Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
39 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
- Size 3.2MB
- Sample260708-elvsksa18k
- SHA256 20d2ccd65bb0b87dfb9f3889cbc7a6bdcfaba982755c5941807371e4700df14b
- MD5 f7c944b0d70ee1f5bc4bdb23cb77d951
- SHA1 d0ade1a307c24d8b336e8831e0ef9c76b6a4557a
- SHA512 9feef63eee09619e45edc15248bc9f2fb8dd01a828f9fc54619695617dc10eebb6378ee37beeda743f380d27f02ca0f02e089e862ada52379090321a5aa8af3c
- SSDEEP 49152:7QgNqjSWrYs3E5C4tAwAeyfvE0Z3R0Tnxn1o2d581KMxmUuViU:7j6SWrYs3yC4AeKtwnW2ETwUPU
- TLSH T16FF5AF31B2918120E5F39370297EB7EA5B75BC256F76408F32D8BA390B725C09D35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe - Executes dropped EXE 22 IoCs
pid Process 1156 alg.exe 4488 GameInputSvc.exe 2156 GameInputSvc.exe 4016 elevation_service.exe 352 elevation_service.exe 2004 maintenanceservice.exe 988 msdtc.exe 4840 OSE.EXE 4536 PerceptionSimulationService.exe 2160 perfhost.exe 5944 ReFsDedupSvc.exe 1944 locator.exe 1232 SensorDataService.exe 1940 snmptrap.exe 3040 ssh-agent.exe 1620 TieringEngineService.exe 5080 AgentService.exe 2896 vds.exe 2472 vssvc.exe 2032 wbengine.exe 1468 WmiApSrv.exe 1444 SearchIndexer.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8d111bccce3e03f1.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118546\java.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118546\javaw.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118546\javaws.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\mbamtestfile.dat 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003afe41ab8e0edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a2dc2ac8e0edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018faecab8e0edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d91ffdac8e0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe - Modifies registry class 38 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{DF72A8EE-0594-4574-B915-10C990DC5CD0} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{ABA1F1E8-5FE1-4568-8EF8-1F8BA5B386A6} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2156 GameInputSvc.exe 2156 GameInputSvc.exe 4792 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe 4792 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe 3236 explorer.exe 3236 explorer.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4792 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe Token: SeTcbPrivilege 4488 GameInputSvc.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeShutdownPrivilege 3236 explorer.exe Token: SeCreatePagefilePrivilege 3236 explorer.exe Token: SeBackupPrivilege 5944 ReFsDedupSvc.exe Token: SeRestorePrivilege 5944 ReFsDedupSvc.exe Token: SeBackupPrivilege 5944 ReFsDedupSvc.exe Token: SeRestorePrivilege 5944 ReFsDedupSvc.exe Token: SeBackupPrivilege 5944 ReFsDedupSvc.exe Token: SeRestorePrivilege 5944 ReFsDedupSvc.exe Token: SeBackupPrivilege 5944 ReFsDedupSvc.exe Token: SeRestorePrivilege 5944 ReFsDedupSvc.exe Token: SeBackupPrivilege 5944 ReFsDedupSvc.exe Token: SeRestorePrivilege 5944 ReFsDedupSvc.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 248 sihost.exe 4792 2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe - Suspicious use of SendNotifyMessage 41 IoCs
pid Process 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe 3236 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1856 StartMenuExperienceHost.exe 4036 SearchHost.exe 3236 explorer.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4488 wrote to memory of 2156 4488 GameInputSvc.exe 93 PID 248 wrote to memory of 3236 248 sihost.exe 97 PID 1444 wrote to memory of 5848 1444 SearchIndexer.exe 122 PID 1444 wrote to memory of 4616 1444 SearchIndexer.exe 124 PID 1444 wrote to memory of 1984 1444 SearchIndexer.exe 125 PID 1444 wrote to memory of 1192 1444 SearchIndexer.exe 126 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_f7c944b0d70ee1f5bc4bdb23cb77d951_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4792
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3236
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1156
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2156
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4016
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:352
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2004
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:988
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1856
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4036
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4840
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4536
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2160
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5944
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1944
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1232
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1940
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3040
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1620
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
PID:5080
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2896
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
PID:2472
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
PID:2032
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1468
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5848
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4616
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2756 2596 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1984
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2884 2880 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1192
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:3708
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 93a23fc31207e29df133e810291708e989f33328dd2ebef57ce6370ed01525c1
- MD5 8cfdc71a732da1262bc664730088bf97
- SHA1 043289c0b20a5aff03fe7e8a06ef6d3eb9b03adb
- SHA512 7e7a105cc4d0ae44101687844b1c6c3979394c334b7489637b718c8fb9fafebed4ffd5fb505f36200f0b1fe86e48fd419f3dbf0acdcc4b315f4181d4beba77f9
- SSDEEP 49152:Db+632BuPkFKRrdE6oh7stBhuXjfS4LWxnlxmUuViU:h3q6gjBEwUPU
- TLSH T137D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 845KB
- SHA256 1224fd78f10ff6dcb139a2781cc668ba16d64d6fb8b22dad0e96604096d2450c
- MD5 c17d0f818cf5a20df465538fb0975e01
- SHA1 577b2116d831c34083d08fcbae3f1d4bf71c6358
- SHA512 811364d00c7f4742b6f123269b62a5af78323fe2e5d6156f6eca08fa8089bfc77bf913170254414b88171c2a98dbeb93df93babb912013044df5951ea95ff8b0
- SSDEEP 12288:x1XLs2kWkxy2lRq2czAx2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:/XYdDtczAc0qmGq48HlVZ4U
- TLSH T1C9050129A7E408F9ED67C13CC9A28541EA7378454764E79B43E089261F337C86E3EF91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 8622fdd90aebb9ec7786a67814e4321b93d497beec8f8707c27ac5bfb1c1ded7
- MD5 e79cf13caeba0100f64899f849fff2a6
- SHA1 739bc230c97e855dd464071c9989eef99ebb46d3
- SHA512 ec8a8ca9fc328d347dab25702a88d51165383f2abd6a018be0a839f91bb43f6ee8f2578a26c5a582132224adec605efc7a15f53588b71825bb4e3cffc960a8bd
- SSDEEP 12288:5wWNYVQeNUq+0h90ZD0wxpGZIVuhrHsB2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjN:V0QeCq+0hmxOrMM0qmGq48HlVZ4U
- TLSH T19835AE16F6748375D073C0B9C5D2A68AE97130865B308ACB4286C77C7F67BE68A36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 81e9aded6444b9b199093b0d53179f60c9c81ef67ddb9640991e7499eae99af6
- MD5 691a8bbbf5f3e113702fad4789bc5ef0
- SHA1 93a935393e75bb06394fcadd45504da168070847
- SHA512 b392218d3b1241feba3657cb564f7df0fc5b86d74bb9bb6d74dce36a241ca5226e04afe4f8f78b1f4f7dc0161ff68f715a820e2d633ca15185433474a41dce01
- SSDEEP 24576:8AE/ezSC6vUyD/aqgrvW/6q8wyu/0qmGq48HlVZ4U:O/ezSC6vUzPvuHjyGxmUuViU
- TLSH T1BC756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 9121ab76c89df2f4ca2adee657d53d72d0f1e8105b2a052f9ee749a73e94c02c
- MD5 30e02d8de2194968c4f2ecb0905c8074
- SHA1 1af2c5827c7c9254bd2792ceebf09ac8bf864b42
- SHA512 25d2a0416677cfc7457f8b02efea88849cd885b064af178d8cdcb7aeba5741b41e605bd5141216c772c1349a4edbda1fddc90ce03bb63b0fb7f2e39cff0c76fa
- SSDEEP 12288:baJjBZ33vyedhO+l1D0hwsEBoW/lx4jf0Im98S2GcSCIfQUz+mGqgF8HW2lTSh5I:babZPyahPv/l+dB0qmGq48HlVZ4U
- TLSH T1EE55AE66F5748331D073C0BAC5D2AA9AEE3230425B318ACB1246D76C3E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 599KB
- SHA256 1481bd8e82b60253e29164d8c00db115a14949f0116209e11526d2681bff30ca
- MD5 2887ba95230ef3228394f309d829f8ef
- SHA1 c2b338e7098245483f28e3a82ef65c421ad96e88
- SHA512 2069644ec0fcc4026d06a0763373333d96bc6766d92bb0cb74e3ce5e89331b76c93be1c43f8af7de9ad62c21f5a88fb1a2560c6ecb7de1f55b450aa864237f73
- SSDEEP 12288:OEG2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:OEd0qmGq48HlVZ4U
- TLSH T178D42316CF2838F8E3C1C938965A1DC535963A8A9D6C5AA8D1602D035D32FC3FEB59E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 859KB
- SHA256 ce4aa3de91afd5fb3ed9d3eab213014c06bc76d23f08216c8c81f348d6b04f7e
- MD5 16f8c38cf455b369be8db7b5a93e461e
- SHA1 dd6c5834c710376d2dad66ecf06f2aa9f4cd4713
- SHA512 f0aa5f2d9491a7b790e008ff5404e0a2a02628ab63491869f2e6ae2c3b82706c50e0046f68816f515e1691dab5f52a48b618e4331032ea03264423949be4ddfd
- SSDEEP 12288:FeBNUbTVO86UW2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:FJIUN0qmGq48HlVZ4U
- TLSH T1E115CF3BEE28FCE2C27A8D7857918640E77274714F61A3CBD164820EDE236E15E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 1.0MB
- SHA256 c028851c47b9372a2e3ed1951b85bcaf9e4155d60ac258712410d6ef65bd35f5
- MD5 06d0e593f46942e38985a45673da9586
- SHA1 d6530519ccacb32dea026ef334f0299d8f4dcdd9
- SHA512 3c76a83b3a8691246362d0e2f6d50c046ba3ad21add40b57150bcf8701fa7ee87082c3025fe8db676f7c33f58701288aab79a7f423b9f9ccacfc386fd894d1ae
- SSDEEP 24576:pbXt2hcMcIIlyEQTY3WPwWnFgcihNOqY3IGaWCh5OAJhbs5CPM1ea5946EsHCysv:pQIlquu1Gn1jKm4ptlQzJWwbr
- TLSH T11B256C5647A841F9E56BE068DA2ED973F7B238060130778B0BA1CB773F77A60692D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 896KB
- SHA256 178e95e9081d7edb8a4b47f388662386e999daa15b88ef0759272eb826607a70
- MD5 2ccb7b003cf4a6c0cbea039c675bc953
- SHA1 46cf00e52901e6c52a038ce90edcc548d82ee0a7
- SHA512 ce389d31e615868271c330a0fac1510820548adeb6cd9d6934071cdf7c612036c9e1667398acb7d80a1e63fa7f607cf91fb305edf1ff3923c217c6460f459b8e
- SSDEEP 12288:9CwSfxL/2Dc3bDLLmt0LDQewsAjR2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqz:0mewsAj80qmGq48HlVZ4C
- TLSH T10B15E031FE74E436C3BB0DB61B26C716246D79204F611AC3E3A84E8E59302D26776E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 768KB
- SHA256 d92c31f83ebd088065854346f458fe727d8b0bd9ae850df3e993720d082c6973
- MD5 2efa6d649c50082c134e8e25152d5bb6
- SHA1 c0a5c5d7f0e7df29c7d7fe6cc829cf1e7d795c4f
- SHA512 103e7038f33ae8ced08e8531b03d96ac999cd5d566053ab06abb9a227817d301261bc2ec1cc36d4a90ccfa00f1638345c1133cf2278ff62e0f8da4fce805f28c
- SSDEEP 12288:Jgw0PYVKfacg8aLFd1d5FWsmhfqeenskOyC52R4fTXsBnK:kYVsdaFd5FWsAfqeeTOyCkaX5
- TLSH T158F45C4A5B6801F9C577E198D69A9637F7F0340509346A9BCBB2C7472F3B660AA3F700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 1.4MB
- SHA256 dfa3e2084f07c42d497cbec0594505a8ce1da90af20d817785f88608a5872a4a
- MD5 69023fe0fac33d32832d2943c291b091
- SHA1 be05f1f3fc48cdeba11b8583872b1bf7d5736c8d
- SHA512 02b6ec2e61fdcb97d87319905be22a0b766981f2a06f18e9449099816ddc0490dbe61faf5a28ff518e557c9e657ccb8bcf27cc7abd1f74c03c4c3c5516cf7100
- SSDEEP 12288:yfq1gskg2gMjoKU6aUANzA/vu2L95o5YgDa4ACTXfKqfS9LGzW+0yTljETMo1lQv:31bRquA/m2z+L5WqJGrHCYRu
- TLSH T1EA652A5A767C02D9C1B6C6B89787C503F3B538190334AFEF866246572E33EE59A3E610
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 640KB
- SHA256 32881372e4e64e367ed14870e3244a3049070b93eecd7b15c0d25fee1dba2601
- MD5 85fe6c8082ece371902d6ca8628e8bb6
- SHA1 27b6f76e429cfe0c1a03a8247d576b9dff8ec487
- SHA512 3860ddfe997c515cd3d8bab5489fd01452de081d138c1f8a494519da9b7f831f9ae4b478ebd90eb7fcfcedd41c24427cc45e16ef8a441eb8b3f594120b10c1fd
- SSDEEP 12288:LAZ/GLvsFoiwtA5qy97S9uaYFLq3On2GcSG:LAhGLvsFoiwtA5l7S53v
- TLSH T1DAD42981EBF955D4F5B3AA7899B68571EA76BCA65E30C20F2160D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 824KB
- SHA256 439ebc0b797d559794ce721c4cf423b7c539f9ce1ae23b57ba4f2dfefce66a1f
- MD5 137e02536f544fbd4d95d904f3666c18
- SHA1 a2d080acff86ee3f2282a5b9c34a34747d8b841d
- SHA512 b90c4fbd4914ab63d7b4f732878873ae9983a5653fa6f08e197edf19f9e77168c6a4bd9fb0e85b66c8437f91dd1d535cc7b6d09465619bfbbcc8d6ed6817f5e7
- SSDEEP 12288:Cmw5HEjsChNYBFgl0WBm+CLJ2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4U:bwuROW+E0qmGq48HlVZ4U
- TLSH T1CC05F14667A41CF9E5A28538C6478576F7F2B8022A35CB2F5360C61B5F333A1BD2DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 512KB
- SHA256 d56e76cadc5bb88998b244f1fbee57efa583a582f9c1aac26fc6f2bc68638eb0
- MD5 80873c457af6433a505b67d0657001ac
- SHA1 d642327312a89fecf3467da2d751cd159a3da232
- SHA512 1df395ab985024e7cdc448366b8bd43c50bb4c9f6b1e9d9990c9e379dab7efc69b1a046a40e1dd5a657ced922636c8f23e3daba2de8c1d596f93e357e6712ee4
- SSDEEP 12288:op81I3i2GcSCIfQUz+mGqgF8HW2lTSh5SfvtN8:y8uB0qmGq48HlVy
- TLSH T186B4129B6BA434F8E293813DCAB60A85E7B23486577143CF516006971F73BC16E39B72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 128KB
- SHA256 a4adf61e738503abfad04daea1240444cb8cec8ce76101b7c12aa60bb328b148
- MD5 ce73ad4ce86ac61aaafc00c996682f19
- SHA1 be907b730c711ffe228fe9ed434bbb9e8789015a
- SHA512 a7b8cda054f914654b4f61f6588915ccdfca1f24763b654da9a4fdef75d68ff684e6c48f88c5eab4ecb73b517451054e26e44ed3164359d0f21d6747a30eaa69
- SSDEEP 3072:GJUfOdBNTk8kukm46TTf3Bt8RR7HjT8QETijsx18:/e7/7vBWRJT8biB
- TLSH T1FDD37C7CB4E210E890ABA9B1C1AFA2792246B43E15E405F713C5D0D45C17ED0FA6EEE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 42KB
- SHA256 acc5737dc0e1c6d45b96bce610060c273bdea187670ffd0387967a3160b1d099
- MD5 36d6915fffa2351b1a3b5537fc346be4
- SHA1 f856173b9862f54914b803bc56cfa076ceceb0c1
- SHA512 596a3dbf1b40a3e8a46e6c10c859ba87806e113596f4e81d8f23cd9b5fefd3855831f541967976002b37e74144ebee655f9aee3f0cff89581a466c07d08f15b6
- SSDEEP 768:GVMNsggPoooRwUca/h7JAO3YpdBnp6p4wjn8Tk8kLak8P4Jgl:G8wU9JOdBnp6ptjn8Tk8kuk8P4m
- TLSH T1E61309BD5DA214A8E0EB62F4E66FA03954D1F83F5C9451A693C4C0920502FE1FE67ECB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 320KB
- SHA256 ce5ff656790bb158e37baa7612f715e2e86dc7eb79e45b246394bbb9cdb021ea
- MD5 2bd7ed14a457850776f5e46d56d85ee3
- SHA1 7539067bb6beff84e2d16a33e65463f1c5dc10c3
- SHA512 9868dbee40165395bcfbe1377807a62b557ee46bf756f5b51f7f40ac9bbbd195100162cebbcbd739587f329929a789fa1acca9cc30c95eab8f58948ae5cfa515
- SSDEEP 6144:527/7ZfqRHrm0qLwvhBD045gc2tfhYSyjC:5sXwvhBz5yf6SyW
- TLSH T157649E27F2D901D8D09ED4B5C75BA132B961B46A0B21B6DF0A40C3A11F6BEF46B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 192KB
- SHA256 30d9cc775ad3d958b81cce4bcc140e6165e17e8afe7692208b4e76308a88e649
- MD5 6afa8a45a52e71c1cf5c5e834cac38bb
- SHA1 8f549291836fa2333b7696f829ecb54d7ec38ced
- SHA512 d9bcbe21d422bed28b0da06363c4a47aa763e66714dfa03fcafbf0286930ddc021b9029c38f8566ee1a10ba24406c8ae4ff6c216416d52c4cad3455e8ea3f1a7
- SSDEEP 3072:FHUxxd47bk8kukm4MTn8ZT9kRTjRz7yQ2SdjKzR5vfbEnvId2sUyiszx65Jd:a+7/7STeRV7ypuAHvfQvIoWiXd
- TLSH T17F149F3BB5E510ECD0AED0B4C34FA136A951B43A1B6065EF0680C1A61E6BEE0BF7D751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 dd6cdf4e06cc211ede56ff03cd8f4edae7526cac87773bbae4388d403eff8a2a
- MD5 2916eb492b0a2ba3a90821ab4a6d0950
- SHA1 2e68060f2fe7b2e9cd8364f5e9429bfa77e4c933
- SHA512 c686dc9056ef76e670f59c18d554f6af2f752f54108fb7eccb64f287b4fda30396d4a086987111874878f9a4554828d7235e6cc4eb105eedd5becff45b26a81c
- SSDEEP 49152:sB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glQxmUuViU:mu6JmTxd2dQwUPU
- TLSH T10ED59D13F2D901E8D05AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 ce43b6474786c609a93d79545a3e40a036b553b183189cdcbc2090179c3c37bd
- MD5 08526c58d1d82fcb7b3ef9f5fd5eb6e4
- SHA1 430ab2b907d95ac2bb93cbfd094bf90cc3fc3b7c
- SHA512 b2117262690a91e99b4593e91c288a6651a2cfbaf658e1d7cc5dcef3671a85ca14dd742f000d6a2b9c779ee9e4547203953655ecb9ba1f7ce56d46bb7663341c
- SSDEEP 12288:HywvD5ue64Lk3tRX69qkyAI5C2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk1:Hywvtk9RX6wkyAIT0qmGq48HlVZ4U
- TLSH T19535DF29EFD804E5E1B7C13C89A7464AF6B178591B31C6CF125A536E0E33ED4AE39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 2.9MB
- SHA256 310bd09338d5d077e949c3ea0d783f40604dc14a06818678ef867946de6a16ba
- MD5 666bd4512372dd4ebab269e53ccb82b9
- SHA1 17d9444f8bb1805c381975ec947c0f8177be9f15
- SHA512 1184d90f04d939696bcd7f24f934cdfc299f534eeb5864421bb3d4f104cba0322aa564a76ecab3e1793bd37178c746cde168837cfa5c6cea2fb34b979862a302
- SSDEEP 49152:bYkvNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0:1ySzP
- TLSH T1A0D54B9661A801D5C1BDC1B98F1BCC1BFB7134490335AAEB02E556935F6BAF0AE3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 bf7f79f7bded7ab74c3638024fc3bd585f17dff6e1d01947b04cce84421028b5
- MD5 58ce684a7b307e89fbdcf036f4602fd0
- SHA1 44e4eceff731f202192b7389967b96f3676dae51
- SHA512 1ee5f4d559335c71abf00dee08877b52c20856f4d85429aabf388b159d2647a47ba82e9df4fa62999a2be97f1e0aaa1d8d8a0655abba97339f6ef22efecbf3e7
- SSDEEP 24576:0T7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYP0qmGq48HlVZ4U:0T7JUQjXirIhCnDHUPfF/NxmUuViU
- TLSH T13E659D1EA3EC01E5E1BAC27885154A5AEA71742E5F31CACF2270427D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 448KB
- SHA256 aaaa8781d4f23e0c0bf864b3bdcaf0be78912682cb6e2913740d3486e4e6608c
- MD5 b71d775bcb1311ee93957a8cebda4166
- SHA1 f9fbf80f4f21eddd6250e8cdfe458decf82564d3
- SHA512 793cb18a6c056334a14aa91c0488b731253600533d3c5fb1fbeff267fe0541d0aae2154812738a752d38c1bbd691863d3fdf31e93ad38b7c866863cd287a2b32
- SSDEEP 6144:SRpstJISsQFqTYnyN7sD7AlWJcS4pRHIfQU0OAvnmGqu5FQb1H+HZLr4r6ofSWxI:HTsfYn2GcSCIfQUz+mGqgF8HW2lTSn
- TLSH T11AA4DF1AD65811E8D16E917AC7164A81B3733C2987E1D3CF52D0F93E0F72A906EE9B43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 8KB
- SHA256 2f19db6431c4a194281ff4790d1a9b1367f7c00e6b07e6b703181f2921cf372c
- MD5 73a3dbf204b3e55142d1ea8e0769ab08
- SHA1 0dffb404f285933938806bf7ff6abbc99134644a
- SHA512 6350805c649f7c8becc29613d00e3ee1dd548a23cf39b98717f3608fb85bea0cc67ba2c3cf68ac844c180177e3054a22801d2d50fc8f508e4fc9a6b332ab59da
- SSDEEP 12:KftzWEEEEEEEUsr4InEzBRMtrC0EEEJHtEx3Xsm5Rv5H/nPPWl:KlCO8I/CoZR
- TLSH T1EC02E596FF814911CE0321B7D6126BA507B3E318D4D0F3872264A33CBC552DD8C01F09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 606KB
- SHA256 4404174a2bfd507c6454d8b4276bd52cb611856ae261bc7899e5704b3bff7740
- MD5 7002763e060b7cf6c58de017e0e4fa04
- SHA1 d18a2a2f638914888f8c06ac7510170adc8af017
- SHA512 eced01a9b01056d472c1e5877bf302b870e64eec4a4cfe16dfd9110263c81b1a51827152330123726b998fd21f09b3f6fe28bdb8a8992a2a29e0599f320fa8ed
- SSDEEP 12288:TP7Q2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:P70qmGq48HlVZ4U
- TLSH T1ECD42312CF683CE9F2A0C938464E59D5355A364A9F6856EBF11019036E32FC2FEB4ED4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 cf69af4bdbbbef188a93531fa745eda28ec19b9b34e6428883ecad4580e34dd3
- MD5 db8162b90a4c327b53677a2387122b94
- SHA1 be6568775bed9f80251fd37b07a229ee3b87291b
- SHA512 222f13c73e87d17478ccc5537cc9179d0192b74a2a4f3597f610187e87334bad9187558400d168d208989dd169e0ca1360765e3ab44dd74a24f4c8a3ea5404fd
- SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYu0qmGq48HlVZ4U:3gb4mBIBhGFTxmUuViU
- TLSH T12265AE1E22EC02F5E1F9D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 656KB
- SHA256 77e5cc4834bcaf14c9b269254ec3077b803ee80f53f17da1df945b2ba1f3cb86
- MD5 47a2941dca10e7795d5e15e72e322bec
- SHA1 32c9b19875d26ca3598259a292da1a48b6eb7408
- SHA512 f0218203b7228bac1a7d854315dbdc83b823769097f831adf3dc5a09da6d7ce98a91951b1a63163a9ca02ef148943c5e42aa1936ac75feabec12252e6c812bfc
- SSDEEP 12288:6LGJ32GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:sGJ20qmGq48HlVZ4U
- TLSH T10EE4122E8AB438E8D175CA3C855619D675B235819B2816FFC19098339F32FE1BE38DD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 620KB
- SHA256 245d9129e02e81720fbb1c15e16870e9db6e0b7943d32fa1ab7afcb87654da59
- MD5 392b83e846b8079180f72c29d044c354
- SHA1 4d3f429a89abf8aae85d82fcd92dd6f2c420d506
- SHA512 48f3945e043998fe7cac7bbb805fe23d751b0fd7f3153c4ce5a7b538db449bc939bde64fec905b10de36fd4da38e2b1db4309747ed33fa12fc6db51c75b7705a
- SSDEEP 12288:nz2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:nq0qmGq48HlVZ4U
- TLSH T180D42316CF2838E8E280C93C864B19C535963646AB7917EBE05019035E73FD3BEB5DE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 88c8437a6301ec3b1a637b3a9a926f47f760996c17b6cb56f44a8e1afa81402c
- MD5 ab65cd4bd87ca8a111ed45044c8da1c6
- SHA1 e16d95b0cdefb9b447b202d0bce52fac0d0d4481
- SHA512 bb143690c42c4c32740c8d5f9dd04d601eaa63f5635edd53c7243fabe4c1a021f4c74f4518fb06a12e87c0afa78a21e78815bb25f2aee68c7db2925df70f27fc
- SSDEEP 24576:e7Q838FpJqH1Mzria7/mF0qmGq48HlVZ4U:sfMFPqVra7/IxmUuViU
- TLSH T12635F165A7E001F0D477D1388A8646A3F6B2B4150364EFEF46A88A521F23BD54F7EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 824KB
- SHA256 faff674081878663e7ed771898051c02f0f10543063d5931b996339d4c4507ba
- MD5 37f502204bb456686eec9d4719368872
- SHA1 4785ea766c6104b416a84a3f2f02c6d3e7d0673f
- SHA512 a07cae0df9b127698ab48a90ab2f2089e8711593d0ad828ddece44756586995d2593de37893f089070b1a1b62ded8aa1ef021ecbc12756e915662f5f6dcb0c86
- SSDEEP 12288:tHvUrBFrEjwaQw2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:tPUr+NQb0qmGq48HlVZ4U
- TLSH T1E605E12F66A82CE4E676D17C89864649F7727452171292DF02A0817F4F33EE8BD39B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 0b221fb16439dafd4a784abaa7457976da4a78275ba80a2187e59302c556bd0a
- MD5 1566b805837caca6afcf46dfac817518
- SHA1 46ce1ebe7195785dbd1232f3451ef53a996c2d17
- SHA512 864a64cfeed7a5c2404c9590f934b943a247df1dd27ccae6ee3a18e4977cdd2d5984cb246f8bcd5fe0183a3a65cf5791ce4c303e0b022003ecb0f727db757134
- SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDxmUuViU:QG05lO43bMwUPU
- TLSH T139D5C06A62EC11F9D1BBC17CDAC64A0BEBB23415033556CF02A486A91F27FF4697E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 1.4MB
- SHA256 53e1fd105ec23f528d2fe82e2d108c4776f5644b5464c4e04a88418839f3f469
- MD5 0e3fa8cf0ccab257539111241c37f04d
- SHA1 30934d143541d5736a032c05279abd9ada4f5330
- SHA512 355f3946a3fc2cfecf05952a00201161215089f8c32daee955ee4d56a3112c915e73031e41b7e876df97daf8ed5b8f3b98bfc0608d7220b315c91eeee39d68b1
- SSDEEP 24576:RZxLMhbo6KHgFPThMOrlANeGe+z6bX17BHpV61tKFPNlDlrUz8pHIH4Sd4fIzX7k:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4b
- TLSH T180656C6E62E801F9D0BFD16DC6878A0BEBB13426533556CF02A486B55B27FF0A53E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 61d702e00bbccb8544e5e2f4570ddb08ddd13306028d0d5650659a9b5d8fff4c
- MD5 fd601078367cba752df838d22471f581
- SHA1 709e6cea2b01c120aba565b9dfdb6cad0c29c7f1
- SHA512 fcd7dc1f09de6a62c5dd41cb53617a02eb00306f93a62a31b28981ed95bce58acffd1b2d89e17c687f67884ed221debab10c76e926cddab0fe8cd6a8f67dd58f
- SSDEEP 24576:/ua5POZ3dpbWVM50JicR2hG0lasx2+47eidns0qmGq48HlVZ4U:2a5POZ3wJt2pasx2+mqxmUuViU
- TLSH T17C65AF5EA6FC00D5E1B9D17DC583461AF5B1342653319BCB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 6b3bb339f7e171b9c335fc47cdd1e6cf1a342ea687fa41ab4b5fc4090fba5e1f
- MD5 c49e4763f8a2d7f101c1dbec10140cc8
- SHA1 e8310782400e5c45f927dab9a387a0f37763e74b
- SHA512 cd66b41c3b566eb2e1d04da6d7167138f9fce7cde401902d68453fbe979502ff00287add222cfb93483a351f979c30d0ca166afecf1e093bf523f787800d74af
- SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7Fkw0qmGq48HlVZ4U:WNc/zEOVHFZxmUuViU
- TLSH T1DC858C1623E801E4F1BBE1BE89779546FAB1786553348ACF0291851B1E73BF46C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 928KB
- SHA256 5966a3096507e560defa60ea37c50ed2770cd13e7bb03c6273d30ef7d5fdbbf1
- MD5 ed6082d9bf4f443ae533f3b145a0a646
- SHA1 06b4d243bc1ed2b8c16f45dc453e75ebd718452e
- SHA512 795e0a1cdf6615d8b0cfb7154280b910036ec5e28eecb8ea9c43415bfe84c62a6c45fe22e597acf66ea455da86726e4c930746e5b4d0b9ce1c23f7d6f18b325f
- SSDEEP 12288:XYHPJnJP6szeCs6Rl28dD2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:yJnJPbzB4Sa0qmGq48HlVZ4U
- TLSH T12615D03DC2A820E8E4B7C274811A1B9AFE31346D2F2569C759B4D4353F12FD0AA79F58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 96879037a879c791906c04fd7760253dcce4db124a9fa9bcb5b9e7e37c7ae7ad
- MD5 3efa9686f9967cb2578f6779688f5919
- SHA1 3caea6ec042c8ffe5726a3edbfb0995d0b2ee241
- SHA512 60a4fe3deb4953c3bfd0ce9c2aacf6175831865ed4a6350f1d460857bac6d179a0bbb658d2c3373670ce2cbc3427a94cd7e940a217fd55494945f40101ea142a
- SSDEEP 24576:eCLHGL0MoeVtFumTijCmlKQWDkX0qmGq48HlVZ4U:eCLHGeeV5ijCmlDWDkXxmUuViU
- TLSH T1E6A56B05E7EA5184F8F3CAF5CA2694169A327C449B34F7EF4A80C96A1E32FD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 772KB
- SHA256 c24ef2cfd775ffb7ac9e724e997244d94a3a921a579ca851ca04e343f9a488b2
- MD5 c1b8484c77d160485ea69e8670da9a39
- SHA1 eb6ffd75164e5dc88fb4c8ddaf61cdbf08f0ee25
- SHA512 68788199105440c725db16430b461bdf3bf64dfc3855fbdfe2b9f4a4322d778e1953bef696ac7ad483cf184ad30fa472162029adf3ab2df228b92e75f12e6755
- SSDEEP 12288:e1Hck6j5ZI7m2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:y6DIh0qmGq48HlVZ4U
- TLSH T1FEF4011D677920F9D1A7C03DC6830582E2B2706187261ADF8694C57A5FB3FD9BD38E81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 756KB
- SHA256 8adc64bebc60d046122ba4eafdb70cd663a206b06f12c56ca57175b0b89494da
- MD5 19e37030b468816fce8f21d0bba27f66
- SHA1 eaa6b7fb8c7e4c8ed4edd9d646f7697b2a9bcd04
- SHA512 336743dceaa426e148b86a2da5e596447763391347b0118a1113406ffdbb6448548859d0f500f468072f0e756321289e475019d7717f3a5511ae9566f3ff8f6c
- SSDEEP 12288:MG6kya2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:NtyZ0qmGq48HlVZ4U
- TLSH T11DF4120587A834E8E6A5853C8A6741D0AA757C009B3553EFE190AA2F2F33FD1BD70F91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 628KB
- SHA256 4c5bb06504c7b791393b28e1744580373fae74a4dbea4146b689c585485dc788
- MD5 01acb3c09bbf6419365232fa86061eb1
- SHA1 7c4fc3fb807450f27cfae4a81a63b752ee37691d
- SHA512 889510d2d35c3d251ec8fcf78fac60bf581313d5d18660578bee9b9c0a5b55b233d7bac162ef9955cf1627c393f3602fdf38731ade55741683bb26348b41ba3e
- SSDEEP 12288:cZj2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:i60qmGq48HlVZ4U
- TLSH T1E7D4231ACF6438E8E280C97C461A0AC5716635869F7916FFE09059239E33FD2BE74ED0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 2af4eb9a316934cb37a73ef85a9c9322f84452fb614a51b9524aa46c19af440e
- MD5 48c477763d33a2d8897241e2b670791b
- SHA1 6641cacf2b5f20d42a55582e56d34260d617ef4a
- SHA512 56c519cbe717541b5d40024dd432fe319c18877f4f7f86cbe5ed9dad46ab13576b01f1a076814eb3c91d7cf0e51454a8e1abcd3fe70e89bdddc0a845a3bd2169
- SSDEEP 12288:5mgIuZyFDK3tT5Tr7aVLIH9lH3c52GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqB:5mgILoTfaidZX0qmGq48HlVZ4U
- TLSH T137559D1DA7E905CAE2B2D639D8631493D633B4315772C6DF2448C03A4DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 788KB
- SHA256 1377f05078d45212d8215e0d17b584a04e6ca47e11956c7e7fbaa1158cbbdebe
- MD5 4761f2e08da55da31b58370255d9d719
- SHA1 0fbaf5a08117c7bef5caa8f73cef7fca3188746a
- SHA512 60c56cd2670c589b34162d8968bbae34f057f11a5d35e9ea4d946003c84b8a836b3288ae239358363cb059e032d0a2dd3d28c46e308a3853af1a18598656e550
- SSDEEP 12288:kpJcm8CN1h2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:krcmR1s0qmGq48HlVZ4U
- TLSH T1FC05F10EB76D10F5E1B7C13CC9464585F6B37021672267DF82A0873A4E67AEA7D38B90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.0MB
- SHA256 a2de334fedb796d4a9de480d15b2c7868b16ff06a7a69cb6d70534c4cc1fbfc7
- MD5 a218921630c26972061a9d0a055bd46a
- SHA1 852532fbff7a0d118f0570bf813068c65413b61a
- SHA512 4f46362a22a4aec350edff81625e1c222304a4675b6509a84550ab747a3ef7303cf924f4dfe297cb512b0cd018487004b6c2f28ab19d671cb6b8ca0bd55bb682
- SSDEEP 49152:sDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3ixmUuViU:p3Upow8sBBwUPU
- TLSH T1BEA58C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0170C578BF1BEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 4bc7cf24d5b13e5f0818682fdbc3e554a4285961c54db74bb22779322afdbd91
- MD5 82c3d78058e4648c1eabba3c9248c826
- SHA1 29b18b834df49af01ae301bf18bd70935f6907a7
- SHA512 b4e5a60cbccad4c38082b7a7fb757d00e2fee91865c94a508f76a9f7ba4140da92e44622a4c6828432add392656c02ad420dcf490253dc76a96ca0aac854b73a
- SSDEEP 24576:7TkNvNnaFeYhJNtmZBmN0qmGq48HlVZ4U:7TMwBtOmNxmUuViU
- TLSH T14955AF2EABB806E4D1FAC6B4CD238512F6727451173293CB9290C13F1E679D89E79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 984KB
- SHA256 aa0d1d36b47fb1db028ab3580e67d93ca97b57462986076fc4b031364473360c
- MD5 96fd1a4079293f9ce4d6d23ee6676d70
- SHA1 d3f8e6282bbb07a5db410dd68a677baa118550b9
- SHA512 df3c6effafd957eb3782a3ca30693b2a90b8ffee46bc267d8d89bf91bed0b939fa775b92ec27e76b27f6517c7689f434738940eb0164412d30d0720a962ceaaf
- SSDEEP 12288:CQcMxWDXN1Dp/fshBItT1IQgAe2GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBi:AD3FHshBIYQgAl0qmGq48HlVZ4U
- TLSH T11125E13EDBAC04E4E57AC1BCC6534A06E67138A9033266DB529081B61F6BFE47D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 764KB
- SHA256 2a5ef823e255a21cf7dcc899dcfaba034c80b7ef927ac27752e81e34889e6bf3
- MD5 6ef598a758a6ccadf11a432693b7c07f
- SHA1 8ea28a4ffca9f5d736e500a668b0934dffc85c93
- SHA512 1b242adbcca146ff8e9686f6cbbbed3ba316a3caa4c4dc667cb91c361e1f768f7d7b0f13576a6f5c37680b1a1f3d2b22dba0a74cb03074a634b6170501aa04bc
- SSDEEP 12288:jyS6b3IkxjbBz52GcSCIfQUz+mGqgF8HW2lTSh5SfvtNjbNSqWBk4Sh:x6UqjpU0qmGq48HlVZ4U
- TLSH T15BF4120E8B9438F8E0748638D56641E551B17862177956FFB1D48A3B8F32FC1AD3AFA0
- MD5 SHA1 SHA512 SSDEEP TLSH