616518594c52b47ad53414c9e77e7bfa738bb819fd2363085358932016698099

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Size 17.3MB
Sample260807-eep9hsxand
SHA256 616518594c52b47ad53414c9e77e7bfa738bb819fd2363085358932016698099
MD5 83c1c36f5125cd3044e4030ef3b7724b
SHA1 6cce4f11bd3f68b76ec21843d5edf802cc8692e2
SHA512 df7f0c17167dcc47921fcb95fbc57f9ae71fe99b51934c85afbd9e1cd84e7bf40014dc17896820cdf62c769227e352ba75013dde8d088b82a030e093772c9b15
SSDEEP 393216:kFHnfRI67blpTg2osZTK7Kbnlyrgb3zWpuHs8nLbSDV9:Gn7blWQZTKeZyrgvSdKLi
TLSH
T1B9073310B742C1B6E59B12F07D7CAF56973DEE204F6198CBA3C4AE2D49311C26A35B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery ransomware spyware trojan

Malware Config

Signatures

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SETFF6A.tmp	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Windows\SysWOW64\SETFF6A.tmp	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\SysWOW64\SETFF3B.tmp	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Windows\SysWOW64\SETFF3B.tmp	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_43.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.he.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.hu.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.ro.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.tk.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.vi.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.de.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.el.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.it.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.pl.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.pt.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.sr.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Polyboard.exe	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Polyboard.exe	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Uninstall.exe	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.bg.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.nl.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Uninstall.ulog	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.en.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.es.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.hr.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Uninstall.exe	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Uninstall.ulog	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.ar.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.cs.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.cz.dll	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe

Executes dropped EXE 1 IoCs

pid	Process
6344	Polyboard.exe

Loads dropped DLL 7 IoCs

pid	Process
4792	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
4792	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
4792	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
4792	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
6344	Polyboard.exe
6344	Polyboard.exe
6344	Polyboard.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6832	4792	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Polyboard.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Boole.Key	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Boole.Key\NoOpen	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Boole.Materials\DefaultIcon\ = "C:\\Windows\\SysWow64\\imageres.dll,-67"	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Polyboard.Library\ = "PolyBoard Library"	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-typ	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Cabinet.Document\shell\open\command	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Catalogue.Document\shell\printto\command	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-cab\ShellNew	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Project.Document\shell\printto\command\ = "\"C:\\Program Files (x86)\\Boole & Partners\\PolyBoard 8\\Polyboard.exe\" /pt \"%1\" \"%2\" \"%3\" \"%4\""	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mat-boole	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-typ\ = "PolyBoard.PanelTypes"	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.PanelTypes	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Project.Document\ = "PolyBoard Project"	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Catalogue.Document\shell\print\command\ = "\"C:\\Program Files (x86)\\Boole & Partners\\PolyBoard 8\\Polyboard.exe\" /p \"%1\""	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.PanelTypes\ = "Panel Type"	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.PanelTypes\NoOpen	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-param\ = "PolyBoard.Backup"	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Export\DefaultIcon\ = "%SystemRoot%\\SysWow64\\imageres.dll,-69"	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Cabinet.Document\shell\print\command\ = "\"C:\\Program Files (x86)\\Boole & Partners\\PolyBoard 8\\Polyboard.exe\" /p \"%1\""	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Backup\ = "Backup File"	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-cab	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-lib\ = "Polyboard.Library"	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.PanelTypes\DefaultIcon\ = "C:\\Windows\\SysWow64\\imageres.dll,-67"	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Cabinet.Document\DefaultIcon\ = "\"C:\\Program Files (x86)\\Boole & Partners\\PolyBoard 8\\Polyboard.exe\",1"	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Project.Document\DefaultIcon\ = "\"C:\\Program Files (x86)\\Boole & Partners\\PolyBoard 8\\Polyboard.exe\",2"	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-proj	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Catalogue.Document	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Catalogue.Document\shell\open\command\ = "\"C:\\Program Files (x86)\\Boole & Partners\\PolyBoard 8\\Polyboard.exe\" \"%1\""	Polyboard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Boole.Key\EditFlags = "8"	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-lib	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-param	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Cabinet.Document\shell	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Project.Document\shell\printto\command	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Project.Document\shell\printto	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Catalogue.Document\shell	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Polyboard.Library\DefaultIcon\ = "C:\\Windows\\SysWow64\\imageres.dll,-67"	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Cabinet.Document\shell\print	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Cabinet.Document\shell\printto\command	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-cab\ShellNew\NullFile	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Project.Document\DefaultIcon	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Project.Document\shell	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pb-proj\ShellNew	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Catalogue.Document\DefaultIcon\ = "\"C:\\Program Files (x86)\\Boole & Partners\\PolyBoard 8\\Polyboard.exe\",3"	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Polyboard.Library	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Backup	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Backup\DefaultIcon	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Cabinet.Document	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Project.Document\shell\print	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Catalogue.Document\shell\print	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bo-key\ = "Boole.Key"	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Boole.Materials\ = "Materials Files"	Polyboard.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Boole.Materials\EditFlags = 08000000	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Boole.Materials\DefaultIcon	Polyboard.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Polyboard.Library\EditFlags = 08000000	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.PanelTypes\DefaultIcon	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Project.Document\shell\print\command	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Catalogue.Document\shell\print\command	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Boole.Key\DefaultIcon\ = "C:\\Windows\\SysWow64\\imageres.dll,-67"	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Boole.Materials	Polyboard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Polyboard.Library\NoOpen	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Export\DefaultIcon	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Cabinet.Document\DefaultIcon	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Cabinet.Document\shell\printto	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PolyBoard.Project.Document	Polyboard.exe

Modifies system certificate store 2 TTPs 9 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Polyboard.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Polyboard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6344	Polyboard.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	2260	vssvc.exe
Token: SeRestorePrivilege	2260	vssvc.exe
Token: SeAuditPrivilege	2260	vssvc.exe
Token: SeBackupPrivilege	4808	srtasks.exe
Token: SeRestorePrivilege	4808	srtasks.exe
Token: SeSecurityPrivilege	4808	srtasks.exe
Token: SeTakeOwnershipPrivilege	4808	srtasks.exe
Token: SeBackupPrivilege	4808	srtasks.exe
Token: SeRestorePrivilege	4808	srtasks.exe
Token: SeSecurityPrivilege	4808	srtasks.exe
Token: SeTakeOwnershipPrivilege	4808	srtasks.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6344	Polyboard.exe
6344	Polyboard.exe
6344	Polyboard.exe
6344	Polyboard.exe
6344	Polyboard.exe
6344	Polyboard.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 6344	4792	2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_83c1c36f5125cd3044e4030ef3b7724b_darkgate_elex_luca-stealer_magniber_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Polyboard.exe
  "C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Polyboard.exe" /Register /Background
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:6344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1852
  2⤵
  - Program crash
  PID:6832

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4792 -ip 4792
1⤵
PID:6812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PolyBoard.en.dll

Path C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Lang\PolyBoard.en.dll
Size 551KB
SHA256 378ac5baa3a9025bf3ee8bcd942308442376e227808204a065756d2f891a8f30
MD5 d3bef684a9cd4a7fef2a245ba37115cd
SHA1 812e0e4c7f06dc01e72729ac94a4d00514af1ca7
SHA512 8c9852280d22100caeb69e572c3c09523026ecc0b085feaa0b72a80c40b744c58d6757add139749fac24cbbeae5c84740e35ee32c8e0c560270a0c75bb34b5ee
SSDEEP 3072:8sPAXXoLT9Ks8J43MCQC2mx72EuQ+p9sPB+VMK0yKIarUv2ILyjJbrBWCy75wXuQ:NAXXuTss8yMN3gFrcBhT
TLSH
T121C4B790AFFC8508F4F62B70AE755AB41A37BD55BD34DA1F2240710EE932B409869F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Polyboard.exe

Path C:\Program Files (x86)\Boole & Partners\PolyBoard 8\Polyboard.exe
Size 30.6MB
SHA256 2f802bd43a910510865db99d1663dcf1fcdf04e7f9bd1c592a903bc546990f1e
MD5 5fb50f58e99f1d2a9887cbe246c150de
SHA1 3848d4bb54890b928a1f94c400e288fd5b06152d
SHA512 3aa85c0589b2b9745b77b828a5260350084a13505aa932a5a565398b2c4f33e83b28f8be58831a0b551978cc6581e9ca1a4a979951bf3f2ed45944513219e4c4
SSDEEP 393216:Hq7QKEBZYP22AyhIdUmna0gybnaz9I0LxK5whe0kCe4KBboBDycJSKw:HUcNdUmafg5wdCL42cJSV
TLSH
T108678D00F519C1EAD65021F06DFCBF6A537CAE542B6286C752C86E2D9C716C23E33E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bar.mat-boole

Path C:\ProgramData\Boole & Partners\OptiCoupe\Bar.mat-boole
Size 65B
SHA256 dc26569c63bbcfb19b1b8532bb0c8541b3a1a6eb814792b04330d2d786ae2c55
MD5 7fc8dbc615dff89457744e39e600b426
SHA1 201650658580d28d98be341502bd40c9af12038b
SHA512 f86fdd3483fdb0d2a8f92fa91533f85b07d7e3b2cf7f76e5c8d003846d4eaf7211b8c8b9da7a77b2c3c504c56264111aea119c40fdebdad0c16311c81fa8b92b
TLSH
T1EBA0220C003303F8C08080B080C0F30803800033022000FF8C00C0032023280E28008A
MD5 SHA1 SHA512 TLSH

Submit Download

Edge.mat-boole

Path C:\ProgramData\Boole & Partners\OptiCoupe\Edge.mat-boole
Size 291B
SHA256 dea4751a89c260e737d1a4da8cc678d6f618ddd89889bc7831d5404ab8fbbc2c
MD5 cc1cf0385a9a23d2fce677a968533ad1
SHA1 946ea551a08e39271245f427e2d07b4a33c87e62
SHA512 8e3636deea15e27527c1b2bfa0f4311ced51bf7e80a51579cb1b4da919c0c63c99d7c027726037f4f48d1d56b08a865500ccbb5ab84d8fce9ec955dd12a5c89e
TLSH
T1E7D0EB908922974EC8B79F3183077204E2C3965560C283D94E16870C5282EC84909029
MD5 SHA1 SHA512 TLSH

Submit Download

Panel.mat-boole

Path C:\ProgramData\Boole & Partners\OptiCoupe\Panel.mat-boole
Size 686B
SHA256 99dc254e8741a731b8fca5fbb4d45524b6bb694b5a7a2507b7f7800db046c44a
MD5 4e8dc7ae03f558694aa317a0457972ff
SHA1 33a2e7c3c48805d0262bd36df7f1d39018f3dfbb
SHA512 c0fde9a10382c1dc3c98c2fb313173b496ca3250886535a1b76796d7cb248aca4fa3c27e05f02b92f09b8a3a9e79c20f7e3e7516d62552c8e933d120751345ab
TLSH
T14C0188FDB0F37A251842B17291409991CDFF756157534297006F4FEE4D2A3409B1604B
MD5 SHA1 SHA512 TLSH

Submit Download

Accessories.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\Accessories.pb-lib
Size 1.2MB
SHA256 ab9c973a30b46440970d143551b55359a89aedcb6d18af3aa2c6bb468f5c4229
MD5 f89891f2b977c55a3de46ef62de4e1c5
SHA1 5b0c3d7000fd272868efa3e6331676b7f23d87a8
SHA512 ae31f857e161c8d6e0780266997b4031d76cdc2d2160505b5abb748485ecf9e0310b20fec92dd7445bdd09b65812955d0e1436671d6baa7404c12de04038157a
SSDEEP 12288:QTaGUXMsiy8MVB+ZtXr8o7DZmS7yiwtskTwWvUDYioEuHSC5Rw6y:dB+ZtXr8o7sS75wti
TLSH
T166550742F8804996F67442BC58746F8464169CAD3B34EFF78B91E32784FE2D0EDA1272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Curves.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\Curves.pb-lib
Size 2KB
SHA256 6bca746c440c36c7a21884ab2b0b7f8a5efe31e87444ad5752303dbcabf928ab
MD5 a5b6ecb561c92050c1c70d9ece1fa4c0
SHA1 7e414fb3054ca89282d402865008c9bafdd8cfae
SHA512 479ae20016e17a51dfbe27c98fa7f1b7368242491c7d6638dbef9ab955cefb853e087d17ae109fe3753b7cfa33dbb2a523610c9e6c4d0c4d1755b16c72b55af8
TLSH
T1C251AC6FC48836E5D5720FBD07551484F6BB2725AEE4267832BAB14F47AE3888C2D712
MD5 SHA1 SHA512 TLSH

Submit Download

FittingHardwares.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\FittingHardwares.pb-lib
Size 956KB
SHA256 67f87a40d96352f969f70eb3a78b0320f224be3bd923ab320c9c439b287a8df0
MD5 39f5bcd1b75790f63589ee786c089b6c
SHA1 586a602dca7184d95c1b9db842b5734a09e4d5ca
SHA512 58f18117359aec0775fea10d6879a6bc6f89eb569f6e4d307772c190bfec2814dce60ba3b518193a768ed86b04a5f6685575e5ab9f9715eb9c7afc81ce52da4f
SSDEEP 12288:IXr8o7DZmS7yiwt4TaGUXMsiyyMtw6TkTwWvUDYioEuHSC5S:IXr8o7sS75wtP
TLSH
T1FA25E642E8805896F2B442B858746FC565129CAD3B34DFF79B91E32784FE2D0FDA1272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FittingRules.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\FittingRules.pb-lib
Size 1KB
SHA256 1547c9f6c7b865db1486c22abd5a1dcb08495ed8c19af2a21548cf90ea1f9247
MD5 176525c5b89091ba141714ea995b7d18
SHA1 ef2cd7429c66a42d70863b038940e76d1bbdcdbd
SHA512 2cf40bec7a69893e57a489b79b6790bbe73a71d2902aa65100a4846bd35bc7a8691097e8a171c4cb2be45ed86b03cd108f90f2645793a2e0d9a2f79ce4fb079c
TLSH
T18D21024733B50880F9D0DE7B5AEE9A1B652FFCF17901DE4A1C94AB930D260551D1057B
MD5 SHA1 SHA512 TLSH

Submit Download

FittingSimples.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\FittingSimples.pb-lib
Size 94KB
SHA256 93ab0efad1a546fbd9d50b1a07fedc092dd97a4e117525bb27017122a20f3c29
MD5 f146904b1780844d6c56ff1ee25159b1
SHA1 16d62d9203b13c4e86a69e5aa32ad67a1d7cf8ac
SHA512 e3fb7c542fc04fa987fa2836d758411054638e4d33195c81e1d253958d65a802d3e0b44ca0ec04f4b2de243225c916eec489edde54d9b777de45111e87c6b290
SSDEEP 1536:v4jQP0qSRQgXo7cqGs4Oe5mTYWB8Cg0yKoyijJxV4/LY:vXP0qSKwqGhOe5mrB8CEyijJxV4/LY
TLSH
T18B931947E64A4FCBFF75C5B852249BB4A8232CFE4652717B4F18232746FE2204C259B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Labels.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\Labels.pb-lib
Size 57B
SHA256 e574f43cde2aaebe1c48cc2dc22597aa3992eb16786bb8c0c9e57caf3fc01ce2
MD5 9f516b0867c500a57cb2f168d41367bc
SHA1 a1b9c259fe4b2c34e2485f5ddc608f3d5bede472
SHA512 1aa9d4d9239fb198c1780c76d231f040466d67b13f41e49ba4985fa1569307ff42f59a68e57b13b97144725404f95afed603896a2a5f1f214a6b6ec5cb9d34eb
TLSH
T1C09002E0C6501C54C0B90CB12A374495151724911DE3E95594716E1181874149195710
MD5 SHA1 SHA512 TLSH

Submit Download

Methods.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\Methods.pb-lib
Size 19KB
SHA256 bbafc2a95f329d2e353367a5b272140e55b647b33c4d3e305f09543350fabd86
MD5 4c146d6e65e35f21518ed862ffa1b33a
SHA1 f046c8c9af32ec7a5bc692b8c36f830a8272be02
SHA512 05b9259078c8c3fd619c06101ed1c435b4b7e0ab6ad0eea51efd5aa3203fd6e69cfe58a18e0792b25895d830fcb670be69df374430dce450d8becafe4f25e421
SSDEEP 96:plbj+RfImkj4KelqnI4DexFXelKD/FPrfORzVepq0hK7kjO8DexF5FPH80YSiXq1:plbSRCgOKD/J6tVepqkEzJHdQM
TLSH
T1F4922207F7D1C543F4E81FB2896EE799B266B532E96283173DC4BF2F0E2A2441D11615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Quotes.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\Quotes.pb-lib
Size 57KB
SHA256 5cd0b6212a0b89469c27e01a139bbdceac40daa58966756527465b605d220f68
MD5 07c2e96bb40fe6bc35a13f41359f8854
SHA1 70a16099eb2dccd0f03ae109ba3bdafc0227ddd0
SHA512 9a68b5c2e5be57861c5a99e46937e6194a5e543c4ca367de5a441d258a19eb5c6aae30e97d9f5782929beccf3894aec8a65eb4aff36a7a75b8722e4ef7af18d3
SSDEEP 768:yPV/9FkfeshGKi5qaz6Y5rzr2tQ/ijKqhGKi5qaz6YKrzr29Hh:A/1ssr9KLsyO
TLSH
T1B7430315A7E9461AF6F37B3169BA0B046F36BC96DE36C21F0254016C0DB6F588D28B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ranges.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\Ranges.pb-lib
Size 67B
SHA256 123e0aedf809613fe49e8c427e0e9fc53b63783ba8a27adbf9ac8fd06eb9c963
MD5 c98e2edab677d7af306e8a98ff1204b1
SHA1 38e5883be01d91cc06971034cf2c9e7db55d9ed0
SHA512 8fc60254963fb99a98118086450e51f28661968ff8247b8d457c6e7460fe1424b9d910adb4aea44dbe7238ddb247218301feea05630a8cefbfe33b2b2dbfd185
TLSH
T15FA00240E655684CEDFA5DB61521EA0489676844CF99D9643AA09D5541C60024400717
MD5 SHA1 SHA512 TLSH

Submit Download

Shapes.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\Shapes.pb-lib
Size 4KB
SHA256 7771402bbc01de0646a25fe6f332a50f9a90532dd2e891b2438e1965db78c239
MD5 efce28e82448b6dfcd9c9d6bfc00ee6a
SHA1 56d6da35de51e2acbe837f889288774339e5b774
SHA512 bb883c2f4baafd0cf14c9df9b3e54b34b207f8d077129724724247668cf2b44c6a294e8f1aa14bf24e0c79766dc6b9f45042764da776e74e65a05dafce9e6685
SSDEEP 96:zLFbBY15sMQ6Alo1xhEFONRbuJtZwDfB:VlixQ6xhEFkRbVDJ
TLSH
T1E891F7870CD885CFD1B4AAFA0B9C6B9973BF453B4E44645586EC2A8458F0353FC43B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Structures.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\Structures.pb-lib
Size 5KB
SHA256 87fcd1b3391461fbce58f48d8f3eae764a514cdf001ca5f94df785aa9c77f73f
MD5 dc800b808f9085afc220f34366ea2b18
SHA1 a8feb1eb79945085966fbb0b5fc2c3589d8df41e
SHA512 5daeb94a2ea6b391a4a70c5ef0180068075fed5d292b53701457e0eec7471dcf0636d90cd2633ecb55962ffe45bc3b30301e57777f88855048831a939959fca8
SSDEEP 96:U+adZaJZP+I+nZoZgZP2mZaJZP+I+nZQZMfGZzjT:U+adZaJZGlnZoZgZumZaJZGlnZQZmGZL
TLSH
T164C1C215F3C143ABF4A24FB2C5706A71B216B8B6CE31D73F2F98C747259E9018D46A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubMethodAssembling.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\SubMethodAssembling.pb-lib
Size 1011B
SHA256 3b6d9fc5d03762c951e9c0b5afbaff5ea34a9970887f254a9c097f5756a7aeaf
MD5 488d6f0bf57a27f8790657d64257389e
SHA1 f001f669884bccb4d383947316520b4ac1888d81
SHA512 53a192233c496b2d3913eea5aba80b7122d51fa6c279ee57cfbbb9387e3a01ea5cc9d1a0b151affeed43bdd2f15fe501a4900fef44943dfa2c26a169ac60d03e
TLSH
T12C118B0BF5868657E0A42E779A71F8A5F4EB7622D832133A3DD58F1B008DC494C46706
MD5 SHA1 SHA512 TLSH

Submit Download

SubMethodChant.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\SubMethodChant.pb-lib
Size 3KB
SHA256 5ac2d992f057758efdb622ddaf853c2c6fbc090f15eaf0e4c5ba577d512df66b
MD5 a10eefa15694749de0990b992fbcadb5
SHA1 47dd5c4c2271677b905be2455d529e2aedf66716
SHA512 d05849697a88f6ef3e268ccbc8e1cec3805ce5be189412e16f47b9379c7f959acb46597c5a22525ea7a8135867cc96e2624f5b51b31d4ede720961f8ebf221f1
TLSH
T1D7713305BB82C503E4F40FB5049FDBDC7522B9B2EE92471F7A813F1F66152905E6A52C
MD5 SHA1 SHA512 TLSH

Submit Download

SubMethodCorps.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\SubMethodCorps.pb-lib
Size 2KB
SHA256 092b11778f97ea99008924f836cdb88d45d8a4d258cb5b1bcfe5e1c123ec7d64
MD5 29afbdfda90e96fe4f49d27069a9313d
SHA1 a546ac0b324af4642835dab09d0886dc5b4f43d3
SHA512 e9dc7d46921fdf88de70a75d02cbd0dc530258497ba78c38c031ebfad7265bcbc6a89c5659e4642194e8d84132943e42adf07ee951840589632043b110c8ed4c
TLSH
T122511340FB92D893E4EC07794C6DE384B7A5B985EE62870775CA3B2F9E1A1807D80159
MD5 SHA1 SHA512 TLSH

Submit Download

SubMethodFitting.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\SubMethodFitting.pb-lib
Size 9KB
SHA256 0f3c0ae29d21e9ed182c353863eb852898d9de400f08daa829e0adcb4c5ec9e9
MD5 4360544c3b76c57d2e5c93c14f4a7ace
SHA1 50884f7fb3ed8755cd545ca307e528ebed362f13
SHA512 1cf397eec6a33d2d3a2dce878c490f3973aa7f1575bec05829a0c0be22dd4079950c8575691de1a1b8a53609ea7cd4d7a2fd472bec6aa5613fafc0219cf86ddd
SSDEEP 96:qHULLMLKKelRh7UpKF16XelKRr2p5crKPlMPZ+IMpK97UpKF16x2p5cTnIK9uKFN:qpPUXKRrXSMZs9UkXTnIVUk
TLSH
T14622DF0233A5C442F5995EB35EABC3A6936AB825FE10C71B78D4AF5F6D372560E00712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubMethodMateriau.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\SubMethodMateriau.pb-lib
Size 1KB
SHA256 2a16378afc5a36d865d0bcca54065b6e89b69717e810d1c5f67fa706e7fc5bd1
MD5 1d7bc6e5d608fae528390f1d2fc3c848
SHA1 8ed415c74b96d5dd72e2366b8a60bbba880b93ba
SHA512 98618a14861654f19ba5df981c808f96e6dde3a6407d8eb942a47aa506dc2e96cff69138c3ce49cbe085bfb9731f10819ef7e9a4eb83a806be2bfa94b7ce52b2
TLSH
T174312343FB90C217F8D98E728D6AE761BA237430C837830F3EC48B0F51576142D1A519
MD5 SHA1 SHA512 TLSH

Submit Download

SubMethodPorte.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\SubMethodPorte.pb-lib
Size 564B
SHA256 0ac88b330572e9ddaac8e68a55f24ddcc525258a1d3e4807f0ea384ce717f94a
MD5 92df7fef35c81c3d7b42a9e97a9f4a1d
SHA1 cec43dc5b096fa0827787e26f07b4e3310bd1be0
SHA512 9a4a118c0fe1cd9ef04a2448b777826f944d95a3e11999738eccea9d0f0458de41e48c60312e1b91795697d33043b7811a500cc5a4ea76cfae154a9cd01fa3bc
TLSH
T19BF05B13D7A9054EC4751E71A17BD7703537B5B76359491F2C950E1B0F551400C017E5
MD5 SHA1 SHA512 TLSH

Submit Download

SubMethodRegularDrilling.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\SubMethodRegularDrilling.pb-lib
Size 307B
SHA256 877fd4f25793a4950d615d529415c2bacd1a5bf3437895a48619901c40f897a4
MD5 cbeb7dada43492cdf72bedfede204aea
SHA1 f580292aca395acd2cb1e0e78cafad26a4874715
SHA512 14f2487a275faad020356ea3ea42a3381ba91ed0246a51b06a7a3fbe23c385aa234768b6a55735087addabc91324a17140c43927a865c43bc37a69495a0baf92
TLSH
T119E0125663E448D1E8E65F711AD6D164962BB4356A82C68F7DD05D159D030D59C10310
MD5 SHA1 SHA512 TLSH

Submit Download

SubMethodSeparateur.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\SubMethodSeparateur.pb-lib
Size 1KB
SHA256 930dad51fef865c123f58fb2675f611315ea2fb6f58709b1f0c9c230db97a41a
MD5 7b4299d3d8a922f6565c9103504c66c5
SHA1 8b8cda5e9620180038b61b54a12afc8ac10d9475
SHA512 f69bdf9440fd1053229d5718deb7345891cec8b71b0dd9074680e759a02b66f766ff3b2c85758330e557cb6e83aa138a59f883284ab388983d7d6b4311408bd7
TLSH
T124211400F790D483E8F40B758499E3D0BBB5BC559E23830B75922F2F2EAA7409C1254A
MD5 SHA1 SHA512 TLSH

Submit Download

SubMethodSurcote.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\SubMethodSurcote.pb-lib
Size 314B
SHA256 df25fe537141696e3c3a0c2dbbd6ea2e5e7ab2b93ce25860f8bb82cc7fe1b235
MD5 5661df42f0f0189a7762fa87f26d3151
SHA1 ef21139b23b0b6dd15b936ff6bd88aa75dff9115
SHA512 15c8617d2859e58f991be50d52327bd680dadb4b3f72cfd11ccd53953d87c5dd3e529b8ad551b6d09d12a42f684e5bc2721dc326b30105556d3f8ca515e51306
TLSH
T1E6E023C88BF80152F7E44F76916549189D2776177594834D0D920F4540F35545D41317
MD5 SHA1 SHA512 TLSH

Submit Download

SubMethodTiroir.pb-lib

Path C:\ProgramData\Boole & Partners\PolyBoard 8\SubMethodTiroir.pb-lib
Size 2KB
SHA256 aca4c23a0dbe15b385847ef2df69f2ed7b2ef2e70f408d6ef55ec3d9c0609236
MD5 4e0a7571a4c546665508e88bbbda0c29
SHA1 089c54d52fb91e4cb2f9ed8513bf14dffb732aca
SHA512 a5fee7565810b2d6f884222af4dd557bab3f18f6fa94251d14e81c739a74b78c1bcee1f827382d073aa474c59ccd0cc5999c4d1db1e36f167d7107cb17735d40
TLSH
T1CB418603F7C2D85BD4A8167A599BE7E57673B0768F52CB073CC61F2F1E162801C61A94
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Size 1KB
SHA256 bd1bee9357f42720d4e45873494c816bbf3252e6b561d517b4db9e5d173955d6
MD5 4135b4d24296afe73d329ea921ee4d42
SHA1 d263862cf750c4352249949489ef1a3eee731259
SHA512 df1bd97824a0e225801bb3729218e89201afa69d68d1b59cdf843efecb2a40def9ce4a60610d127b85ae02bcf7d0ccf293b1c38b34c2754844a42dddcdf5e1f7
TLSH
T11B31DA2A8A7C3543ED60EDD45DD6F137FC94AB9058DA3041AD15851720907B33F55D8E
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_26648875735022F64E0DDBCEB7B46509

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_26648875735022F64E0DDBCEB7B46509
Size 1KB
SHA256 4caed1c8f4c2a24578afce0a2e89ecad524872669aeb8c46f20263e48dca13d5
MD5 658480e65b1695c3736b1aa9a810ecad
SHA1 b4840f745b609b54dace4934e0b6bf05b7f2365f
SHA512 8650ea420a9dd19722c9c01b53e96df43d6987424a0ef1e89d47cab255457c5108c7f7927f8d53d6890febd28eb9e2199bce49ade546a4df348515b3950c60f0
TLSH
T1FC31F80F013936037B46AF5186DA94237CE017E485F56C2E7A7E542C99303F14F69B44
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 1KB
SHA256 57b3c18df3caa756c76e475562bd102d2bfc29c0bb271f770fbae5c6173ef92a
MD5 64b7f519a6fbb269fce7e5e0ebe0413b
SHA1 8a3412e0a5e03a1952269d62654c003c7a0b1e23
SHA512 0bd36b6e3bfa527c7c6b0305ae7686de9b88696b2579ba13e7ee9110e91e580c191dc008c864d9130b9013c9d76f8b6316005582b15de5afbb35777c2534d55b
TLSH
T1E321B947E6AD0D822F2A8E840EDDE6B27C97D6D964CC044DE247D175A4013967F5103C
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Size 532B
SHA256 3328a376479e9f82d6e7bc4eeb1134deea53a0e1873256cc99ac33fa80f0b458
MD5 db06516d7d400806ff99faaaee2f0416
SHA1 7a509d6718a79a1bd7d1371a483cb99f2e38b655
SHA512 2819383006e5f68470dda52a82dbaef38106175960894d44419bb9bba431b76b176fdb94811f4066c19f9e9dd353cf8d7f88a1fe6d72ad21c88221591d800283
TLSH
T102F0972809F8013FF471EE389AE0E555DA25F96328169BB81B85075D8A28D108C23C3E
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_26648875735022F64E0DDBCEB7B46509

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_26648875735022F64E0DDBCEB7B46509
Size 540B
SHA256 b0097290d5bec2b2b5363748cea7f6fd301f1d0f85598f2f0f80e1707e47549a
MD5 bc56c3253662273415791e7290a49b46
SHA1 9aec663f9962be89719378756ef65566a2527d30
SHA512 c41ba133c89c16bc4d883777701c70e6b90c730909d0b350046c112ad4bd269f1d93d1bf957d30ebe0100a60199b11b8093bdf71a6d1e4a35babc065e4d46b91
TLSH
T175F09E0804B9011FF53ADDB982C470A34A75F80B3C0599A80EA1430DAC15E007C21A35
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 508B
SHA256 ba02a1f87d7df166128644c4aaf078eb2f85721380e5e33a28ec3f855036b1fc
MD5 9b79afda8a573e613cba2391b391a6f9
SHA1 7366630151acfc3c3da68746afa174fe80f30a46
SHA512 1b3a2a7d386468d361ba79a502210bb73833cf6f12b21ffc16bdb0ab5d2eda5889ec960e73ad1bbae574f89308fe0e662a2a7e972b6dbe07735c05ae9473e558
TLSH
T1FDF0271864F8A01DF272DF38A5D469F79A1FB60B241606B92AE543185A25E136C0263D
MD5 SHA1 SHA512 TLSH

Submit Download

Jun2010_D3DCompiler_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\BOOLE_~1\Jun2010_D3DCompiler_43_x86.cab
Size 909KB
SHA256 417eebd5b19f45c67c94c2d2ba8b774c0fc6d958b896d7b1ac12cf5a0ea06e0e
MD5 f7f554aa613eccf065575b8c69717ef7
SHA1 8417886d47c19cf6892f4080ddd5aaa1a49db3e9
SHA512 618f6dbb5bd9d44a8f10d119f5ef644f168fe3d8db986994e8cce31d1f11ff9ac872b389d1f218a82ff8b397bface587f97ca21e8f77433dbadb2ac475e9e6c1
SSDEEP 24576:dOWjUzqd7URYQio4yGDUATxoWDYicd3qRbmXHphTheUB:dtx6RYQiL1DUA7EicSbUJhI0
TLSH
T1B41533B48FE9413741A6F8481B96BBC0C11DC9E574F22DD5367FF2860846B94E32E99C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jun2010_d3dx9_43_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\BOOLE_~1\Jun2010_d3dx9_43_x86.cab
Size 750KB
SHA256 fcc6cf0966b4853d6fa3d32ab299cde5a9824feaecb0d4f34ea452fb9fd1c867
MD5 7749862c307e527366b6868326db8198
SHA1 bce9f21cdb1e101c7223c9e62eca61ec22d6bb81
SHA512 b65a84535b749ade0f8ea1a8ab6239df8e82ad59cbdb07487fdbfcfcf57a565f493f56378e216859a081d23ddf7c671636f53ef821289d66452f09218080f02b
SSDEEP 12288:w0b5pTUIVIRxV+yb+HJFnXQRGr85UpzQ3VztxmHN8DMFy0BJ1lSIug3SqHAlzJYu:Z51NVO+XVLs3VztQHmYjBJb931I1NYIZ
TLSH
T10AF423432AA5348E8C523043E3669A2724B83557CEBDE77562A44B2D0CFD76F113ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdllreg_x86.cab

Path C:\Users\Admin\AppData\Local\Temp\BOOLE_~1\dxdllreg_x86.cab
Size 41KB
SHA256 8ad77a4d9c76f65cd62337588f847cc1e0ca6ca9735937f3a781f7395e9566a1
MD5 a025c67403dc2c2bcd709aa9435faeb1
SHA1 0433ee289e96a0d83a0c66ec35cf906a3e063884
SHA512 56bced81de59d413238b01396fafa6442ef6db0afaf237a699966df4753ed1a0b555450fa308f6965689a67f9fb5efb5d377d5f602a8d453ecceddca41072b45
SSDEEP 768:iEsyaJmSW1YcVQ4iEX5EicqzKlrla3TsgsuRwjbW+O1xIhMbDbw/n+Mi2jXHUp7J:RjaJmSW1Ycl5X5EqKlR8sgsuRwjbtOwk
TLSH
T1A113E0C5087C81A7DD6A5DA126EFFF373D309AEB0115E7A8124FF36501857E20A6AC2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.cab

Path C:\Users\Admin\AppData\Local\Temp\BOOLE_~1\dxupdate.cab
Size 91KB
SHA256 13393a91201e69e70a9f68d21428453fff3951535dec88f879270269cfe54d6f
MD5 8adf5a3c4bd187052bfa92b34220f4e7
SHA1 b52be74c4489159bd343d3c647f28da1fd13d9b9
SHA512 3e2f2fe4b5742a4cf6ee2f6b8c0ca734fd0b3c5431dff112c907231846dd3eebee7b9b8117f0256119614282cc7a4896474a199563078481d48a1204ca96f92d
SSDEEP 1536:6chonoSUr43zmBkraJ8jchLdjH0UyrJ/7BmHA1N2mmoQwjn4mHuWr50woo/lKB9Z:6UonoMaWEd7y1Ds4N2XoNb4mOWr5xn4J
TLSH
T1A19302F7282D660389366AB49330E850BCBDC4536909AD1E097FFB600AC67D25D5B8DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXFD28.tmp\D3DCompiler_43.dll
Size 2.0MB
SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
MD5 1c9b45e87528b8bb8cfa884ea0099a85
SHA1 98be17e1d324790a5b206e1ea1cc4e64fbe21240
SHA512 b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
SSDEEP 49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
TLSH
T1FBA59E11E705D0B2CCCB00B16A5DB7A6647C9F30432096C7B2947EA95D72AF35F3AB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JUN2010_D3DCompiler_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXFD28.tmp\JUN2010_D3DCompiler_43_x86.inf
Size 1KB
SHA256 5dd568919e1b3cbcb23ab21d0f2d6c1a065070848aba5d2a896da39e55c6cbbf
MD5 1a86443fc4e07e0945904da7efe2149d
SHA1 37a6627dbf3b43aca104eb55f9f37e14947838ce
SHA512 c9faa6bb9485b1a0f8356df42c1efe1711a77efa566eee3eb0c8031ece10ffa045d35adb63e5e8b2f79f26bf3596c54c0bd23fea1642faae11baf2e97b73cf5e
TLSH
T1883114ED8916943077D5B2B2BF8F264F67674406ED65214CBBC908A4EBB3701126D1FC
MD5 SHA1 SHA512 TLSH

Submit Download

JUN2010_d3dx9_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXFD28.tmp\JUN2010_d3dx9_43_x86.inf
Size 1KB
SHA256 6b33d32da02f664092d44b05237990f825b4062c105a063badcf978648b5e95b
MD5 a11deb327119b65bacce49735edc4605
SHA1 0be2d7fa6254b138aa53d9146cda8fedbba93764
SHA512 b0134a3d6f2d576e5fafb601014ab66fef91d661013acc8a7a9129940369a1d9ed5c0f228bb1666a4e891f09b4b18e83f0cb2080047aa84fa45ab663e5739a31
TLSH
T1A73146DD8C02E4307B94B6B27B9F364F2727450BEA61314D77C90990ABB3341115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

d3dx9_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DXFD28.tmp\d3dx9_43.dll
Size 1.9MB
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdllreg_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXFD28.tmp\dxdllreg_x86.inf
Size 724B
SHA256 54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40
MD5 8272579b6d88f2ee435aeea19ec7603d
SHA1 6d141721b4b3a50612b4068670d9d10c1a08b4ac
SHA512 9f1311803db1607e079b037f49d8643daa43b59ce6eafb173b18d5a40239a5515091c92b244ffe9cfef2da20530fb15deb6cf5937633b434c3262e765d5a3b21
TLSH
T15A014094CC039474B689F1B2B76B774F3AEB0917E9112308B3CD04499F6361021AD1BD
MD5 SHA1 SHA512 TLSH

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\DXFD28.tmp\dxupdate.dll
Size 168KB
SHA256 6dcad858cc3ff78d58c1dae5e93caf7d8bacb4f2fcf9e71bccb250bf32c7f564
MD5 94202f25810812f72953938552255fb8
SHA1 c1e88f196935d8affc1783ccf8b8954d7f2bfb62
SHA512 65b66d07ef68e0d1e79f236a4800c857e991ee3ff80ece4cfdd0b5f6083ea16f8a52d351c3af721cb05c06394ec91b4b5e3cfa4b0f0879f7549f3e3ed035e79e
SSDEEP 3072:By6LKSOwGi/9S7BLfsdg3/Vhxo4yYbfBu20jPzwRFvxdGF4EdRDWXGTHzh/KV8ce:4wGaI5W4/Vhxo4BJV0jLwTGF4IDdPEe
TLSH
T148F36A15B740E472D5D20178711C26235AFDA8B117B980CBE74B2BCAE9E53C0E67E36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.inf

Path C:\Users\Admin\AppData\Local\Temp\DXFD28.tmp\dxupdate.inf
Size 12KB
SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
MD5 e6a74342f328afa559d5b0544e113571
SHA1 a08b053dfd061391942d359c70f9dd406a968b7d
SHA512 1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad
SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
TLSH
T121429976B5168259F40EB3A016AF3EC95E3B008FB53164CD79EF11B0572E1ACA2FE464
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSETUP.dll

Path C:\Users\Admin\AppData\Local\Temp\boole_{11359693-6587-4c1e-b00e-e6733f1d34e0}\DSETUP.dll
Size 87KB
SHA256 def6f245762be36cf18b435ba8b7ebc224b9c21d1a1db606a8e8fafdaa97bba0
MD5 9e0711bed229b60a853bcc5d10deaafc
SHA1 2bea53988bd35c5df5c9edcef0bc234c37289477
SHA512 c0b31872e52c8f4270d991c70d1a1c9ef9a4bbee4807c54c05a449cd1607506ab16ff1e74b378651b36e3276322c86cd843565c8a1aa33a49c47322ef4df0185
SSDEEP 1536:OtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCH:OtAvG5mOEll4Roi2pVVFKJuTVtXVpS9a
TLSH
T1CE937E2176A0C176D4D7207875ACA37216BEB5B10BB880CBBB4617E9DC713C1BE3931A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup32.dll

Path C:\Users\Admin\AppData\Local\Temp\boole_{11359693-6587-4c1e-b00e-e6733f1d34e0}\dsetup32.dll
Size 1.7MB
SHA256 642d9e7db6d4fc15129f011dce2ea087bf7f7fb015aececf82bf84ff6634a6fb
MD5 0f58ccd58a29827b5d406874360e4c08
SHA1 ba804292580be6186774e7f92e6dfb104e46bf25
SHA512 3e3d4f2de5dc5addc86765a2f888487ea0c9ee0208fac60187ddaa9a2bfd73cfd7734836d32805fa43222470c8f6cb9a10e2a099aef72c67ad7c789096e57ce4
SSDEEP 49152:MjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWq:YIjma
TLSH
T145859E31B1D40332EA7203B177118AB7F63EEB9DE119D565B9AE825920C2B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserImages.bmp

Path C:\Users\Admin\AppData\Roaming\Boole & Partners\PolyBoard 8\UserImages.bmp
Size 24KB
SHA256 d68da2425eb1c1ea255ff91eb97939708d8de74b0da017b984d5c8401c2b9128
MD5 33fad6d21b6f35aa71df50d45ec88e9e
SHA1 3f605f87ff5067de3a64be37cfdd4577eaac25b6
SHA512 e4560589d05278749919a97bc94d7f40d6dfcc1711e51ab32fb735c0ad1e3ae67358353e30c901d115f7fc5b9e95846dccf223afd61e6aed023c56bd5a30a32b
SSDEEP 384:PyT21F2kf3B9cFaOoTUu9aMiVy1PctMkfbncWwm95W/muNYTm+4YQB2GJYsi4KI:PyT21FP3J79arM+B15W+uNE1aBdZB
TLSH
T190B2AEC93E4D09DEA9263C10BE495B09265ABD81B2F55B700B3BB145F335BFF5299402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 375B
SHA256 93b789d1d641497ef1103e4ca12596bb39d948118bdd1321823887430bfa4a1a
MD5 fe4bee102eae17f4dbd55a1321636306
SHA1 387375af65ef97ebeeafa5835e3a0af5982e7d41
SHA512 215de11abe99051f8b17e7899a2fc9eeaed0c4e61af5f3ff7f02f19737e4d4dbf34bb7c1d7e737a463d38795a4a5723368d9f45eeda9a7e41bc59753fe10167e
TLSH
T18BE0D8F66DFF30C00608191A9F4768828D5D71221FAC807E75A047BC100933F8E24E16
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 24KB
SHA256 fb7fef3832cd4d119f752decd23af51ee025a3d4186297ffbbcd3143898362c3
MD5 68bd45612315d8cf16a341f8f7283cb3
SHA1 6abe242cc57188ab2ca391ae1bd7c0280b1b4b8c
SHA512 1b712fcf29986ddb2276dccc850216edad53087b42c7a3548645950b66746970991f09873d98ca42588d69ef1da561aeff7556f9ef347046ad01f590e4f2bce2
SSDEEP 96:NfeVYo2y3NiYLYgYMAVwLOC6BxareOYDZOYvZOJZO1ZOaZOnZOgZO9ZO+ZObZOEn:WV5ESBgLFoP
TLSH
T1A8B282BC6D35DCF1F810560A4B456CC1648BF2638D6D0378D2DE86E8EA087671C9EEAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 26KB
SHA256 82154a87df99a0d562555a5de71bda671ef912c4d5f9a54114b7430c79cbd85c
MD5 ebbde396518e022ab5b3a1a7570b9b81
SHA1 c7888f4312d63fe2c6ff4d66431574e849f24ae9
SHA512 cf5541be0d663cc16bb264a7d7d3cfaaa446ec4e96c5ff5ac4485027f021cbdf36ec1a20c31607e41f1523bc4752d64c39dde9bb7e477ba53d01e5c792be0486
SSDEEP 96:NfeVYo2y3NiYLYgYMAVwLOC6BxareOYDZOYvZOJZO1ZOaZOnZOgZO9ZO+ZObZOEy:WV5ESBgLFoV2Y/HSP
TLSH
T116C283BC6D35DCF1F810560A4B456CC1648BF2638D6D0378D2DE86E8EA087671C9EEAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6344-1218-0x0000000000650000-0x000000000252F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads