Analysis
- max time kernel
99s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/06/2026, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
- Size 5.8MB
- Sample260630-ehr8aad17x
- SHA256 29974b816978485889f33a268687293e509c37218a69cf6fec93c8d1e4919b5a
- MD5 c26866a99c8365ca90629dda9f88dff7
- SHA1 fcbecccb0984a932a1579cd3835ef0b726b28c5a
- SHA512 4c9a52bf346850ef9d848eee6bf660556ca7ba10ba9e1ee6ef4dc611e5424c519178be34c6ffbf2796bd65718d802868dab49da2cc3a81af52e32b00f02a15a3
- SSDEEP 49152:VBGmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2i:3DiH9MfT3NwMkKhBRr0yAk6qkKvs
- TLSH T1C3568C22B902C139E15102B159ECBFE9C49D99348FB105DBBAC41F7E9A613E33931E67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lsass = "C:\\Windows\\alg.exe" alg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run alg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe - Executes dropped EXE 3 IoCs
pid Process 5508 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe 6064 alg.exe 5916 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe - Loads dropped DLL 31 IoCs
pid Process 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe 6064 alg.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in Program Files directory 29 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX8EED.tmp alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX9335.tmp alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\RCX9BA3.tmp alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\alg.exe alg.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\alg.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\alg.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\alg.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX9111.tmp alg.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\alg.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\RCX94EB.tmp alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\alg.exe alg.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\alg.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\alg.exe alg.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5508 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5508 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3172 wrote to memory of 5508 3172 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe 86 PID 3172 wrote to memory of 6064 3172 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe 87 PID 6064 wrote to memory of 1716 6064 alg.exe 88 PID 5508 wrote to memory of 5916 5508 2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe"C:\Windows\temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe"C:\Windows\temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe" --type=collab-renderer --proc=55083⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5916
-
-
-
C:\Windows\alg.exe"C:\Windows\alg.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\temp\*.* /q /s3⤵
- System Location Discovery: System Language Discovery
PID:1716
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- Size 247KB
- SHA256 018a335764c0c391a80861e1f2bb25ed18877cf9209fdd77f97aadcec0f0ec8a
- MD5 f14c95205dcf8b94919e2b2dbfc7a966
- SHA1 b06987f4a842cb16f7897b6536588c8b9ceb836e
- SHA512 722f99d758dbc0db1144b39d514af9c28111afce296267372eaf1cc0afcda0dd03783175d0c7b03312c0f20f4e709715c292b29cbc4268b24f7ff2b10617f077
- SSDEEP 3072:oHE1RUp3cKAArDZz4N9GhbkrNEkjkAdWdA53Pa4sjSTXEHb5CZCq5DACsVlNl7Hq:oHiepxyN90QEmdWmsjF4N5QVrZZ7Lxe
- TLSH T112447C127B8490A5E59313723EFD6AD44BF5BC329AA4509BF318BD6B147F310863632B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
- Size 399KB
- SHA256 414b57ff48c60095a475cd584fc77167c2624277698084ceca2231d9ccebd090
- MD5 54b732ef6e221f567836ee6d236cbcbd
- SHA1 f8e880f1ae7274bba4ef67458038cff804f6d0fa
- SHA512 6e1832781d1b9b145a72a8d6427c27b37bcd06b210b88e1dfd84c98b063b970fc2c4d4b1ca759bfe8ae9adfae7b691122a1dc8107a2024b98d1a6f30be835af3
- SSDEEP 6144:OW8Bi7Q5VYNh6edjvCi7Q5VYNh6edjvw6L6jAVnhH1Am2ZBU4M528K:OZ4Q5VYf6exlQ5VYf6exwI1oB86
- TLSH T151941A013FA18FB9F5A2C0BF197A671D2A66B9160B10D3C373706B59CD225C9CA3E365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
- Size 399KB
- SHA256 1880293774f09c47bc4a1eb188f6e907986d47f3c2e142ef6c5a16ee49cbab6d
- MD5 d98d5dfe0d81e03c104a4e3f08f7c2d1
- SHA1 c798d3e56a4458ce4f12154e1fab84fb26ea9ecc
- SHA512 dd99fec706adc13b705b5860cbcffe2d55d082a61a245eda3243a9a9483b4692b7642e3bbe1a1945143133a83643f548cd92573a0a08d441f8bf593872a57859
- SSDEEP 6144:OW8Bi7Q5VYNh6edjvw6L6jAVnhH1Dvw6L6jAVnhH1Am2ZBU4M528K:OZ4Q5VYf6exwIjwI1oB86
- TLSH T1F9944C013F518BB6F9A2807B5D7A671E566ABA230B11E2C3B3702B59CC321C5DE3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- Size 9.5MB
- SHA256 3262430edd0ec75d6b91d225afe290f9fe2b15b434487037f91612bd325d01e3
- MD5 927642da24eac8c32ce0f553e14fa04e
- SHA1 ad0dcb8c3df9f4c287d394654462dc6651823a11
- SHA512 14749facfc5d900df51ccda5ff63ab49483c79c132fa9c246e71417992c22fddb2ffde13b78e4a8e999e1538b42fa580b9a9bcc3b8a936389f34dfc3a93e0af0
- SSDEEP 98304:IrbubT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTM:LXnfW/JLGMcblLheTM
- TLSH T13AA6AF1E7BE21036CD732175AF4FA105E738D007A215C6977ADC83981FB1AA152B6FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- Size 9.5MB
- SHA256 cf845fb25ad51ca68301643f269a945704e89c3143ff3d0d5465f12c999418c8
- MD5 01d0b0b533e5b6bf212b5b92e264c4dc
- SHA1 80d4e4923bd0e8115fa1d23aed101b8fbef6a868
- SHA512 36d17ddb8ef4f2a4a19178c0e12825724851a8b71c32ab82904b4ae3e089b7f4ace0d5e2b6b0626511a89d072ed7f823e3eab4795a22220f367204da593d07d6
- SSDEEP 98304:IFbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTM:MXnfW/JLGMcblLheTM
- TLSH T128A6AF1D7BE21036CD732176AF4FA105E738D007A215C6977ADC83981FB1AA152B6FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- Size 25.0MB
- SHA256 58f871dbba6f07cc7feb921b257865dec706e6943e3fbd227dd0a151924b1b55
- MD5 a4a0fb00ab84850b6e8da6370d73b25e
- SHA1 0ce3285f878d5ea66f8750374c6a10d675cd15ef
- SHA512 add12f459ade2028429f90e741392748a76a536ae50dfaa26a0de133dd29508ecc8cdd0fa01cc67cfbcdf04eaf49ee24a4f513e777832c22cb6e63f1a573871a
- SSDEEP 393216:+wChNVNyPQCjX7F2/pe6y48kNZCbyaKBArYxeMmIn6F8/wuTFYRfE+IzXTO9Bz:XC1rq2/r+bqAzMmIn0BuTFE82z
- TLSH T147472274861DA679FD3E82F51DCF02A688CA4DF15632F8C5F9925E384E2722037B5B48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- Size 25.0MB
- SHA256 a61e84809a98c25d8f23af278af6cffd86e89abe68f4f1a4bf7df276fce8456a
- MD5 db68a089ed6ca5d7a055ab744c26f143
- SHA1 3238354100d11552fc5372c29f34d00828037ae9
- SHA512 5242225bfa014709a707c38a38f4454d9f428e2aa282e30b4405ecc338dba6379529dddb63fdce02142e2d9f0ebf7fdcacf0ed3ee31acb23898e07728ec77079
- SSDEEP 393216:5wChNVNyPQCjX7F2/pe6y48kNZCbyaKBArYxeMmIn6F8/wuTFYRfE+IzXTO9Bz:KC1rq2/r+bqAzMmIn0BuTFE82z
- TLSH T129472274861DA679FD3E82F51DCF02A688CA4DF15632F8C5F9925E384E2722037B5B48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- Size 2.5MB
- SHA256 497c039ddf48dc480e2dbf64d19748515086e1e6de766a9cc19f60cf988ab786
- MD5 3777080f1620814e6f769a7c68b343c3
- SHA1 99fa84e3dcc09b82b8be74d4713dd91cf007999c
- SHA512 fa2a02ce49ca6e9e7c73d470b089df79760308498cbe42fee86fcc0739b305f86dbfccea2f0100328e27aaf2d16f94b7d781485b433831803e98c8ee6b97ed45
- SSDEEP 49152:yePTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJS:yePTfiG/nzU90m
- TLSH T18DC5A226A2C8C0EBE5642170CC69BBF900546D78DBA2CDD7BD447E16B9307D29533A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 140KB
- SHA256 2a735560ffa8a0d3a6fa10ecaaa952cfc689ddf65d204b27a0d86a87fb1f7a76
- MD5 180f31bc82659034b62200f02ef602a8
- SHA1 3edd140c838b7993189e3836a849071afae11f8f
- SHA512 6014a906c7169dadd135628dd566bcefd23ff71af96e61b925f993c28df564c265b0e218c5c8140f9922975d1e1693878c968e0bde45680d589dc8c12ad3c052
- SSDEEP 3072:AHE1RUp3cKAArDZz4N9GhbkrNEkjkAdYJEBXgr7:AHiepxyN90QEmddBwr7
- TLSH T192E3D09A7F5C98B1C8A246B16C3FC7544A35BEB17950C123A7A1BD2FC876701CD2352B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 158KB
- SHA256 767337efd2245023963f3f84cd9e3d00687f190358020df002220e0b74e10dc6
- MD5 a711e352120517d4689ab68dfeb78898
- SHA1 cd36535ec7f59ed12f9aaf28d1129a8caae7daf8
- SHA512 b2a8d3e2e758b1182e7709556a033f2adc44644fdff238af37fb8f44f9e25f8005a707f9ba1c91ced4273fbacd53c688c9e2eaa698234970f7905bbb3423e8ae
- SSDEEP 3072:QM6GC+QAtArDZz4N9GhbkrNEkjkAdtM6GC+QA8+HlJF:oAkyN90QEmdHA86/
- TLSH T170F3C02376B184B2CAA353F05C69EB4DC67F7D704B60425763C4AA7B1D31A82DC3265B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 158KB
- SHA256 ed86e613f0b8da8a4a93c76d717954a667ee186b7ada2023ed3b88e3db8dbf3f
- MD5 7114b7c9c2e33e00c40d2b4ffcbc19f7
- SHA1 dce451a519f3199471c474e4cebc49f1c56e3e4d
- SHA512 9f1fc18862735030c36013da89a38e3514c47df9a4b5f02da77f4043faa031a98e7ca3f1cc462327f1c1597bf6d70a6d0df0725462905399beafc939c39ffa1d
- SSDEEP 3072:QM6GC+QA8+HlJnZz4N9GhbkrNEkjkAdtM6GC+QA8+HlJF:oA86lyN90QEmdHA86/
- TLSH T1FDF3C01377B144B2DAA347B06879FB4ECA7B7E704B70815763C49A6B1D70B829C3261B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- Size 5.8MB
- SHA256 2a188c22a66965c4fa405b34f8f37d918d116f551238e83c907f8f1aa1ac8bc3
- MD5 c1148381c6b6f055916ca1d338b3aa25
- SHA1 6b6cd05b0cb7d91a41719872cc8c2ec5b54a12bb
- SHA512 6398a46404406b1b5101ce8d5ace5d18f8b291c686bbf3cf33c848742bd02e6a818296534569dc5f3d28bf15d77ff14c0ad27241afc30a0bbbf8181c21349d56
- SSDEEP 49152:HGmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2Pa:HDiH9MfT3NwMkKhBRr0yAk6qkKvs
- TLSH T12B568C22B902C139F05142B159ECBFE9849D99348FB105DB7AC41F7E9A623E33931E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- Size 5.8MB
- SHA256 29974b816978485889f33a268687293e509c37218a69cf6fec93c8d1e4919b5a
- MD5 c26866a99c8365ca90629dda9f88dff7
- SHA1 fcbecccb0984a932a1579cd3835ef0b726b28c5a
- SHA512 4c9a52bf346850ef9d848eee6bf660556ca7ba10ba9e1ee6ef4dc611e5424c519178be34c6ffbf2796bd65718d802868dab49da2cc3a81af52e32b00f02a15a3
- SSDEEP 49152:VBGmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2i:3DiH9MfT3NwMkKhBRr0yAk6qkKvs
- TLSH T1C3568C22B902C139E15102B159ECBFE9C49D99348FB105DBBAC41F7E9A613E33931E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
- Size 255KB
- SHA256 88f100ff3df14ed15149aed03b7fcf44145fd72b3eb3aad4b6301bdb18582b64
- MD5 b2f992dbb632c892b0589b571d8fa055
- SHA1 931c4e9b231be1c687fdda80a28444d31933e50b
- SHA512 28e55a83da4163f159b7b089cd2643106d584dc141f6bf08a81d8b974f8bf51c5ebff90dd35f2ee7f292eba29d7f347a20676051d4024356d1773c86a10c032f
- SSDEEP 6144:JPc53T/Cbft0QEmd4Pc53T/CbfHwCbyFdAafy:Jk9Wbl04Wk9Wb4Ilafy
- TLSH T132447D51F78BC672E99202705879AFBA41ACFE3C0B6114DBF3D87A1B19702D3153266B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 203KB
- SHA256 961516ff3d8aa4c43b13c24a5b1bb6d09e43f8cacebcdb40b7c2f5f54f5804d0
- MD5 d104a23f7115144f111b5c3535ede46d
- SHA1 c5ba332002a0186cb6f5d49a67ee6ef7de30255d
- SHA512 1802a51849855898952c4f2b47050aa304d626fef8591ba86cc628a69c04e4f0a71ff67cc6d3697039329bd5bef924b811004084f4c4aeb09148480c77090454
- SSDEEP 3072:wiselSsONt3F7oQGO7M1bmq9YnyoQGhbkrNEkjkAdLiselSsONt3F7oQGO7M1bmg:wvldRQ0QEmdLvldRgLd
- TLSH T1FE147D53BBD1C8B2C7A202305E74F7A796ABF9748E60CB277B8C171F5D744828D08A56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
- Size 325KB
- SHA256 84c7019c86247e207e5edb0a09eb5154a18fac79d5a579b627986874798f0cba
- MD5 ec228c6a108c79be5858205a986711c1
- SHA1 ad169928f9f69a9f8ef1b55ae450df2ac6ffc298
- SHA512 f08f0328efb30d4d797d9018f13fe2b79544334a2e2c2e5f063e084c5f55bca6bac7c9f4c340fb1f5790b8bee0037c16d6c6b79151c9769c21941cb1c89171c0
- SSDEEP 3072:wHE1RUp3cKAArDZz4N9GhbkrNEkjkAdsqcVz5fzsTl4dsOc6v2vTzwU+Pho86med:wHiepxyN90QEmdFcT93PiY+Fa7BdvGX
- TLSH T17B647B307B4AC57BE99201718CFCABBF4429BE551F6441C7B3886F2E5DB06D26E32816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
- Size 457KB
- SHA256 18077e2d896da8451ad55b895d7c72afb10571879e3ba0091b61d40f85a41a1c
- MD5 d4b0ecac01c508c8c7b3d451237cc73f
- SHA1 bb062f0da5d83027a25dcbbd6c02a6379b2bffb4
- SHA512 f6e5043cedebf30fd04db3e8bb22d8e5747d0de40bffb83fdccd4cf6e6cd2e66f3e8d36f90af7d34ec2857e97583fa5c77ad912d34f370e4b976f055c2601510
- SSDEEP 6144:CHiepxyN90QEmdZ0RsrJ3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKE:CHy904IqwKhHSDeWTRW8fdebE
- TLSH T1D6A4AE11FB4AC1B2DC9201324DAAA35CC4BDAD715F2186D3E3D87F1E9D702D29932B86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 196KB
- SHA256 e1004cce943ce9b6234e3a9e27383a238319efb5cbcb8f8df65dd1c278590fec
- MD5 e21cf551102ad5917189001f7f750da3
- SHA1 24d4f41b50ae11bef38ea595cae9b59403004d10
- SHA512 adc04d60ae1a071285ea93cf47ff160a72b67bad6f23c683f5bef0ff1e603430d0ddeaa25f25e4832d12c5a8c0fe4b8faf88e22e85141602de7ee64c71ad90bd
- SSDEEP 3072:6HE1RUp3cKAArDZz4N9GhbkrNEkjkAdfKrMzkm8PL3E7Qw/STyr5Jks7Mj:6HiepxyN90QEmdVzkmIL3E7QPQLk
- TLSH T15B14CF657B64D072C8D24A705D2EC7A14A3ABC326A90C017F7E47F2B9C71790D62732B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
- Size 214KB
- SHA256 08b0bc716bd9138d0e5503255860ed0346219719a96649fe6acfc062dd18510b
- MD5 e91acbf68adc249ef4c7aac7f02ddd6e
- SHA1 eead05733105b9386b4a295f4bc8cf43b09c3c07
- SHA512 b8e46f44d98fd8ce16f17754be580f197ea4642fe9eaf611556ac7413908e18e70705f6309c6aa20b8bac6fe0c2e8fd65725b5a72f99ff10a1e53a4f926ea2c7
- SSDEEP 3072:TilU9xK7HN1GhbkrNEkjkAdGilU9xK7HN9fN8sFOE1Z5Y2965:Ol0kN10QEmdll0kNr8stZ5/65
- TLSH T1CB248E21F1C15571EA7601B25E6F6B9F9428F9340B2194D3F3D88F3A99301C39BB39A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
- Size 349KB
- SHA256 b9118871f03e5fd04d58cf26e265f20bb3ef4cd4c19dda0ae7f05ed382276ac4
- MD5 2c6958d77f8f3388a629ab3c6a7d81d0
- SHA1 9556e91edbee24a30084c177f3b84180a41a5b08
- SHA512 628fb307565003b8abb7b5f95b564ef3d3c6f85f3c0142f33b40cda8eb2200d510e87884dc74a6a7da542d40f29c1243b2ebcbdca76d028ef3c67e99cd678b3c
- SSDEEP 6144:vBZ6cm0QEmdwBZ6c1UKupTu8ffMb0/GxsZfcJtqQ1G:pZS04aZKK+HMYcyD
- TLSH T1D4745B1E33D848F5E467C179CA569542E3B178554B20E7CB67A0432BAF63AF0AD3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 164KB
- SHA256 1a37c06d4a9932ebdf62eaa8876242dfc92beed7a630aa9328fa3aa0e9ef53ba
- MD5 11ce97d25b611d0f6e8e922342aa09da
- SHA1 c2d347f598692e12011567c3334f56ad5b65e827
- SHA512 c28b8da81f440464093f1b4abbef988dd598498aec839e475f0bda2e879d1d6cddc97de07f0d574eca97393cc712b69365c8cbc6cdb181b2776fe906d550e43e
- SSDEEP 3072:uFlKwW/Y6w8Q4N9GhbkrNEkjkAdjFlKwW/Y6w8I:uFQw9KN90QEmdjFQw9J
- TLSH T123F3AE137F46CF63E861467218B99BB994BAED309F4157E36344672B0CB87C2593222F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 164KB
- SHA256 4ca70007b329d2e57501738349a2d8ea50992522305785febd3493d75cfcfeb2
- MD5 fc90fcc6434bec806d1a2d78df7e80e6
- SHA1 36b32590dc86d5f25e12017e1d47b2087b5a3d5b
- SHA512 56a0efa32dc127abe4ad33d7f29e1c5df252f6507d4aa8509c20361c370d8f3e4bcbb93cc84498e1525c07d7089957ff416c96f4a9582b67d370658a2f68abc0
- SSDEEP 3072:CHE1RUp3cKAArDZz4N9GhbkrNEkjkAdjFlKwW/Y6w8I:CHiepxyN90QEmdjFQw9J
- TLSH T114F3BF177F09DAB2C85145B11C6E8BA59579ED70BF4082A397507E2B8CB93C1D93322F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 219KB
- SHA256 11a1e6d249ae7ab3f61940a8fc5dae27b59c99c38379108607f063b5ff9afcd1
- MD5 50b737355acde50a2df48db19777866b
- SHA1 52bbf02d20b6121b1408c8c588e64f9bc9a6ae04
- SHA512 2dd7c4e37f6bd515476240168ac259a29e3bd73d80538176bd34d94034ae3a2a97d0673a79e87e5bc69007efa8a7d6ca566d70e6aa58e56e3be1b887afb7ce3e
- SSDEEP 3072:ip3IIJNdS3Uv6l8TRpR+0GhbkrNEkjkAdJp3IIJNdS3Uv6l8TRpR+EMucyaGoSZ:ip3VL4kv6l8L0QEmdJp3VL4kv6l8aGok
- TLSH T1C8248C5B77A520F8E5B68278C8621A09E772B8751B71978F0364436A1F337D18E3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
- Size 1.2MB
- SHA256 ba48174b499f93d2b2ac77761f2aa417ee98bec19c66c5b5cc4025cbe51b5698
- MD5 1e5d4cee22da5744ece340cc361c20d8
- SHA1 5f1cc2094b696a0216d4109f91509f98b275b0e3
- SHA512 e27515e227ea36cee0dec21ba8df3672b7edf68ec7e19c23750457e1c4ba3de2e9731acb2608ab17f47d2f61ad44551f48476d63f7e314eccd0d9d4727e4d5a8
- SSDEEP 24576:+Sgouvz0ZR51Sgouvz0ZRHkFfenxyQZXS7gZnQh2NIq:+SgouvAr1SgouvAeFfenxyQZXS7uQ0N/
- TLSH T10D55071267F94129F1F37B71EEB993645A77BC61AE39C50E5380025E09B4A90EE31B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
- Size 525KB
- SHA256 04fd6faad65afdd200bbdf59e0e72380df5918534b5178391cc7cfd9876621d0
- MD5 6393d8c9ca49563850387e8b0af37465
- SHA1 b9c4f717bd65f7b18a5d275585e0f720ed31f596
- SHA512 adfad6825837cab6216297ed7e052a1937106e5479b72b646b7a9a7ba6ace8c17f62b5ddee2668a3448303af224afa11b3b5704c932ba2392ea060f378f8803b
- SSDEEP 12288:u6dVWJ0496dVWnxlMSn7nFKbltn+Ch/m6X2:d6siTAbD+Ome2
- TLSH T128B48D1077808135F5F329778ABF9728556CB9715F6881CFA3C81A7E4E70AE1AA3071B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX37E5.tmp
- Size 114KB
- SHA256 3e8394bb74514694957e8817a016cff9d0507cddf3bfffb8b156d5e64928253f
- MD5 b58e84722f82171f2d07993b7de50a4a
- SHA1 78a131c60b4c238234af33771ae1fb80f1a457cc
- SHA512 9bddb2c0e39fea54303be5558c9337e80d18c93864190e13f1a9834af83cba0bad932a057cd6f33a903a88c32d1a247ab6e4915e80acda6643bd5468e16cb4d6
- SSDEEP 1536:1/H5C1odPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZk5:1/HE1op3cKAArDZz4N9GhbkrNEkjkAdq
- TLSH T167B3D09A7E1C94F1C8A002B55D2F8F9042796EB3758C82B7E7907D2BEC76305C673929
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
- Size 626KB
- SHA256 aafe61d5d2b89905400bb4df2eeb60a5c25425759e0944cfa26139526a80cf47
- MD5 a680496cbcc6c8e159e50ce072dad443
- SHA1 bb2ee6780593d162c488afff7597c707ef13d0a6
- SHA512 74fc041298ced8b72873c6da19275c64d11b2ef0682f2e5a10ab83701c089c466b9d621e0308abcdb2508f9b5f2f6e6f046591cc8d19d8310bfa737e4554dcfc
- SSDEEP 12288:gQJ7O04DQJ7RKv89GDYikjjqggz7/PtFxRNWBYrpc:vJ7esJ7RKqjjg/PzNWyrW
- TLSH T1E5D4CF2139A1C032D27311314D6AE794777EF6700A6249E773C4AFBE2F349C1E725AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
- Size 192KB
- SHA256 9785a7627ddcb05610ad459359d24505fdd5c9263b263044e97d3ddd1da1af0b
- MD5 33fd4e969505f51b5b3b3e1519a75216
- SHA1 17c0bb9bf7d644122372cf6923043cdc75077b65
- SHA512 97fe9e075ec08d4eb6c64b492d17df5b5123f482a525f5f167ace69b0874effcf6eccefab5680b6e22ee6618d5fc7fe8453328dee28eb17bba29d6792145907c
- SSDEEP 6144:CVmRFJs0ug1MOl0QEmdLVmRFJs0ug1MOc4T:g0s0udOl04r0s0udOPT
- TLSH T198147C2179A0C132D8E2217489ECD6621A3E7E724B748CC3379427EE9DB13D29B75367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe
- Size 397KB
- SHA256 77b5165227caa9058932056d2783082147877a519bdd6ab537025f0e7222f0c0
- MD5 7dbfbfb44be083ab8286f3f106173ff3
- SHA1 88e8a94d170c4e7bcb13eae250194c713ca5e836
- SHA512 b77078531d82699e166706b03016b94b1ebdcfc1f529f39d48a62ce81ccefe2cdbbb0f33495eaa8ac65fee1e60218df4f2d3d2bbf3882a89d883c0f060d12d0c
- SSDEEP 6144:pWPZw225bNz0QEmdsWPZw225bN5zFEjGkqkAJHyEzYV/PvyX:piZwb5N04SiZwb5zzFEoS2cPvyX
- TLSH T196849E99B39018F4EC67813EC9658906D6F2BC660B60C65F13B436671F333A11D3EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe
- Size 397KB
- SHA256 fd494b8641a0ac7dc8fec2587a2ffc9a18b05c7f3f1adc1a91c46975153feba7
- MD5 9f727ec4f34f27b2e17f73c9a312d93f
- SHA1 c957afb5d35712f6d860239c41217b3791bef8d5
- SHA512 86e1492abd36d6dc878a3a6cd6f93d49c8ae16f4e9eda45aa292e83cea1a7eab9bb2dc1512a6837b9ec12d2e38bb79b3466e1a7d25987b99eb106363024b2675
- SSDEEP 6144:RHiepxyN90QEmdsWPZw225bN5zFEjGkqkAJHyEzYV/PvyX:RHy904SiZwb5zzFEoS2cPvyX
- TLSH T1AC84BF95B7541CF4DC63813ACC2A8A06D6B27C661B60C61F13B43A2B5F333915D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaw.exe
- Size 397KB
- SHA256 3fd952592df8408dfca0bf73c22b4fbb2ca9f8bf6de563f598767c0ab9b966a8
- MD5 eca37f1a55c5d35f3998e1aedb2a440b
- SHA1 cd24c5fddf0f8c98e0ac1ffaf2b9e1643cb142c9
- SHA512 5e66de6cac7ef8a476e156b7cd5e5d280cdee7bf1a1211e76a054f8097fd82ea9c268012df273d1e1a9873ba125044ff573829200a6aae1c0aaf89c3502dbe64
- SSDEEP 12288:PCd9/WYoS04ECd9/WYoaLHF3z0z04PDvhD:aTWK9TWaLl3z0zDD
- TLSH T1EA849EA9B39018F4EC67813ACD568906D6F2BC660760C65F03B436671F333A15D3EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaws.exe
- Size 577KB
- SHA256 29270141dde16194ecb2fb8b0c5f5a7eff460a4088b13e3839ab6503d4b5ae11
- MD5 4c24ae82fb6d51c3b95d802a0c8ce196
- SHA1 809ac5806f2c251f04de89d5e6f1622155dc5fe2
- SHA512 b1b4e05950ee8d24d73a873cf5960acaf31b003255e41bf723ce09e48e5640e8be57ff16c3ab5adfc9cf5cce60c0190d741348894d9405d9e855ac7a7206a870
- SSDEEP 12288:Vi4e7+040i4e7WRdTfgwCHKy7GLbbdIvWW:V3J03Td9CHKy7GZO
- TLSH T1DAC45A90B3E410F8F0B7DA35C9665512DAB67C691B71CACF03A4265A1F33BD18939F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\alg.exe
- Size 110KB
- SHA256 c0a0a1c2c487d1e0f3a6c6c6a5ee7ea75518a6b879b0ffb2c0d472926d9d9c2f
- MD5 2221eb6dfbff6ef7e30040b16e5604e8
- SHA1 5db541f14ac2ad9922dbcdff137a1162e6c13a3d
- SHA512 afb640665c8a2f698a71bbd6460665ae26f544328256141be470d730525c6dc5b66f7063b6f9bf1bbac7b15fe0ac771c9f23d7cc2a9cf01708ba48c2e389df3d
- SSDEEP 1536:1H5C1C97RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkAdw1:1HE17cKAArDZz4N9GhbkrNEkjkAdy
- TLSH T1F0B3CF6ABE2C98F1D8A045716D2F8F5006B5BDB379806222A7D07D2FDC37712C62753A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 5.1MB
- SHA256 7c7061a93da70a121b9daca025a75e7dbcb3f66cbf0b893754ee071cacf323bb
- MD5 734a6117fa71bc00c1b7bf6101b48012
- SHA1 493f4e0c6e36fd92d3536f6e83016758cb804907
- SHA512 3666f74c0196a355451fd5dffbc6a281ece16b1162035692b9e054b8f257f416ae20a1189986f0109648037013246d593e7f590c8386a99cd90f8797687f9e87
- SSDEEP 98304:cMog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQzT:Rog1P9fIlOuz6IgF+I3m2MXP6HG8QzT
- TLSH T1AC468D33F8805075D4D632766D1DA73D5A325BE24F2209C79AA4BC906FB83D3253A39E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 5.1MB
- SHA256 4cfd69f613b113e18c85bf7c45bc28b272ba281a13503f39605a770b1c741654
- MD5 5c6853e208b355270634413307f75b25
- SHA1 6401b50ab77021c3929e6326dc9db33eb87f616f
- SHA512 2823a91e85da0ba021db61dfd8b395113d1fc7e45a1f47376b868fc78b8c4ec0a6f093054caa1b987eb2c63a2decd56e89b62eb2a4265b5bfbebf84e65436c02
- SSDEEP 98304:cMog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQzj:Rog1P9fIlOuz6IgF+I3m2MXP6HG8Qzj
- TLSH T13E468D33F8905075D4D632766D1DA73D5A325BE24F2209C39AA4BC906FB83D3253A39E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 4.9MB
- SHA256 2bbc260abb0d3522c98b3456d2e86b35fe66604e33eccb09e360787c55a4f58b
- MD5 3cad923e404fd67dc3aac8e7c180455f
- SHA1 9e0c20b1b460fbadf9026319e41a9daa7c6edaca
- SHA512 087b5ba49eb2a13fae15e89a7c54109b40abb125134de62107862db018f47b0bb81dc1daea20c279b53941ac69ec45a67da638b2aca5eea8d678aee875536da5
- SSDEEP 98304:Gsog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXo:3og1P9fIlOuz6IgF+I3m2MXP6HG8o
- TLSH T12F368D13F8905075E4E332767D1DA73DAA3057E64F2249C78AA4AC806FB85D3253A39F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 5.4MB
- SHA256 98c5ac475519ff46b5c159799157a157a9fe04dbf9c7afd837082cf6730c04ec
- MD5 6a3066a42ec29c9e53eb0a18821d3993
- SHA1 c54389df38a01b756a9562e40dd1d4fcc8e34671
- SHA512 c38cd1c63ae2dfee1cd81c931d8283e1e954799ee71a8022c2dc9645ba7ece82b789c1f4a899eb4b06fab1ead51a87f228e2d29e1a1d6d1324406dacd7a81e89
- SSDEEP 98304:Gsog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQzJ:3og1P9fIlOuz6IgF+I3m2MXP6HG8QzJ
- TLSH T145468C23F8D05031E5E732766C2DA7395A326BA24F2145C786A4BC946FB83D3253A35F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\RCX5C50.tmp
- Size 111KB
- SHA256 9cdbc1a93a249ccfc580a5a1bcde6c45512532f8fdfe33ebc79f605e6523926c
- MD5 a6b533bfb70d7699f94a47460a23badf
- SHA1 d20c60d702b03d39c4eb09ba355aa1dace0b03f7
- SHA512 d5f3fd2a75b3173c9819f21d2e047786d889a73fdb0bb205d3ca1d5e53040a77265cd5d8a30fe9716062c646decf9288ae0edbb41672dda0a8505b21b147b186
- SSDEEP 1536:xH5C1GdPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkAQ:xHE1Gp3cKAArDZz4N9GhbkrNEkjkAda
- TLSH T1A8B3E199BF2CD5B1C8A102B16D2F8B500679ADB37A804133D7907D2FD876312CA73976
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
- Size 2.6MB
- SHA256 3c93d0c0d576ef2a097a1848fc0a34ee034deedd15e8bc479cdf1faf13b55dea
- MD5 4a5b03a92e2763b395eef128d95e2b30
- SHA1 d20e8ad02cd7415fbe77e30fb1bc5208acecb832
- SHA512 41b165996415a5aa688bc64d51c808cdeb424a768b365598338abb25b66621a048ee797458d2e7f676338939526c7aa32030e4d4e58936c290a6550e4a054846
- SSDEEP 49152:iBGudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRE:ciijnUdYd+RE
- TLSH T1DAD57C03F2D910E8D05DD1B8C75A9632E9B2B8890734B6DF07909B622B77EE4673DB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
- Size 1.5MB
- SHA256 27f55984aee7a5d126b5663474671900eece848ad9a196a147221e0c0b605a31
- MD5 6f9dfcdff8e7b04b620ff81db872bb23
- SHA1 ccec38c0daeb85d7ae248e26276657b7ea4b2966
- SHA512 4586610d1db705a918be014381bcfcfeffd4e2f06eaf16eabb67978ea3bd570dd9a0c1d782a6f9ec3aecd69cf6af808910c0017152a31666a2d320910c85ba69
- SSDEEP 49152:KB/fehjvHHKTdfxINPEt99G2Bo7EukU1a:0XyjvnORmE
- TLSH T113758C03B3D801E8D069D1B4CB568536E9B2BC450B24A6EF0B90B7561E7BFE49B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe
- Size 1.7MB
- SHA256 31fd5cafa0f380677cbdc35f738ae24b047fa5e229cad5dc416bddda3eba9bf2
- MD5 1946cb632d8a0bb382cc50c4e2bcacac
- SHA1 52dbb27594df041e42ce320d74ba61c3cc06d3b6
- SHA512 1084430e16d7a8ee867ef1f53cdf72c039048218676ba639640b2d2d07e01da1d1d4e91e8363d41246f7b2e6fecd4e7323ce03fc19efd30d766601f0e64cc823
- SSDEEP 24576:iyBJnh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsN:JBX4hoNiZVB6PeuT5lxeHX04mfHI
- TLSH T1A2857A03B69841E8D06DD2B8CB468232EAB27C450B34A6DF0791B75A1F77EE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
- Size 1.5MB
- SHA256 00435878762412c33ead239aeeea2ca82aadaacedf434c382653314e34dff22e
- MD5 92cef0f9e915fa7d8ada1058ecb9a648
- SHA1 dfe954b15e4d2bf44bc9908d936bfe9c51b57576
- SHA512 60b8061551bdb1ba08b998d67eb6159adeeaa6370724079dca54d7c586004d7f3df35bc6cb465409650017d0252e5b9404a0028ab67974ffddf36624a6fa21ba
- SSDEEP 24576:JyBDZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:8BsY2fF8FhmS86IUJWQn+6h27d6
- TLSH T161758C03F79900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7562E77EE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXA249.tmp
- Size 111KB
- SHA256 9e2f5486e169d1e7de5874d9975f70de2b18339c4e249acf6a94a1085f7a4e99
- MD5 28fff31d88d1f528b81e498b51ade908
- SHA1 a0de1c6703a1568a95554218a6bea0bf1183cf91
- SHA512 0636d0899f87e866bdf6230c6ee26a146f9e469625b1ec54cf6d489e5b6ff2fbbebf175a1657ac7837912290830a6f8a7ddf6f2d847848da76baab5363fdfe36
- SSDEEP 1536:FH5C1pdPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkAA:FHE1pp3cKAArDZz4N9GhbkrNEkjkAdK
- TLSH T1C3B3D099BF2C98B1C8A045B16D2F8F500275BDB779809232A7D07D2FD877712CA2357A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXA2C1.tmp
- Size 112KB
- SHA256 b7e84054e89aec2a40ff82b62a172fd7bb7435d2654b096b74951883a146d07e
- MD5 2367fe2c931022b59043591613ef8584
- SHA1 772b71964ff4eff23067ea7addf87011b43024e1
- SHA512 9dec72104417565c9d4f438eb5a9553a3dd134892f1f84001a79d38bfecb08a9c2dee9ecf278ced146611fbe58e1c72eab9480718e6a6410aa0c2cf58a196e14
- SSDEEP 1536:RH5C1BdPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkAI:RHE1Bp3cKAArDZz4N9GhbkrNEkjkAdy
- TLSH T115B3D09A7F2C98B1C8A045B16D2F8F500275BDB379805222A7D07D2FD877712CA6397A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXAA67.tmp
- Size 110KB
- SHA256 4c5c5be1ecab94cf0590cf19148257eedb6ab38b64c7ff57e43e15d97bb08242
- MD5 13f59d16fcae9b69b87fcf33327addfb
- SHA1 dca6aab0b2e076b09efe8082fe8b1216c527059f
- SHA512 e164dba71f854fefb28306c764565db63c6ff5b0bdeccf95a29864e1e4bb42e78f7745632300d78309931c6cfcd4b88243d0bf1176225ba8c0e166d3f99233e2
- SSDEEP 1536:hH5C1z9bvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkAdw9:hHE1pcKAArDZz4N9GhbkrNEkjkAda
- TLSH T1EAB3CF567F2C98F1D8A044716D2F8F6046B5BDB379806223A7D07E2FD836712C62753A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 634KB
- SHA256 fbbd5de342ad4d6317aa6c549d89e1a98ddda442b910dac50ffc7b18dfe36f45
- MD5 1fdccd25f2518bc9d6548f686724b6ef
- SHA1 4bad3c23448a93ea83208bdd8964d6a73ec3f18a
- SHA512 3b1d817461997518cab294d59c601eab5d212ab2fa85f83280428729283d33e127b8407d6f58335eab8aee08be51c4a540c30e2f6f2e9a1d9e715773c03a8f3c
- SSDEEP 12288:RHy9046S86nHrUA9HVlK8SQBJ9t4f15rL:FyB/86n9kAJ9tA3L
- TLSH T1BED49E41B7E847E8E06AC134CE568642EA717C960B60E6DF03A0767A2F377E55F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
- Size 5.1MB
- SHA256 84d3bd6939da38e976b348571627046f06e9aba84a11a2c1577237499719c524
- MD5 f7023bf8dee3c40b6d7ee9f6394b058c
- SHA1 31cccc3edb6584495d1b6b847223e3d0f6f28bc9
- SHA512 cb2fe5bc36a51135536c72ec1bb0a3945f65c2a74ec5ad3907667c15955479054aa9bb2a43915643ff6fbd165beedd3dab88488f6bc85c9f830fe0e2654c9f8d
- SSDEEP 98304:sg6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzq:UCZetaEMGIG5xVqzq
- TLSH T1D5466D4BE3A610B8D41ECCB4872E5522D969348E5734A3EF06D98A351A73FD86B3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
- Size 226KB
- SHA256 267dd420a98ad5092ca7aa6409e64b1f5e370a723f9f11f162ae13125f5bbf9c
- MD5 66a6d3825b84c4e12cb2902e7e682abe
- SHA1 b5a8cfae02210eba5b47b1209ed5ec3897c9dfbd
- SHA512 2a75cfc0bfbc4fdef1d90dd918b5c5548cddd5787930cf2743715b7e19e0dc55f6a88efe3f96b1aa361caa21745186eca7640b950240988e176dc6f9c749d42e
- SSDEEP 6144:3nRpAFWcwl4hvndNIaZ0QEmdanRpAFWcwl4hvndNIaINY++++YtE:3nRpAr4svndNIaZ04gnRpAr4svndNIa9
- TLSH T12E347C5763E820F9E1774278C5124A45EB73F8724720ABEF07B4426A1F236D19E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
- Size 3.9MB
- SHA256 f0d5d9bff9d69fc5ad069a0a858b17ff9dba3ebc699be93c9e276fdc7f941774
- MD5 4da95d4a77399647d722876e41e5ecd8
- SHA1 10a3b822b9695ba5cb17b70a18cc7e14bb20f939
- SHA512 529d9256c7b730e8d2d6cf9cc97ec90cdd1bb3c150d54105c040a9617eda02ff3ced12decebc00608f0416ee8df4a64457c6ebf02da5539eca3484f7aed2ee2c
- SSDEEP 49152:0f6gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdQBD:0e3mMsYvRmCCENUhIUBbM
- TLSH T167164903F29900E8E05DD5B8C7568122EAB2BC854B35B2DF0750B7562E7BEE4AB3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.3MB
- SHA256 4ce5f79f5b1f6a2501ed2d4a3acbf5f05a48654c6ee5963605902876131ab08f
- MD5 ab099ae86a90c2edd29daf809ae208d1
- SHA1 284df7c1d78cbdd0e06cdec1012100859d7d6adf
- SHA512 d8aae44ad2505d471573b6faff1efed94db70f206344b0ddd123b4b04a39dd9d24540a8f56cd50e792a37d0d98f2250c168f766fde30264c79a6b175dca6d820
- SSDEEP 49152:Wib+632BuPkFKRrdE6oh2stBhuXjfS4LWxnM:WE3q6DjBf
- TLSH T190B57B03F2D900E9E06AD178D7569133E9A2BC890B34B6DF0780B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
- Size 1.5MB
- SHA256 fe4d1148f22f3a1d5170d648c4ed351b785c9ca1763f94f8122a31ef530ccebe
- MD5 fdda37655f355963e6c6589913f57bba
- SHA1 601643feaac83d03343400996df128ff4afd3c3c
- SHA512 bad73a38f58037e3666a770caef818db8ce6d0bfbf8d1ff2c2e31deb75979fd1cb5e347522fe1fe7a35fd971283777f1401eaf773483f50c6b4ee4fef01bb6fc
- SSDEEP 49152:K/DvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:KLI4Ds9Ol
- TLSH T1DC757C13F29900E8D069D1B4C7568536EAB2BC450B34A6EF0B90B7561E3BFE46B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
- Size 4.0MB
- SHA256 572a1a20e195402a4aeb564152d091c1d67d4586d869e4fa61af4fcc35757760
- MD5 935d196eec9d9f42496e995e047c2d27
- SHA1 32340a051d9fa8f5bfeafbb186c1af0bb29bc3d9
- SHA512 50703072176218b6a0360efef35efbd1ae31a0dd423d2d10ba6e5f000ad2fa9ec193a62159cfe80759f1cdb5958c312768165eaab39d92a471304e57cb7d4530
- SSDEEP 49152:2GudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:2iijnUdYd+RaAj
- TLSH T1AF164903B29940D8D059C074CE5A9232EB617C8D47F162EF3690B7EA2A73AD47B3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
- Size 1.5MB
- SHA256 49bc5cd7bdbd5565e6d59ddcbf6d86fd1e9f5840ea5749d0ff631e4071b6ec5c
- MD5 2effdba2aafc67995e3fb71e92f7a4ae
- SHA1 f8d8c12adbf11aa40879d0836ef737b5c70867de
- SHA512 a5e1444c4bd35a68cf207842000a851899cd19dc3a7c3a82a751d7539fecb0ba381aef097f195de8cddaf75a2fef7c4003cdbf35a8371196353421df4b5799bf
- SSDEEP 24576://yoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/Sl://fehjvHHKTdfxINPEt99G2Bo7EukU1a
- TLSH T105757B03B2D801E8D06AD1B4C7568536E9B2BC450B24A6EF0B90B75A1F7BFE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
- Size 1.9MB
- SHA256 323ef01d2820d0813a5f153699edd698cbb25256bcbcf27093d4370f53bc813b
- MD5 3288e4eb7de99fb3ea38915c30e86317
- SHA1 4c6646888c27e3b9bcaf1d553ebdb66985837d93
- SHA512 b1c9eb48731f45fd06b73d0f4153a33753c71f8e05d7795c6f56093c894d2b6ce2e7c27fa23486f84c3256ab2f272dab3696cca77d782eaf904de91205fe4fdb
- SSDEEP 24576:If5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAb:IfZGu6qG13O7Q7gLYduZrSdHBAVfb
- TLSH T102957C07F69A80E5E05DC2B8CB368B35EA717C554F20A6DF0280BA652E77ED04B3D794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
- Size 3.5MB
- SHA256 bc43223a423a31380054237d37ca92764d2440c42405628df1c91a3899b43154
- MD5 7c5d24bf83d460262151c64aef60b675
- SHA1 1a5b9f1823da10cd497673474140a8b3f8b045be
- SHA512 22e94c325664fb16d729749cb60384f1e2f3f8030698831ae9f4d3de61163af751e55276e4af16ac95e3c86215e6badf6c7f2eee54ec18d398dbc5bcf438a17e
- SSDEEP 49152:0QuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:0Qo/Yhy8OnZy
- TLSH T145064903A29900D8D059D074CF5A9232EBA27C8D47F562EF3690B6D52A77EE47B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
- Size 1.7MB
- SHA256 3acc1926761ec4268376c3b0611ccc5f7572a503b2c6dc5ff841dc3a77c0f099
- MD5 3d22a332abe927912fd26ab7b051c3d0
- SHA1 8bdd85675d110c11c466bc24c15afeae3ed843a3
- SHA512 47f8efb664fc4f08f476e36d696ab161f851d46c838193bf4fa5c91e9e536520faa0ae36336a35f8c31707d6b8f426aaf21559b6960c700b9e0f1b891d205557
- SSDEEP 24576:zJnh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsN:zX4hoNiZVB6PeuT5lxeHX04mfHI
- TLSH T107856A03B2D801E8D06DD2B8C7569132EAA27C460B34A6DF0791B75A1F77EE45B3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 1.5MB
- SHA256 585e623e9981181d6a48f39dda417ce7d67af441017bed4ef1d1064d79340c03
- MD5 a6dc80c0021c475e75bb8923f2bb1ae1
- SHA1 59361f7b7c1652478915a6a847520cc4c1bc8381
- SHA512 0c1ba2c766d80a52b446b61b2581dcedb23e7ebff4ba035482c1f8b3d6e31112175bb8f3da180903b21c65f07db8082f86997a195c4efaca804dff112621cf0c
- SSDEEP 24576:/DZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:/sY2fF8FhmS86IUJWQn+6h27d6
- TLSH T1C5757C13F29900E8D059D1B4C756853AEAA2BC460B34A6EF0B90F7562F77EE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 3.4MB
- SHA256 7a16ed848d069d50901762f316cfffc92360df29c6ed6305a81c999784e96059
- MD5 e50143cd4ad237b9f8a68ffc800358f6
- SHA1 42c8823f794e56f02b106baab09373894bc472e1
- SHA512 54d80225eb3071fcdb7f7969a62f8a247b13f38822057923c5a4be1dbe1845f86a31564a0ca3cfd0b37b6c1f95451ead9f82775439ccc74cbecff70a08b50f32
- SSDEEP 49152:2GudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpeL:2iijnUdYd+RO
- TLSH T1A4F54803A29900D8D099D074CF4A9232EBA27C8D47F566EF3690B6D52A77EE47B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
- Path C:\Windows\Temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
- Size 5.7MB
- SHA256 0a44f71683a512feb884ab34881c25b71e4ebf066f689a6e56aa4db73c192249
- MD5 0c4cb18763e5b4081a3051ef5f916ab4
- SHA1 a27be9e0442e17f9a3bdd0d131bc138a68a6552b
- SHA512 43f1c6268ee846e7aea465d5635a28352068ce4b9c80bb0d53dc37048be930caf0bf1eb503af012997c0ae450ab54953a5dcc666931db107a05b701acd92bf4f
- SSDEEP 49152:PmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P3q:0iH9MfT3NwMkKhBRr0yAk6qkKvs
- TLSH T11E567C22B902C139E15102B159ECBFE9C49D99348FB105DBBAC41F7E9A613E33931E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\alg.exe
- Size 112KB
- SHA256 699614a0edcd683b3ced3ecdaee8ac57a140c04be4e5185318e34897f9daf0d7
- MD5 1ae52d4ab6aeff78ce8b5893180de7bf
- SHA1 b0a7547a0288646bdb362cbc83257f470ade9ccd
- SHA512 4b4b7fd0478ced14f0e65d9d53d9dcea8e05b7b9310063dd79da1c568e29bb76ea3385c5b65c759df270c5f65c7f413b4506d6e9960513d2c9e3ae50725e309c
- SSDEEP 1536:5H5C1RUdPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkh:5HE1RUp3cKAArDZz4N9GhbkrNEkjkAdS
- TLSH T1BBB3E0997F2CD5F1C8A106B1AD2F8B500675BDB27A80C13297A1BD2FD877311C633966
- MD5 SHA1 SHA512 SSDEEP TLSH