
T124217F7AFCBDC9D97581D0829B056FCBCCC300CC6D18309E3726E54EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 14565bb0d5adf0086ae9ca20f8f83ea5abeb6269ff5672172dc962d3b668b69c
MD5 97a5de4ea1e95f5e3abc377aa819934a
SHA1 42d43e6cebe0265fc44698defa42e237aba413ce
SHA512 f6cf46c2e18d8accecce33e0746755ebb0db65cdf93b0a2a2d76d61f08319c1d637102892773483486d47a57beafb6bae9d967a0d0525d096cafc9945b1a2e95
TLSH
T15E217E7AFCBDD9D97581D0829B056FCBCCC300CC6D18209E3726E54EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 b52dfbc36b368082235ed4b6ef33892a6af87790369d5cf318c0fd622c150eb5
MD5 337970efe9a2db4c031084c082ebb217
SHA1 efdef90fdcd638e01b22d6818772fc5f341dd9b9
SHA512 716a26040bef0b8576971afd3ae46ab31267d08196ea439f42b712c216374f07b11fc3d26c60e40ed23938969951c7b3684f15555d47d2273ad1127599d68544
TLSH
T177217F7AFCBDD9D97581D0829B056FCBCCC300CC6D18309E3726E54EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 0a261b6d4b0c830ab62a6e1f5a9a07b2f5d4fc43289572510acb56b39aabf015
MD5 468fca70775598245bce840638fd26fa
SHA1 b12745477ea21e72683a3db8daf13b21ebc4d964
SHA512 5f21fc73821bde3cda25640f477e180c5c2a2695c59fa69297b0c043048c5ddd5a1036d815776a1d050e0e8a8560f14b3418f5671d7567271b205d51eafaae69
TLSH
T1B421727AFCBDD9D97581D0829B056FCBCCC300CC6D18309E3726E55EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 bc62b84ae8e629932090c333e92d966fa2147b45e59ecdc10168aa35bac530b6
MD5 ba994e65da768f2e1d3f5a6c46f7bcc9
SHA1 b9a25148648aff0f4e6727116d0dd977f5921eae
SHA512 b5aeff304d9d8cd58daf0ed0533c3a54e95443759cb0d25d1700e09e10b3a9d03745b4975d67e8c42edc3b73d55ad5ea2c0a7143639662e1f6b0280f39d9423e
TLSH
T12621717AFCBD99D97581D0829B056F8BDCC300CC6958309E3726E55EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 fa98af3fb2088399063d392bde0e02179a31940362882367582181c697f0e36a
MD5 8adc8dfa8d6c945876e0ca3409eebcdc
SHA1 b39bafc9df69fd060a4a47a718862ca4d35bfc1c
SHA512 a6d8d45e72546ac5f0e29d92ebd6f01e38bcaacf3ba2f86b5a86447087f65c15b706261a326b9775d4511660fc22d38bfe790c05bc37e00eb22269132085a76f
TLSH
T19A21627AFCBD99D97581D0829B056F8BDCC300CC695930DE3726E55EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 140ed3374be39dc9eac94ff402726786713a0f3dac65d3899d14f3aeaf3a3660
MD5 8f80c2ea4083cf752f17af631c83938c
SHA1 eb80a9fe6af9c2a2ccd9a48bde32f50825bf2304
SHA512 7061f1431eaf7eceb16b56183a915b86865e6f47fc7a82f8fab36aec40df1aeb6b6f9e4eddf6475ca8ca5e55cb043d4e3496761f6a3acfd71e450395a43991a7
TLSH
T1A721737AFCBDD9D97581D0829B056FCBDCC300CC695930DE3726E55EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 86af4e25b508a14070afea707414e9da92af4617caff2e782186c9257eb5d8e3
MD5 06fc963486b6621224a2e1bc00f29e22
SHA1 72e64715a04be1dfb550c9bb0515644e04b56cad
SHA512 5aa2431610c0e06d2c6859c306904e8065a2069a7b36226caaabbf2126c427de2a36bd5bb4af003bb5dd9e3c41260591fecd2ae49091dd0c0020645a3508688f
TLSH
T19B21827AFCBDC9D97580D0828B056FCBCCC300CC691830DE3726E54EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 4d71b2e995796991319ad7426306620994a4ab372a249cfd7659f94415363a70
MD5 1ffe752cca46e73a12540b9c37ddc123
SHA1 5fc02ad67192806ef7d6ef9a43c0169f46127d6a
SHA512 28ba0d5dca02f48eabae09e7b71c15b1111c4d4f5d3a469530bb2d3a84469f51730f86883e0ed6b8122bdaa828cb075e9a2bd01bdafef5802b62f53391b7b32c
TLSH
T13021817EFCBDC9D97580D0828B056F8BCCC300CC691830DE3726E54EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 994066e2abdac7e86505f4b13281714e998fdf20f8d42fcbb22a1da531639683
MD5 ca7fb6aadb40d41056d6c06cd75f343d
SHA1 9b9de5564e84c4c8a1112a4f96ae1a99f9b3416e
SHA512 0e649605fdb46ba7799b91828309d63f44023bf5807cedd4778080d5c98b7768c6c26b610ac0412f33523b0e889caeda5d167c4b91d1b7393a25acb732d258d3
TLSH
T1A621817AFCBDC9D97580D0828B056F8BCCC300CC691830DE3726E55EAB22CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 8cd491757aa11e2a894477ffb4e5c820a2cbf872fd9152d93f147717e5761374
MD5 45aeef296e424f3faf92088ec106183b
SHA1 34638e01fecf9c78fa179200f7421a299a5c1cf6
SHA512 c2e78a5280e42f94670ccf1d543777232977e6386f608995bd7988d56d1cf4183bcb4623d7c3799c7e9d9cb2e3a6ccd9cb655e2a1660eaf77d48a05e622c5f34
TLSH
T1F631807EFCBDC9D97580D0828B056F8BCCC300CC691830DE3726E55EAB22CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 96145a7e0165feb37e622d2f3578de7b436cea754539c0baae745b1365807a17
MD5 cc633bf221b1f2de501714d6617de6e5
SHA1 61ce3bddaeca887fb357bb448bbfafc7baf63688
SHA512 80a2800a0a8bccd0d027f192aa0a88c00a66833ddc25a6843d9b294814a1c32eeae7c828bbd1876ea90bc963cfd02f363a89f24fb34efc382b0bc753577800e0
TLSH
T1AD31807EFCBDC9D97580D1829B056F8BCCC300CC691830DE3726E55EAB22CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 f1f9e168a5552450ec87c87c7453fbaa33b4bde4abe248e0127b831ddb974074
MD5 34b561176b94b576cc57a72cb403d9e9
SHA1 685d1c38d41f4a51480823ba925a04cff8aabbdd
SHA512 1e8524e3cb7ce2a4a429460cd4ad8060cffcbd1fe980356792cd51f49fe79b92a56cfa57aae3c626dc8a2b6b893f72c76be8f8219c491129e2fe6ef42f71c8b2
TLSH
T1F6317F7EFCBDC9D97581D1829B056F8BCCC300CC691830DE3726E55EAB22CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 55511e35c9bf5f9b184b06b4e419c9849a132c8b0a0b4fb8f21cafa4dbb1997e
MD5 3e66e7bea8208bf0ebb7dca660d0378c
SHA1 ad85412aabd47d355a5e605f8e2e91c23b97da8e
SHA512 210ab90a834390b82f5fd817c9dbfb3145696fd939502778582ae49481ef23460e992a3c6a8b2e8aa57cc1b7781fda8b9517beb1e0ab33dd17da86109d26b5a4
TLSH
T126317E7EFCBDC9D97581D1829B056F8BCCC300CD691830DE3726E55EAB22DE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 166B
SHA256 a56143fafa187af63fcf19646253d59fcc1011203492a1e9f80879e2460f960d
MD5 976d06b50c71059ae5a99b2059f0327e
SHA1 393c98f90c94cd36e249909449f2ecffd652c1dc
SHA512 84ee26b169f66158bbe805527e7ee8369b604f3f0654c9c478b5ebb48109548512cb90503f4fda59050508656e80b0b58b5926f404bc00a3e5d58c7d7495d2ff
TLSH
T142C0EA3AF8BC89883490848282406BCBCCD300CC2D08208E3327E28EAA10C9089A8E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 c7fbe3cacf816ad854615a8f66e0805bd1790c4b70f448b61faeb2aa6139075e
MD5 8ddf73c7d5b12cecb9663ba530895693
SHA1 e21b4331e746910807afee3220e4f38e30f6d2b5
SHA512 67d16a0d14735e84d8108a9c11357df213ef381e5819e9fff3f3b80db9c08c0cc42d719a89c4a266b837977dd25f89d1e04c0cde3ddfbeb101817e9cd0d849d4
TLSH
T10A318D7EFCBDC9D97581D1828B056F8BCCC300CC691830DE3726E55EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 d6662b75fe2daa304781e63c9dd36f1de2d59a431999f7f05dec140e967b4b4c
MD5 0f155c3a488f9086049d34c2b4512933
SHA1 78d060eecfee5510edca779537133d35817dfa64
SHA512 db1146c5ec86d4279c92990304fb48a78d444b2564ab0c3b75c04bcf1b6206ab8554775540aff6608b9809e47aeb61774411b1076271f92eff2721735c8ff07a
TLSH
T1CB318D7EFCBDC9D97581D1828B056F8BCCC300CC691831DE3726E55EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 55d2e8eed0e8c39e308f3a2ffb0c5a144bad11192adbe1753821970c202461f6
MD5 45dc904a0d319e988aba7ec74e4d6b27
SHA1 1372b9d6cf978aa6df5bae548491214b48c126c1
SHA512 40f9295ff2cbed43568de22e1d01543f3bf1334a100c99419a39624cb92b1daaed77802b68cb6ddaffa9976714928de9b0e2a0eb53f7bea3d900c364e26c342c
TLSH
T120318C7EFCBDC9D97581D1828B056F8BCCC300CC691831DE3726E55EAB22CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 26236c9e5c9f7c5c2929fdf7bed537d5cb4570e6818ba3aa94279511701cbff6
MD5 29a7496720c065cf46ef90f0f2771229
SHA1 7940b203027f23ee64addf66c81b8812652a7371
SHA512 0f59e80077b60bbe5433e21866c8bb7e54229e6b490a3d42243a70facec35defa06b51632596f442b288a9794f1f4d3c67be2a2cd96730880d928114b8b2643e
TLSH
T1A5318E7EFCBDC9D97581D1828B056F8BCCC300CC691831DE3726E55EAB21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 1b65d548c7259358c5928f5ba5be2a5bcc724e61a25455f2466c1c9801e9a14c
MD5 5d86f176198ce2f135471d32d625d981
SHA1 2e8cc10051398fc66c202d8e6b66453a93b9a4e6
SHA512 28634a6e78a8a7fa3428e9f11302f8be496e5517317af2240f6c040e8700c06d226d1b1b0fcd10766bc32f15d072cb2cd52cf704acb686dd73924595810d3d01
TLSH
T1F9318E7EFCBDC9D97581D1828B056F8BCCC300CC691821DE3726E55EAB21CE089A5E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 ee240c290670d61846cd78a51c15ce39b99cb8235a41b65f28afbace5605564f
MD5 e10947c7b23d5ac309ab2f8fc6f67c94
SHA1 7817caafc06f4383613ecce57768e5a5aba14b09
SHA512 85e8844c56e1f566bc817e9f64558fd5f6f519f6e83d76a32330ebeeb136b84cb7ac9fc61f37982dd50b5e2a9f8083afe8faf33c403adc01044695566412466b
TLSH
T107318D7EFCBDC9D97681D1828B056F8BCCC300CC695821DE3726E55EAB21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 9a9582de1617cd3520958cb92a63eddc0a1a3c73f0570ee5e675b8d2ff76105c
MD5 457ce81289e0ef1766ebc9daf994047c
SHA1 8cd0d61d368e93dbb85c92d77bd5f07c75e396b6
SHA512 55b488d1d4af6e9f02e22cf41068145cb780c0ad94bcceaa48f6b0ad439850f50699262ede102a7519f672f8415a043b46bc69ede88efcce22c9ba1cf0b288ff
TLSH
T149318D7EFCBDC9D97681D1828B056F8BCCC300CC695821DE3726E55EAB21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 193B
SHA256 670905cd3657270860489905c726ded23131b0634819e039f43893f0d7bd73e1
MD5 0873f455d9eb4d91b7b2b2b0de1a7354
SHA1 36021f6d44a36fa81393dd55bae25fabdb3fad30
SHA512 6520b254c346f8db8589692ff098110a30857bfc62ad844e95139f9f7580fef860f0f25eec053781d05561248d79abe86c722658fe7f290f518dc697704f379d
TLSH
T179C0C27AF8BCC9883490848282407BCBCCD300CC2D08208E3327E24EAA10C9089A8E42
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 dc29287762cc7a14a1c4145c8d3f875799ef0abed971e1f5960a9a69b846d909
MD5 772d8c8bcde8434c9d53eb06f7fb311b
SHA1 aa366ca34ff0fb8ce851cadef49d9b515d53b417
SHA512 27bf678a28272901d18ccba8e095cd31216b3ea11c3428865b822434cf27691d104a535945dedfd4eeb58df2e72a05947e3cb82af41b9142084bee58c709b6c5
TLSH
T15C317C7EFCFDC9D97681D1828B056F8BDCC300CC695821DE3726E55EAB21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 67bcb7a640227ed374cbfb36a9057c111691dce533b0181484e966982d8af56f
MD5 34bdadb01152600e77ff8348f491ca9a
SHA1 3653dcf5de72371c6b635a41de036930cb46d872
SHA512 4c63f68981361208b51251a47ffc5c3dfc3fdb0b1c27f11a25b44b62ddeab3296af5261f393b2dfcb339a1a79b425c51304a46ca8042438ad9a77d418cc56731
TLSH
T1D4317D7EFCFD89D97581D1828B056F8BDCC300CC6958219E3726E55EAB21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 1KB
SHA256 72f0b2a81bd55f69cad0251e60d965a8cffae4bc1a4a01cdd70475e2987540b4
MD5 026d6a44a58c49eac19a0a7d38b8c6dd
SHA1 ed69ab521707465359fd2f16928a972d082fa7a9
SHA512 44b818197f07d66ec02691dd9a5b34734e5d4338d3053dfb70977d6b9865abb09891d134b30993a649fac81bedc434a528988a768e8f6489466ba25c63eafb45
TLSH
T16C318F7EFCFD89D97580D1828B056F8BCCC300CC6958319E3726E14EAB21CE089A5E46
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1780-986-0x0000019282E90000-0x0000019282F90000-memory.dmp

Download

memory/1780-1018-0x00000192946A0000-0x00000192946C0000-memory.dmp

Download

memory/1780-999-0x0000019282C90000-0x0000019282CB0000-memory.dmp

Download

memory/1780-985-0x0000019282A30000-0x0000019282A50000-memory.dmp

Download

memory/1780-970-0x00000192801E0000-0x00000192802E0000-memory.dmp

Download

memory/4948-1264-0x000000000DFA0000-0x000000000E81B000-memory.dmp

Download