29974b816978485889f33a268687293e509c37218a69cf6fec93c8d1e4919b5a

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
Size 5.8MB
Sample260630-ehr8aad17x
SHA256 29974b816978485889f33a268687293e509c37218a69cf6fec93c8d1e4919b5a
MD5 c26866a99c8365ca90629dda9f88dff7
SHA1 fcbecccb0984a932a1579cd3835ef0b726b28c5a
SHA512 4c9a52bf346850ef9d848eee6bf660556ca7ba10ba9e1ee6ef4dc611e5424c519178be34c6ffbf2796bd65718d802868dab49da2cc3a81af52e32b00f02a15a3
SSDEEP 49152:VBGmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2i:3DiH9MfT3NwMkKhBRr0yAk6qkKvs
TLSH
T1C3568C22B902C139E15102B159ECBFE9C49D99348FB105DBBAC41F7E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence spyware

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	alg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lsass = "C:\\Windows\\alg.exe"	alg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
1636	2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
5060	alg.exe
3572	2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe

Loads dropped DLL 64 IoCs

pid	Process
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe
5060	alg.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Google\Update\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	alg.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\alg.exe	alg.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX3F9B.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	alg.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXE250.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Google\Update\RCX8F2.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX34EB.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	alg.exe
File created	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\RCX3321.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX3E29.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1D17.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\RCX3197.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\RCX3322.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX1D90.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX2FC6.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX34EA.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX3E2A.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1FBE.tmp	alg.exe
File created	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1134.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1495.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX3EBB.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX3F79.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX10F4.tmp	alg.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX4068.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXF630.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaws.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX10F3.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX166D.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX20D9.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\alg.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXE30E.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXE31E.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX3DD9.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX2FC5.tmp	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	alg.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{32B300A2-6ED3-4645-8D41-15F737B4D3AF}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{83CF0885-A252-4FBA-BA5A-15EE8BC9419B}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4084	explorer.exe
4084	explorer.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe
Token: SeShutdownPrivilege	4084	explorer.exe
Token: SeCreatePagefilePrivilege	4084	explorer.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1636	2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
4696	sihost.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
1636	2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe
4084	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1236	StartMenuExperienceHost.exe
4548	SearchHost.exe
4084	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1636	2984	2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe	87
PID 2984 wrote to memory of 5060	2984	2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe	88
PID 1636 wrote to memory of 3572	1636	2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe	89
PID 5060 wrote to memory of 6036	5060	alg.exe	90
PID 4696 wrote to memory of 4084	4696	sihost.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
  "C:\Windows\temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
    "C:\Windows\temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe" --type=collab-renderer --proc=1636
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3572
- C:\Windows\alg.exe
  "C:\Windows\alg.exe"
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\temp\*.* /q /s
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6036

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4084

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4548

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ADelRCP.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
Size 247KB
SHA256 018a335764c0c391a80861e1f2bb25ed18877cf9209fdd77f97aadcec0f0ec8a
MD5 f14c95205dcf8b94919e2b2dbfc7a966
SHA1 b06987f4a842cb16f7897b6536588c8b9ceb836e
SHA512 722f99d758dbc0db1144b39d514af9c28111afce296267372eaf1cc0afcda0dd03783175d0c7b03312c0f20f4e709715c292b29cbc4268b24f7ff2b10617f077
SSDEEP 3072:oHE1RUp3cKAArDZz4N9GhbkrNEkjkAdWdA53Pa4sjSTXEHb5CZCq5DACsVlNl7Hq:oHiepxyN90QEmdWmsjF4N5QVrZZ7Lxe
TLSH
T112447C127B8490A5E59313723EFD6AD44BF5BC329AA4509BF318BD6B147F310863632B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
Size 287KB
SHA256 15052c9984705a582e4618b604cf02bd0c58faeef3698caf4a9735537f2e5e80
MD5 a5a1e89d922f9d0e308391abd1e1e35b
SHA1 4480fdbbe4825a63bf8da81617b8d48cdfaf8fcc
SHA512 86b0f35a89bad9b797f651043794a2a596e6c84c662ba7b58ddf354d3cea11ea97890e971477a092a4b0dc781e929a00aa0628ae2a2957eabfd009f34e0ccbca
SSDEEP 6144:OW8Bi7Q5VYNh6edjvw6L6jAVnhH1Am2ZBU4M528K:OZ4Q5VYf6exwI1oB86
TLSH
T113543B013F918EB6F5A2807B5D7A671E166ABA220B10D2C373707B5DCD321C5DA3E366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
Size 399KB
SHA256 a43987472f824be9b52b7289eb7f05fde06bdf46000402dfcbde0bc8a94af89c
MD5 dde8bbb208707a3d712988e1257319b7
SHA1 fa5f7e71d7a5a426b1f5d8ae86148e937f4fbc8c
SHA512 89018dda290f8d561e8f53640e86eaa510148c452e1a2f573df8d2f62b00a982bab8fc8feadbed3fb972aa58b7de6a6faf06d741c8b7310b3f8226c55ec19142
SSDEEP 6144:oHiepxyN90QEmd7W8Bi7Q5VYNh6edjvw6L6jAVnhH1Am2ZBU4M528K:oHy904tZ4Q5VYf6exwI1oB86
TLSH
T15E946C013F508EB6F9A2807A5D7A671D166ABE221B10D2D373607F5DCC322C5DA3E366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.4MB
SHA256 63f9577686b544dcec03bca7b8ae6ad9b238369d1a33092c2a310df3a0270c07
MD5 351361ffa0461dce01d7bb13ab768931
SHA1 4743fb30aa406984fea29b35b3621b280f561975
SHA512 3a58de43004ecd0843c6eedda071094fe97397c37b61f6fe59ee25e3cc7d59ea9f8ae810216c896caae26b1aded13e4d2212aa5afcbc26220ad0c966df812587
SSDEEP 98304:IrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTM:CXnfW/JLGMcblLheTM
TLSH
T118A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
Size 25.0MB
SHA256 9b5174e139e9c69d0eba4a93727b1b2a4d3fc46d490e65d08d0ed87b6d5e6a5c
MD5 39090cada9cb4f8175ee43ec287ee8c0
SHA1 f2b6438d89d02daceada37d1647f3a2b1219cf11
SHA512 3857e1d64421b4bc01a113c4ea3a7bd455dff5cda9ffe671a418d1dcf196bb131f4cdafab5658ef71a0b8226df96531e6b35ea0b57a85045cc45cd0d7363d4e5
SSDEEP 393216:2wChNVNyPQCjX7F2/pe6y48kNZCbyaKBArYxeMmIn6F8/wuTFYRfE+IzXTO9Bz:PC1rq2/r+bqAzMmIn0BuTFE82z
TLSH
T15A472274861DA679FD3E82F51DCF06A688CA4DF15632F8C5F9925E380E2722037B5B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
Size 25.0MB
SHA256 92ae44b5011046e6e3a93d99afb25ae00d5c7d2f83be5729ab81eba7e4551e2e
MD5 cbd84b1ea05b884c1d33572075aa2b8b
SHA1 cfa08469ebee037a2dc9335fe58580bd8dde8c79
SHA512 4fc32a70abdcf8d1043c90f4d8b1ab57c8884a8c49fe819bbcc2a01946c3e52dcd7e3fb85531d5ecf8a9706f094b9c0af3a8e6a686300841e364a55e4096ccc0
SSDEEP 393216:KwChNVNyPQCjX7F2/pe6y48kNZCbyaKBArYxeMmIn6F8/wuTFYRfE+IzXTO9Bz:rC1rq2/r+bqAzMmIn0BuTFE82z
TLSH
T163472274861DA679FD3E82F51DCF02A688CA4DF15632F9C5F9925E380E2722037B5B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\alg.exe
Size 176KB
SHA256 d26cbba8ed2ba1c68864ea1482a78ccefe785107973d638963ad9f5b7a2bce09
MD5 a3479c48e116f4dc136ba56646f69568
SHA1 a96603cb3719a9596cd0f51b077348dd52090d13
SHA512 6eed51f055070c910ff8dca40363a1a7168e9ed4a280d208a74fa5a477388abf5664609270b133cc1ee5099bc435016dd7285447690dc05a0f4c4521b6486aea
SSDEEP 1536:kH5C1zdPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkAw:kHE1zp3cKAArDZz4N9GhbkrNEkjkAd6
TLSH
T164048C6E7A1F96E0C75005BD5C2ECB40C228FFA6E94061227BD07F2BE47A3D3C626525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 2.4MB
SHA256 2fcd51e705e9c091e4f23ab61960dfc99883b7c7158008c2f77be22d0b97f853
MD5 b885527bb2c0f0cd91070a58a23a1a46
SHA1 95f9c87a496817d6e98de260d1677fde217dfa09
SHA512 d79d93effe35bdba813aaf07cdcb7998bcf4bdc84851105fc288f09a36a18f22102df5b9b86d2b45bca93e12f51f685c5d80a1c17d488c8ea8df2b009545cb32
SSDEEP 49152:yTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJS:yTfiG/nzU90m
TLSH
T19FC59126A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 140KB
SHA256 2a735560ffa8a0d3a6fa10ecaaa952cfc689ddf65d204b27a0d86a87fb1f7a76
MD5 180f31bc82659034b62200f02ef602a8
SHA1 3edd140c838b7993189e3836a849071afae11f8f
SHA512 6014a906c7169dadd135628dd566bcefd23ff71af96e61b925f993c28df564c265b0e218c5c8140f9922975d1e1693878c968e0bde45680d589dc8c12ad3c052
SSDEEP 3072:AHE1RUp3cKAArDZz4N9GhbkrNEkjkAdYJEBXgr7:AHiepxyN90QEmddBwr7
TLSH
T192E3D09A7F5C98B1C8A246B16C3FC7544A35BEB17950C123A7A1BD2FC876701CD2352B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroTextExtractor.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
Size 158KB
SHA256 ef2bb83c06fff04df236bb1e638fa8904816ec6136fd7ba77d2dce9ef5341534
MD5 3c85d17c3d8c3e3664803e7a1236367a
SHA1 b2dd1e4bd1287968cbe295281131a7a28a58147d
SHA512 c97fc787b6afc49a7dc366001f17150228d631ba543d24ea4a6210f9380f2c6e99fb49aead0e55e9d143d9a9857a0d332ce163f7d30777ac4eaf1298d658983a
SSDEEP 3072:6HE1RUp3cKAArDZz4N9GhbkrNEkjkAdtM6GC+QA8+HlJF:6HiepxyN90QEmdHA86/
TLSH
T197F3D0173F6884B1C8A247B06C2FDB558A7ABE716A50826393D0BD2B9C72741DD3352B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeCollabSync.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
Size 5.8MB
SHA256 2f838f75c5ee3ac22bc01bd5525650b7b53b64a1d318e3955ce56f460094d5c1
MD5 969102cbfe0a391e1fa316b2d6015527
SHA1 19b2b6b3de65ef5a9bd3936987c8a6024135e656
SHA512 6aa43c2a506d3014d4a50e156c1652ee47d651b3e2ef5c879c0aeb21f3c5e0fbd3fff5066922e8997f0a06174d80d7f0bb3bd2935961fbef27d1aca2453efbee
SSDEEP 49152:P+mlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2Pa:DiH9MfT3NwMkKhBRr0yAk6qkKvs
TLSH
T10B568B22B903C139F05142B159ECBFEA849D99348FB105CB7AC45F6E9A623D33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCChromeNativeMessagingHost.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
Size 257KB
SHA256 da05dda91cceaef788ac50848c23bc0a494ec1e09b4f1df56289ca27d704026d
MD5 60e9d8722579f4b0a0b60c5b2b424ee2
SHA1 26c2cb4c464f43ac038cdac727f315805c443313
SHA512 7ed2599aa92451e77315abf1cb08d94ecbe9ba334955264bae3d829759b61f60dd4cf89c7abbfe24023ff162f9b1e0188487dbd5bf9ea1464eb65c70a132f2ec
SSDEEP 6144:JPc53T/CbfHwCbyFdAT3T/CbfHwCbyFdAafy:Jk9Wb4IlDWb4Ilafy
TLSH
T1B2444B51F78BC5B6E0920270186AAFB641B9FE780B6145EFF3D8771E1A703C2543266B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCChromeNativeMessagingHost.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
Size 257KB
SHA256 5dca40b9886e5a869598a2ebdb48c3572f20585f28f08a565da17d6dffa9b156
MD5 5d212edd61561bc7c1980bee6a6174fa
SHA1 8b4bfdea2cc6f8a07c76a1512f21e43f147ef42b
SHA512 d23ddf4d07074e45823b188d316160a1a90471bdaec0156e91046a4bba45a101df629946f6b6a370b096daa7094b789ac56cf2df46f9bfc615b1c54c63061928
SSDEEP 6144:JPc53T/CbfB0QEmdAPc53T/CbfHwCbyFdAafy:Jk9WbZ04ek9Wb4Ilafy
TLSH
T18D447D51F78BC672E99202705879AFBA41BCFE381B6114DBF3D87A1B19702D3143266B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\alg.exe
Size 114KB
SHA256 71b5779302d2ec99e583ff8148e1f10139115cc03588b04930b0fbd9a7532e91
MD5 0fad46a9c5c52f76bbee19631fdd7a28
SHA1 d48c7b6be4b304251a356ed1ae56310ffb4d6e0b
SHA512 f2a0a41bcabf3a019fff423e3eaad4c29de00b21f710adc4449b944de9fe6f798da2921d40a26ede1bdad58d7fd52fc1920d9144585392ee874ff91e0a7b4e01
SSDEEP 1536:1/H5C1/ddPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZO:1/HE1Fp3cKAArDZz4N9GhbkrNEkjkAdq
TLSH
T169B3BE5AFF1FD5E3C86006B15D2F4F6006B56EBB7581812ED7A0BD2BC8B6301C5628B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
Size 203KB
SHA256 d94820f7c6f3c33b73f3579a62d7498188bef3eb1c4671c65e52f15c6a886e30
MD5 1762ba93b24efe9751228d210e075850
SHA1 19484f48ce39311298b849496e3d3309da778857
SHA512 3bb7c4b9c440ea2be5fbae78bb148d85a17c429e98ae51ac21103180594ecfaac863b826ab3ecba8fbf3ca27ca19d1d13619b2f7983dad920a88253d5361d834
SSDEEP 3072:jHE1RUp3cKAArDZz4N9GhbkrNEkjkAdLiselSsONt3F7oQGO7M1bmq9YnyoRmLis:jHiepxyN90QEmdLvldRgLd
TLSH
T15014AE537FE8C4B2C6A202305D2EB76646ABFD716A60C72377883F1F9C717428D19A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FullTrustNotifier.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
Size 213KB
SHA256 4653df6eb852f717ac03d5ecdfdd5e1e2c1ac70b012049f1188e0e7d5b5f8983
MD5 20d89d1781cde87db3a8b59da816efcc
SHA1 4f6670c4dcd8d978b21d1db91e081e609f5abcd0
SHA512 7b03a2e2c5f94a3e6164e160e3346cf0e8247471c48858dad9747dc17c8bccd20caaf2ea9f15d7e6be3e633a01536caefdeff6b384c4448c861f1e5a5ff6cf0e
SSDEEP 3072:fqcVz5fzsTl4dsOc6v2vTzwU+Pho86meq+FaSoB2+vSHrX:CcT93PiY+Fa7BdvGX
TLSH
T1582439307B8AC53BEA9301718CF8EBBF542DBA550F6951C7B3484B6E1EA05D32E31856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FullTrustNotifier.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
Size 325KB
SHA256 d18e8442f9b1bf8f868fdd0d5ef3ace926aed1f38ccab6f3db164d96b899ef41
MD5 555a6ec9fb1aba36d758ecbffe907582
SHA1 2a12a9aba87383a9cd9674daa953fd8f39d12124
SHA512 0e69f93f6d94232ba512e49c313aab21dc4990fdb22ab2877a99c645d0812ab80e9c2a24052eb9a139ec0432ead82cfa583b9f79d257dd3b56e0d1669af2686f
SSDEEP 3072:5HE1RUp3cKAArDZz4N9GhbkrNEkjkAdsqcVz5fzsTl4dsOc6v2vTzwU+Pho86med:5HiepxyN90QEmdFcT93PiY+Fa7BdvGX
TLSH
T1DE647B307B4AC57BE99201718CFCABBF4429BE551F6441C7B3886F2E5DB06D26E32816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogTransport2.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
Size 457KB
SHA256 18077e2d896da8451ad55b895d7c72afb10571879e3ba0091b61d40f85a41a1c
MD5 d4b0ecac01c508c8c7b3d451237cc73f
SHA1 bb062f0da5d83027a25dcbbd6c02a6379b2bffb4
SHA512 f6e5043cedebf30fd04db3e8bb22d8e5747d0de40bffb83fdccd4cf6e6cd2e66f3e8d36f90af7d34ec2857e97583fa5c77ad912d34f370e4b976f055c2601510
SSDEEP 6144:CHiepxyN90QEmdZ0RsrJ3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKE:CHy904IqwKhHSDeWTRW8fdebE
TLSH
T1D6A4AE11FB4AC1B2DC9201324DAAA35CC4BDAD715F2186D3E3D87F1E9D702D29932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\alg.exe
Size 374KB
SHA256 e5b0fb4e189f5a81d818440fdc02d0078ef4e5bb389260dfcc331b4ff223f4c2
MD5 d2881e78437d094675d7734a2f6daa49
SHA1 f4d03fb8c6fe130567b5aabcff6443bca7df5213
SHA512 d65884a9a8dc72843d66f22a13a51cb465b62abb47b912c12513cdb1be19f5dfede85c9ad17909c91fd498075bd3cb1e3dc886302c60fb009f6a263020362f84
SSDEEP 3072:ZHE1FTt/p3cKAArDZz4N9GhbkrNEkjkAd6:ZHipZpxyN90QEmd6
TLSH
T12884314E4608056FE5607AB1809E7B8005902DFD3EA3E77AFD147603FA727DA917393A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\alg.exe
Size 111KB
SHA256 cd3b971487943177d8f21e4f045c6099b616231c991eeb57d1ad9017bbe49f19
MD5 8dea51eb631ec0db77c5d943023d4e24
SHA1 09e70aac83ef50be8d784ed97b4703886906ab45
SHA512 85b7fd82254f269a2eb70ad516cb2bd542da9a647d981db5818339b1fc3ba6f28976eda842c26329be0a4e0b6b22533067a2c7a95808f1df59dfc977d306ce85
SSDEEP 1536:FH5C1tdPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkAo:FHE1tp3cKAArDZz4N9GhbkrNEkjkAdS
TLSH
T13FB3E19ABF2CD5F1CCA102B1AD2F8B5002757DB679808133A791BD2BD877712CA33566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 196KB
SHA256 e1004cce943ce9b6234e3a9e27383a238319efb5cbcb8f8df65dd1c278590fec
MD5 e21cf551102ad5917189001f7f750da3
SHA1 24d4f41b50ae11bef38ea595cae9b59403004d10
SHA512 adc04d60ae1a071285ea93cf47ff160a72b67bad6f23c683f5bef0ff1e603430d0ddeaa25f25e4832d12c5a8c0fe4b8faf88e22e85141602de7ee64c71ad90bd
SSDEEP 3072:6HE1RUp3cKAArDZz4N9GhbkrNEkjkAdfKrMzkm8PL3E7Qw/STyr5Jks7Mj:6HiepxyN90QEmdVzkmIL3E7QPQLk
TLSH
T15B14CF657B64D072C8D24A705D2EC7A14A3ABC326A90C017F7E47F2B9C71790D62732B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 102KB
SHA256 6919f2fcf1f2f97d29b183b132e8746b03e809b36b542be8837d320e3b99ab41
MD5 962f4fb1f6e9d787211b0132fad6e0d5
SHA1 7b7b80163e93efd81d4d841a98bc33604972dfb8
SHA512 a0f5cfe8cb06c9cb4ef94ea58928a0d43cd34eb7243ec7b6c130627ca0be4a266e593ba6248706eb0e2a348d40ac61eecd9b16af55eac8074c21a915a06a404b
SSDEEP 1536:TireklhKsikOkCWfN2S7UmwuBLAefbVH8x+FOI31EmkIY2d5J6WUghy:TilU9xK7HN9fN8sFOE1Z5Y2965
TLSH
T17BA35D21F5C249B2E66601724D6ABB9F942CF5340B2194D7F3D88F3D9E241C39FB25A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 214KB
SHA256 1bf5f277b5fb53993b55ff2838474567da16eee7f9a165a90a21beb39586305e
MD5 781a040570f06792bf19d480e5698e81
SHA1 198bfd5afe324ac7ece0f6aa4597832ba645955b
SHA512 892cddbd85c77dd76a7307abf7635a9a57feb7737e7b7f98a3a86a0807d19288b972a1f2a66f43c2d23c6d756ea399213bc8ec85d47187504e846514abe4358e
SSDEEP 3072:XHE1RUp3cKAArDZz4N9GhbkrNEkjkAdGilU9xK7HN9fN8sFOE1Z5Y2965:XHiepxyN90QEmdll0kNr8stZ5/65
TLSH
T14524AF21BAC598B1D96101725D6FAB9A9428FD341B6081E3B3D4BE3FD8343C2DB73562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 349KB
SHA256 564a023ad7afacd4bf7f056899f8291179d53b7a927139bc8bc5eb65caccae8b
MD5 dae06996e45659004f0bfe9d55c85460
SHA1 936be1f11ea52071eecda93d9559bb14bd9a1c78
SHA512 d01c20ef679bbf96b8e9972b546d3ee40668f7aac3131fc89af79e7718db2af5bdc87a836e866c5551b2f27f1a578b2405433ead095b858ad3793bc682422f68
SSDEEP 6144:vBZ6c1UKupTu8ffMb0/GxsZfcJtqQ1iZfcJtqQ1G:pZKK+HMYcyFcyD
TLSH
T1AC745B1A77D88CE5E467C23989A14642F7727C914B74D7CB2350432EEF636E0AE39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 164KB
SHA256 4ca70007b329d2e57501738349a2d8ea50992522305785febd3493d75cfcfeb2
MD5 fc90fcc6434bec806d1a2d78df7e80e6
SHA1 36b32590dc86d5f25e12017e1d47b2087b5a3d5b
SHA512 56a0efa32dc127abe4ad33d7f29e1c5df252f6507d4aa8509c20361c370d8f3e4bcbb93cc84498e1525c07d7089957ff416c96f4a9582b67d370658a2f68abc0
SSDEEP 3072:CHE1RUp3cKAArDZz4N9GhbkrNEkjkAdjFlKwW/Y6w8I:CHiepxyN90QEmdjFQw9J
TLSH
T114F3BF177F09DAB2C85145B11C6E8BA59579ED70BF4082A397507E2B8CB93C1D93322F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 107KB
SHA256 148c2a561257b994fe0e1606653e8ba80b1ef53dcfe05e914e060d6f5c6e3970
MD5 a77340ccc7475a541ca0fa36b410bbd0
SHA1 a387412ffab19b206700d86d3709230bd55e9641
SHA512 4915969a0690719b0631963aaec3452f533ee8a66c5e30f22104a1c1623f0e00958c7e6b257235f78787ed505af92be44cd7fe06e9111cdc432bc1df7b63c230
SSDEEP 1536:ip3IJaY1MHpY6d7uL3kXv6l8R1RpHx+sXsWbd09dltmcyaGoozzghO:ip3IIJNdS3Uv6l8TRpR+EMucyaGoSZ
TLSH
T1F9B36C5777A530F8E5778679C8A15A09EB72B4391B719B9F0364026A1F237C08E3AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.2MB
SHA256 e5da61c7ca4ee20c9acebceec30341c4e0693531b83fe1dd8d2cee85e0657812
MD5 40c3d82de26779b66df467f6f8dee9d9
SHA1 a51c18395e28df2d409f24371b78ae9707d352af
SHA512 aface5ec1040ba01a1ab47368708cd2fe97bf3852c3ea8fcfd9a5a612ec7e9b335f855de3d342e5f2ebc88bde7c7d309dbad43ad1f5b9f3bf04ce14b43a44cc4
SSDEEP 24576:+Sgouvz0ZRHkQgouvz0ZRHkFfenxyQZXS7gZnQh2NIq:+SgouvAeQgouvAeFfenxyQZXS7uQ0NIq
TLSH
T10A55060267F94129F1F37B71EEB993645A77BD61AE39C50E5380025E09B4E90AE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.2MB
SHA256 f7aba2d2e4245925ad39f974fcf63124cbe6c2ef808d7533a668fdbe4d2c6bc0
MD5 619a28f808438cfacad49c1e00a0ff0e
SHA1 c30245930a055e78581987601b5b8906c186faa9
SHA512 3c860fbf2a3568f0840c7493655e7e1c00b1b8b2923dbc6d2069d545e0b5aae27e5f24e5afee57476dc1ca8c7f26a9bb210d820fad9905f4e7b66d246d0ff743
SSDEEP 24576:+Sgouvz0ZR+B1Sgouvz0ZRHkFfenxyQZXS7gZnQh2NIq:+SgouvAkB1SgouvAeFfenxyQZXS7uQ0h
TLSH
T1CD55071267F94129F1F37B71EEB993645A77BC61AE39C50E5380025E09B4A90EE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 528KB
SHA256 83a97f24c3d563599de20f3d25c2a610d79fcedc6bfa1c1cbd040534f1ace704
MD5 f07a6961aa3613a02d2e19e88440682d
SHA1 2d758c30f8f392198bebb0977e07e768de70496a
SHA512 0fe5f3061ce8941944950f535017993609e952a96e407726fcfd1210c6508848a5b57379cc87f3dd778c696764864653a9b9a7226dabf5843786c0184f7110bd
SSDEEP 12288:u6dVW904V6dVWnxlMSn7nFKbltn+Ch/m6X2:dWkiTAbD+Ome2
TLSH
T11EB48D1077808135F5F329778ABF9728556CB9715F6881CFA3C81A7E4E70AE1AA3071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\alg.exe
Size 115KB
SHA256 5fd8e6c78a8144b62511a77a50329578436f393fcb7516dacceb038a447b821b
MD5 c9006601519e61e31f6d5f56332dc0a0
SHA1 87e567fcdd9ca24fd7d6efc980b540eeb950ced5
SHA512 7c25f0bf06fac4cd3c1b5712dd30ae285d8f9df2526546c5c330e367032f552081c9d93e2707c7680295914748a1818abf5b994ddf129b0dc371f1b10502a797
SSDEEP 1536:VH5C1DdPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkAo:VHE1Dp3cKAArDZz4N9GhbkrNEkjkAdS
TLSH
T16BC3D05A7E1C94F0C86101B55D2F8F6042366EB2758C82E7B7D07D2BEC7A315C63762A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
Size 514KB
SHA256 a3554c0aa5b520fd6bafe5a51315af9fab83fc98d1a57cf24004656acb479f8f
MD5 5815e92687ebe087464ee1b2ec2ae9a9
SHA1 051e132c8c13d0a3d2b3cbece3dc12a6f6087df2
SHA512 4b389cdbd06ef8f7513214756e7fe0ebceef3e09877f41192919981b97bf7dad0bc6f94948e2ec3f4f286f0b1aca55c69d1e37f80ab2f4a2c60f8033ab1b9b76
SSDEEP 12288:gQJ7RKv89GDYikjjqggz7/PtFxRNWBYrpc:vJ7RKqjjg/PzNWyrW
TLSH
T13EB4AE2439A0C032D17311314D6AE794A73EF6704E6249E777D4AFBE2F345C1EB24AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
Size 192KB
SHA256 9785a7627ddcb05610ad459359d24505fdd5c9263b263044e97d3ddd1da1af0b
MD5 33fd4e969505f51b5b3b3e1519a75216
SHA1 17c0bb9bf7d644122372cf6923043cdc75077b65
SHA512 97fe9e075ec08d4eb6c64b492d17df5b5123f482a525f5f167ace69b0874effcf6eccefab5680b6e22ee6618d5fc7fe8453328dee28eb17bba29d6792145907c
SSDEEP 6144:CVmRFJs0ug1MOl0QEmdLVmRFJs0ug1MOc4T:g0s0udOl04r0s0udOPT
TLSH
T198147C2179A0C132D8E2217489ECD6621A3E7E724B748CC3379427EE9DB13D29B75367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
Size 192KB
SHA256 f320d1c42aa50e38525600e5fd5cc5663f1d19c0cec56c19e171254d3c507bfc
MD5 fce80be9b427edf5d7e0de7a5c371329
SHA1 2b2d862c809793d583b7b66606b5c8134113af57
SHA512 ec6b542f4f96eb419e61849849531046eff27786ff9f5f38371adcbb5fadebd3390802efd9e526f4c3584e07e594c16b9c2cc297cee6736042aa2be0adc7635c
SSDEEP 3072:qHE1RUp3cKAArDZz4N9GhbkrNEkjkAdNr1Vg9uCRFRzsxeuPo10JOSdhuPT:qHiepxyN90QEmdLVmRFJs0ug1MOc4T
TLSH
T14E14AE217EA4C071C8E255B05DAE97610A3DBEB26B6084C367907FAFDC713C1DA76227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\java.exe
Size 397KB
SHA256 3dc0e7f34890d91737118144a958d91f2f10f39e187fd5c5553b28ac8c2b32d0
MD5 94fd3e7dbaaf5efbbd39c172692213b2
SHA1 9e4561483a15d93b459c014a23e35be8bbd5a9be
SHA512 24b862c159fb55548662e0b0a075bd4679f4d5d3dffbebffd008edb8ee63852baf9e2b6923588051c4e3f1ad300bb9b3deb37708f691c2698f55f877308e3bad
SSDEEP 6144:pWPZw225bN5zFEjGkqkAJK225bN5zFEjGkqkAJHyEzYV/PvyX:piZwb5zzFEoKb5zzFEoS2cPvyX
TLSH
T106848D9973A018F8EC67813ECD659946D6B2BC560B60C74F03B427661F333A11D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\java.exe
Size 397KB
SHA256 fd494b8641a0ac7dc8fec2587a2ffc9a18b05c7f3f1adc1a91c46975153feba7
MD5 9f727ec4f34f27b2e17f73c9a312d93f
SHA1 c957afb5d35712f6d860239c41217b3791bef8d5
SHA512 86e1492abd36d6dc878a3a6cd6f93d49c8ae16f4e9eda45aa292e83cea1a7eab9bb2dc1512a6837b9ec12d2e38bb79b3466e1a7d25987b99eb106363024b2675
SSDEEP 6144:RHiepxyN90QEmdsWPZw225bN5zFEjGkqkAJHyEzYV/PvyX:RHy904SiZwb5zzFEoS2cPvyX
TLSH
T1AC84BF95B7541CF4DC63813ACC2A8A06D6B27C661B60C61F13B43A2B5F333915D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaw.exe
Size 397KB
SHA256 a5a842c8bf25033c28bcbdaf47ce08dbf5e63e51d0e21ede73bdb5ac398d0391
MD5 ad5a4c53660e158c718ef876c7568fb6
SHA1 f2f42feee8cc98fced336daf4d83e631fa9759a3
SHA512 9a0fb1579994dd7fbc1ea85db02b8eed7532a5ffe85e667e0294769c1afe3d6c33c03008e796e718487a7d798c8494298a0bb8916e503c8d3f9c95446d2beb08
SSDEEP 6144:RHiepxyN90QEmdKAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhD:RHy904ECd9/WYoaLHF3z0z04PDvhD
TLSH
T1EA84BF95B7501CF4DC67813ACC6A8A06D6B27C661B60C61F03B43A2B5F333515D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaws.exe
Size 465KB
SHA256 1a12fb7e54396631be8f84ba5f4f3c9713025918c6d5c3a3cac58b65803e5f46
MD5 0b38ca1d466c8533026d667c3281c1a5
SHA1 e374662a449dab9ef6917e872c68730d501ae736
SHA512 fa46110e7e603f277916fa84c5487d00f2b640ac206ecd58246f312e11a177281a060776bd7ce07d306591db73ce88e84dc38418c0bb175998895c2166acf427
SSDEEP 6144:ViYB2nEaKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvWW:Vi4e7WRdTfgwCHKy7GLbbdIvWW
TLSH
T147A43A90F3E414E8F0B79A3589764511DAB67C5A1B71CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\alg.exe
Size 111KB
SHA256 9cdbc1a93a249ccfc580a5a1bcde6c45512532f8fdfe33ebc79f605e6523926c
MD5 a6b533bfb70d7699f94a47460a23badf
SHA1 d20c60d702b03d39c4eb09ba355aa1dace0b03f7
SHA512 d5f3fd2a75b3173c9819f21d2e047786d889a73fdb0bb205d3ca1d5e53040a77265cd5d8a30fe9716062c646decf9288ae0edbb41672dda0a8505b21b147b186
SSDEEP 1536:xH5C1GdPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkAQ:xHE1Gp3cKAArDZz4N9GhbkrNEkjkAda
TLSH
T1A8B3E199BF2CD5B1C8A102B16D2F8B500679ADB37A804133D7907D2FD876312CA73976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
Size 5.8MB
SHA256 189ec60165bb0eceaa083c457b0fc4d71cc1f50e87e4a7660b5834a60404f267
MD5 4892a67066c6b65c238b46e344071123
SHA1 a5a7bfa47637990965eb4ea0e183801e37c83710
SHA512 22c8ebacf0c38769c6cecfe0f2fb1a8f296b2adb846203363ded1ad30b50714a5f53d8d1b8bac71459d72557ad5d3d8b2ad329be177577b6997bd46d9568f40c
SSDEEP 98304:NEog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:+og1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T1E6567C23A4E04035E5F733756D2C67395A327BA29F3145CB8690AC946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
Size 5.8MB
SHA256 da38eaa1b862bf9ca6e392eb270c4fdfdc60e3fb20f56cf7d07d0c58b8bb4b0a
MD5 fe796a3741a5606ef8c08088fdd122e2
SHA1 98e7a6c88373eeb1c206c4f82affea3193ca6187
SHA512 44c1444374ea5332841a51c9ef5f0c3e9705bcd3d336987d3719b2b9fc482dce133e0e4e68964c58f59350b157bddb7398c394da62563a26a6f652ddf2c9d131
SSDEEP 98304:tog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:tog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T17F567C23A4E04035E5F732756D2C67395A327BA29F3145CB8694AC942FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 634KB
SHA256 e4e213f66bf7b94c8e4402fca69e6147fc9e6a2715f7e4f9eac149a0228d75db
MD5 1acbc046213ad931e2d4a8431214e198
SHA1 89645de87ec9feef118698251d96e7cbf566016e
SHA512 e908f63e5ae5b5f3d7f1fc4228e4fd5a815b8aff7b9acaab867d3674edfa627f29c952b1d69b25a3372d12bdd2cb219c0ce5421249339891949c0670c175b043
SSDEEP 6144:KQL+0QEmdbQLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rL:F6046S86nHrUA9HVlK8SQBJ9t4f15rL
TLSH
T198D48E42B7D847E8E07EC134CA438646EA7178960B61B6DF03A0527A2F37AE55F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
Size 7.1MB
SHA256 f8794c179c457fa146e84102282300ce4e2d674ba27148100a9c324c96842137
MD5 a86794ddbd0fdad37229f71dec1eff3b
SHA1 91dd419502a3ca18aa4480a59f95f54621e5ba9e
SHA512 dddd44b7267611f62ca0916526a970d0565e718718ac700efd2ff9ab58569f8a1bfd1ba9a9e5c96d6981210be6b7afca340780055733aea64c93fa2313683ca4
SSDEEP 98304:Y6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frX:rCZetaEMGIG5xVqzRdDX
TLSH
T177766C47E2E600A8E46ED9B0CF399521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
Size 226KB
SHA256 e2b495e55e85620b629f9c701fa4f161b5a6ae56cd39addcf33c11590686f844
MD5 fe4473c64e0e057340bbf28660694b39
SHA1 8ae63c27aced5acccaec1503c8c907e608081d43
SHA512 a1ba45abc2200fe652776502f9cf09b781c989e44db3f9c268d0d6c430c30b07999e79356b2be5bc9fbbec1ebaee7a91ee053ba53c95d2cd54f5358ec620251a
SSDEEP 6144:3nRpAFWcwl4hvndNIaINY++++Yt0nRpAFWcwl4hvndNIaINY++++YtE:3nRpAr4svndNIaUn0nRpAr4svndNIaUE
TLSH
T1F9346A5763E930E9E273867885518A45EB33F8B10720AFEF07A0425A1F237D19E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
Size 3.9MB
SHA256 f0d5d9bff9d69fc5ad069a0a858b17ff9dba3ebc699be93c9e276fdc7f941774
MD5 4da95d4a77399647d722876e41e5ecd8
SHA1 10a3b822b9695ba5cb17b70a18cc7e14bb20f939
SHA512 529d9256c7b730e8d2d6cf9cc97ec90cdd1bb3c150d54105c040a9617eda02ff3ced12decebc00608f0416ee8df4a64457c6ebf02da5539eca3484f7aed2ee2c
SSDEEP 49152:0f6gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdQBD:0e3mMsYvRmCCENUhIUBbM
TLSH
T167164903F29900E8E05DD5B8C7568122EAB2BC854B35B2DF0750B7562E7BEE4AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.3MB
SHA256 87669b444aea471475dcfa4a8fd959f43f4c18a81246de2a14504eb4b5e5242b
MD5 b73842f6c8814ea3bcba845e31bd1d2d
SHA1 ae79d70c4abddf413482b7a8a305c44b2f7bd203
SHA512 4472876de39a689dcf1bb339e0f6d707807c908dea29377928bb06ebb17cdfec0f5f761c05df2e1162c69eca141265d54f1f033d2cb4d683bdd6d4b2cf91bd8e
SSDEEP 49152:EBib+632BuPkFKRrdE6oh2stBhuXjfS4LWxnM:OE3q6DjBf
TLSH
T1F8B57C03F29900E9E069D178D7469133E9A2BC890B34B6DF0790B7562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.5MB
SHA256 fe4d1148f22f3a1d5170d648c4ed351b785c9ca1763f94f8122a31ef530ccebe
MD5 fdda37655f355963e6c6589913f57bba
SHA1 601643feaac83d03343400996df128ff4afd3c3c
SHA512 bad73a38f58037e3666a770caef818db8ce6d0bfbf8d1ff2c2e31deb75979fd1cb5e347522fe1fe7a35fd971283777f1401eaf773483f50c6b4ee4fef01bb6fc
SSDEEP 49152:K/DvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:KLI4Ds9Ol
TLSH
T1DC757C13F29900E8D069D1B4C7568536EAB2BC450B34A6EF0B90B7561E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
Size 4.0MB
SHA256 648c6ec34ab5421fdeb87514879764419b03b066e7a88b776ba2acca5c2f2457
MD5 c83ebabd1913d90cc9b77ac0e780d75f
SHA1 aa300cc12d1827002249b1fc26187a1875f235f4
SHA512 1fc203a899c8020bfebf5dd0e418b8d3bd42261f545b0536d00f3eefffe8a63625e06433962d14af68f9911d8fd5c8dafc57ed317ee1bb8cb581c03699447d94
SSDEEP 49152:XudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:FijnUdYd+RaAj
TLSH
T119165903B29940D8D059D074CE5A9232EB627C8D47F161EF3690B7EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 1.5MB
SHA256 cd517e2f8853b2fc9b6d1b58ccbe11abab4533cde3199c5165e8cb37bff7c6a0
MD5 8fa0d87167db9299261a6a257b3db3cd
SHA1 42c2828cf4141ce00a70ce915309c3c02bea5216
SHA512 983a2df55b6a6e74f975e380b75e6f2ac3cefe22d1d1db463a0f804b9ad2018ca6d63520ce7faa85baae8da75080b536e5c1def3a985f0c20522b4ab5be44ebf
SSDEEP 49152:qfehjvHHKTdfxINPEtPt99G2Bo7EukU1a:kyjvnONRmE
TLSH
T186756A03B2D800E8D069D1B8C7568536E9B2BC454B28A6EF0B90B7552F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
Size 1.9MB
SHA256 323ef01d2820d0813a5f153699edd698cbb25256bcbcf27093d4370f53bc813b
MD5 3288e4eb7de99fb3ea38915c30e86317
SHA1 4c6646888c27e3b9bcaf1d553ebdb66985837d93
SHA512 b1c9eb48731f45fd06b73d0f4153a33753c71f8e05d7795c6f56093c894d2b6ce2e7c27fa23486f84c3256ab2f272dab3696cca77d782eaf904de91205fe4fdb
SSDEEP 24576:If5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAb:IfZGu6qG13O7Q7gLYduZrSdHBAVfb
TLSH
T102957C07F69A80E5E05DC2B8CB368B35EA717C554F20A6DF0280BA652E77ED04B3D794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 3.5MB
SHA256 bc43223a423a31380054237d37ca92764d2440c42405628df1c91a3899b43154
MD5 7c5d24bf83d460262151c64aef60b675
SHA1 1a5b9f1823da10cd497673474140a8b3f8b045be
SHA512 22e94c325664fb16d729749cb60384f1e2f3f8030698831ae9f4d3de61163af751e55276e4af16ac95e3c86215e6badf6c7f2eee54ec18d398dbc5bcf438a17e
SSDEEP 49152:0QuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:0Qo/Yhy8OnZy
TLSH
T145064903A29900D8D059D074CF5A9232EBA27C8D47F562EF3690B6D52A77EE47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
Size 1.7MB
SHA256 31fd5cafa0f380677cbdc35f738ae24b047fa5e229cad5dc416bddda3eba9bf2
MD5 1946cb632d8a0bb382cc50c4e2bcacac
SHA1 52dbb27594df041e42ce320d74ba61c3cc06d3b6
SHA512 1084430e16d7a8ee867ef1f53cdf72c039048218676ba639640b2d2d07e01da1d1d4e91e8363d41246f7b2e6fecd4e7323ce03fc19efd30d766601f0e64cc823
SSDEEP 24576:iyBJnh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsN:JBX4hoNiZVB6PeuT5lxeHX04mfHI
TLSH
T1A2857A03B69841E8D06DD2B8CB468232EAB27C450B34A6DF0791B75A1F77EE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
Size 1.5MB
SHA256 f4e94c444bbf1c26acbf016f211d4ba0d7ffaca9041e3ed891a99dee67409788
MD5 8d867df6c1e667529e1b7f3ed76f6114
SHA1 030093a7fd7bcc6b7836769f49164d79b6a38083
SHA512 fc88dec7114da6fa99586ddf9324cb64405dd0933f87370ef22e2e91cf10c4608ab4aa005e7fd19d335a8cb1c034276556de7d404be78d158ebf5b23dab6c7fd
SSDEEP 24576:YZvZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:hY2fF8FhmS86IUJWQn+6h27d6
TLSH
T1FB758C13F29900E8D05DD1B8C756853AEAA2BC450B34A6EF0B90B7561F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe

Path C:\Windows\Temp\2026-06-29_c26866a99c8365ca90629dda9f88dff7_amadey_coinminer_darkgate_elex_luca-stealer_magniber_njrat.exe
Size 5.7MB
SHA256 0a44f71683a512feb884ab34881c25b71e4ebf066f689a6e56aa4db73c192249
MD5 0c4cb18763e5b4081a3051ef5f916ab4
SHA1 a27be9e0442e17f9a3bdd0d131bc138a68a6552b
SHA512 43f1c6268ee846e7aea465d5635a28352068ce4b9c80bb0d53dc37048be930caf0bf1eb503af012997c0ae450ab54953a5dcc666931db107a05b701acd92bf4f
SSDEEP 49152:PmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P3q:0iH9MfT3NwMkKhBRr0yAk6qkKvs
TLSH
T11E567C22B902C139E15102B159ECBFE9C49D99348FB105DBBAC41F7E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\alg.exe
Size 112KB
SHA256 699614a0edcd683b3ced3ecdaee8ac57a140c04be4e5185318e34897f9daf0d7
MD5 1ae52d4ab6aeff78ce8b5893180de7bf
SHA1 b0a7547a0288646bdb362cbc83257f470ade9ccd
SHA512 4b4b7fd0478ced14f0e65d9d53d9dcea8e05b7b9310063dd79da1c568e29bb76ea3385c5b65c759df270c5f65c7f413b4506d6e9960513d2c9e3ae50725e309c
SSDEEP 1536:5H5C1RUdPzE3RCvcK4zqhNCcVqUFdjtzty9jeal9G6Mb1tBaJ9NEyz2sfQ3nSZkh:5HE1RUp3cKAArDZz4N9GhbkrNEkjkAdS
TLSH
T1BBB3E0997F2CD5F1C8A106B1AD2F8B500675BDB27A80C13297A1BD2FD877311C633966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4084-282-0x000000000E430000-0x000000000ECAB000-memory.dmp

Download

memory/4548-126-0x0000024E01E00000-0x0000024E01F00000-memory.dmp

Download

memory/4548-120-0x0000024E001E0000-0x0000024E002E0000-memory.dmp

Download

memory/4548-133-0x0000024E01D00000-0x0000024E01D20000-memory.dmp

Download

memory/4548-119-0x0000024E001E0000-0x0000024E002E0000-memory.dmp

Download

memory/4548-125-0x0000024E019E0000-0x0000024E01A00000-memory.dmp

Download

memory/4548-139-0x0000024E141F0000-0x0000024E14210000-memory.dmp

Download

memory/4548-121-0x0000024E001E0000-0x0000024E002E0000-memory.dmp

Download