Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
- Size 3.3MB
- Sample260809-t6thksvvfs
- SHA256 721675517195f55dad19f004641d9057b9250692095b3bde109d5fbb071ace84
- MD5 66b69b9de6a102618a7ec4898eb400c4
- SHA1 ee7d2317f13007133355005ae06457d4c6a5a473
- SHA512 652add256dbe722f74ec8236619911fbe9aeb43063b48b9f19b1ae50963137d0e726e934701a26c3f9103717dd69f5b31e100dd3f9fb2562e215972856f4db39
- SSDEEP 49152:0ZHATAK7IjnDreNwL934vsDEuJUNliAceq58uCiqHUzj23P2URJdd5dU:0ZgTWDreQDEuJU9mGjiyRJ9a
- TLSH T19CF5AF217701C4B6D95202B0ADBDEA5F816DBD218F7414C7B3D83F6E55B19C22B32A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4732 alg.exe 4492 GameInputSvc.exe 6140 GameInputSvc.exe 4324 elevation_service.exe 6080 elevation_service.exe 4360 maintenanceservice.exe 4068 msdtc.exe 2940 OSE.EXE 4556 PerceptionSimulationService.exe 1764 perfhost.exe 6084 ReFsDedupSvc.exe 4112 locator.exe 4396 SensorDataService.exe 1408 snmptrap.exe 2356 ssh-agent.exe 3732 TieringEngineService.exe 4276 AgentService.exe 3432 vds.exe 3604 vssvc.exe 2652 wbengine.exe 3500 WmiApSrv.exe 4884 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe - Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe alg.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\fdcefa488f8562d1.bin alg.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed5203ea1d28dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce77efe81d28dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd8fcae81d28dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 6140 GameInputSvc.exe 6140 GameInputSvc.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeShutdownPrivilege 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Token: SeTakeOwnershipPrivilege 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Token: SeTcbPrivilege 4492 GameInputSvc.exe Token: SeBackupPrivilege 6084 ReFsDedupSvc.exe Token: SeRestorePrivilege 6084 ReFsDedupSvc.exe Token: SeBackupPrivilege 6084 ReFsDedupSvc.exe Token: SeRestorePrivilege 6084 ReFsDedupSvc.exe Token: SeBackupPrivilege 6084 ReFsDedupSvc.exe Token: SeRestorePrivilege 6084 ReFsDedupSvc.exe Token: SeBackupPrivilege 6084 ReFsDedupSvc.exe Token: SeRestorePrivilege 6084 ReFsDedupSvc.exe Token: SeBackupPrivilege 6084 ReFsDedupSvc.exe Token: SeRestorePrivilege 6084 ReFsDedupSvc.exe Token: SeRestorePrivilege 3732 TieringEngineService.exe Token: SeManageVolumePrivilege 3732 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4276 AgentService.exe Token: SeBackupPrivilege 3604 vssvc.exe Token: SeRestorePrivilege 3604 vssvc.exe Token: SeAuditPrivilege 3604 vssvc.exe Token: SeBackupPrivilege 2652 wbengine.exe Token: SeRestorePrivilege 2652 wbengine.exe Token: SeSecurityPrivilege 2652 wbengine.exe Token: 33 4884 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4884 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4884 SearchIndexer.exe Token: SeDebugPrivilege 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Token: SeDebugPrivilege 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Token: SeDebugPrivilege 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Token: SeDebugPrivilege 2944 2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4492 wrote to memory of 6140 4492 GameInputSvc.exe 90 PID 4884 wrote to memory of 1812 4884 SearchIndexer.exe 111 PID 4884 wrote to memory of 2564 4884 SearchIndexer.exe 113 PID 4884 wrote to memory of 1444 4884 SearchIndexer.exe 114 PID 4884 wrote to memory of 5632 4884 SearchIndexer.exe 115 PID 4884 wrote to memory of 2480 4884 SearchIndexer.exe 118 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_66b69b9de6a102618a7ec4898eb400c4_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4732
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6140
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4324
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:6080
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4360
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4068
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2940
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4556
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1764
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6084
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4112
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4396
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1408
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2356
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4276
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3432
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3500
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1812
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2564
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3032 3028 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1444
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3004 3016 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5632
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:2480
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 b173be967abe8f0056fa605e4043864deec1c1e547cccd3eae34a00c48669386
- MD5 bd5d504e7f28fe422e045e3d13736f9a
- SHA1 9ec6e88fe9abe187a2fe7146d345c9c8b3f097aa
- SHA512 bfd8ca5f4a96009c543bca2f2318e2be99c8b6af133d5cf4d9c2dc1eb8df560b4a8d8cb032e42825c0abdf41a02ae37feae6f5bafe5ee72ec0142630c316efc8
- SSDEEP 49152:tHS632BuPkFKRrdE6oh7stBhuXjfS4LWxnpRJdd5dU:T3q6gjBERJ9a
- TLSH T102D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 849KB
- SHA256 d6c4186bd451440edb933637c8369b7832796b8184111e5cfc2ce00372c1f5b4
- MD5 855563983076bf881a8ead3bee7f9855
- SHA1 690ed0c6b1df488a4b6a3ec7c6f148f0ad744cdc
- SHA512 e7625d316d549cddeee7df044c22c10d884df25feff2def0fd0c44e86b939e2eb705e93da7d6e836e704e37453d4c3dec425f6bbcadfdab733a7781e348917b8
- SSDEEP 12288:Z1XLsdmp0xpfWRI+czAwmn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3J:3XYcQcczAL4cJa/0jHcMC8Y45dXkcj
- TLSH T177050228B3E508F9EDA7827CCDB58501EA337C5107A0E79B03E496695F237889D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 4451f10c5f81347bf49081af81f3cf1d51ece3cf2570e7106bb75467a26e7106
- MD5 9ca5c47d140e35bae47c1cf895400e85
- SHA1 5bd17e90f2c95b4537ac05b336bbf8dd99d5b5e9
- SHA512 e177abba7b13c919d459f107babc2967a9a8c43d2d00af579662a906d3673db6c549ec8f3c3ce013ac1107d38969c8647694776d644fbff0c8f20e60c2d8c005
- SSDEEP 24576:k0Dexp205DxJrML4cJa/0jHcMC8Y45dXkcj:kXp20R7oRJdd5dU
- TLSH T1D6459E56F6748735D073C0B9C5D2A68AED7130821B308ACB4286D77C7E67AE6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 3842b50a4de7afe4a81517addcdd80bee00d2345d9bcbc5b5488c1cb90767513
- MD5 a4a25675cac406b5b2225ce23a4727d3
- SHA1 da51d96d50f5eb1b48668c7635bc42f78ebc2c46
- SHA512 202fab338e249111aab8aa21f1ae05a4df975b40deb29a066786d46cbf2128fcbd1fa33878592c1510cc9cd1b5f8994feb5e7de15c997cda1569a59f8cede84e
- SSDEEP 24576:GyEmezSC6vMyDUtqgrvW/6q8wyuo4cJa/0jHcMC8Y45dXkcj:KmezSC6vM5PvuHjytRJdd5dU
- TLSH T1E7756C15F5788323D0B2D0BAC5D6BA9AFE7230464B3089DB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.3MB
- SHA256 980fc64b87dfd3241916124dd9ae43c0b729b5c48e0a8c5872fa210df25171dc
- MD5 b6f70ffabc7c8b9465077585f95e4201
- SHA1 9a6672a725b0db1cab18e9ab53949eda3a6dc294
- SHA512 cc3aa5e695e9b98095fcff4340357d68ef4b9604a07fb4819cfa14d1eb20719e868392661ee68dbb5f6744c9d4caed299b6d8995ef5843e9783dcab5eadad37d
- SSDEEP 24576:/AbmP4O8lYaNa224cJa/0jHcMC8Y45dXkcj:/AJO8lNNaXRJdd5dU
- TLSH T12B559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C2E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 603KB
- SHA256 ec403420e9a5ed20d404a500687f24ebb8b86ee3420cb095546389ce69ad15d8
- MD5 71d6f1f79845d6d4bf86c0b2424de2e8
- SHA1 38b6ecde3406ff9830c69cf24b609ab2824c77be
- SHA512 13373a6d2edd2a0dcb7adfbda176a2f27f1512e223207263653fea6628672e40ebff6f287c1caf9ddd57890d76def3834760a1c011f3b2c9414d269769a9abd1
- SSDEEP 12288:AnPfmn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGPXkcjIm:AnPa4cJa/0jHcMC8Y45dXkcj
- TLSH T113D423CED3AD94D9EBD783BC9AFC29C04A755D600CDAA9B703D2379C9C70D04E80A959
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 863KB
- SHA256 0db8a43b8d64173056b678fa0d46b47f9ea0d3278cdb3f4d501341b8f264d8b0
- MD5 3325836103464d96bc6215a93057347e
- SHA1 4af855e2913cad5931de150ef07a1f6e7fe51f6e
- SHA512 9af71c4761bac3ab16c91b9ce12af3ec6b60dccc127c93234414e7f623a4f76636519cf8786680891b11abb17b2b59b6d0c7acc2986f90c9af74c5b8a805fda5
- SSDEEP 12288:e+BNUbTVO86UyURmn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGR:epIUyUI4cJa/0jHcMC8Y45dXkcj
- TLSH T16815CF7BEE28FCD2C67A89B85B918640D77278304F62A3CBD165830DDE239D05D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.7MB
- SHA256 07da907ba573fe7ff4d235bdfdb8d5fa1552298103b6b1ff07399504ee8bbd2a
- MD5 50f96388bd1ad1cf7bc087c40505c159
- SHA1 5e8fc7a29a7456bb5caef07e814646e3a5751667
- SHA512 7b24106a5cd82977542dfbed86940d11749c52935fc06466247fed65dfa0a6bc09ced6edc52efa1443113ebb01c6bcdc307659f2d5326914dc54f0464dbb28b9
- SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THD:VQvGAdlCEL8c/9RNw5CAp7qM1
- TLSH T1EE367D656BF880F5E0A7E178897A8672F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 932KB
- SHA256 2cec07d3d7174c04a779eda6bc8cff9f218227b096191b4ce4d34574a3056305
- MD5 398bb6f7bcc15ebf097816acdfced7a7
- SHA1 2f72d33a673bf47242f82a8b645054d9c65976f8
- SHA512 aea37f3226f1a8716f6ac52e386441cc5e88e2563cf7eb841f11d10091aa579ad4d725659823c27ed4d217c3d3985d3e349b2eec62293bfcb9e30d3822fd05f6
- SSDEEP 12288:m2wSfxL/2Dc3bDLLmt0LDQewsAjVHQ1dF+npmZCmn10I3fZ+iFOFOALRJpM7RIG9:ZmewsAjeGsZCmn+7iFOz8kUyvN7ErR
- TLSH T19215E031FE74D436C3BF0DB61B26D706187DBA204B6119C3E3A88A9D59302D2677AB17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 e9c58f0f6feae9dd95d5e73fe38a5c1ad380ab7b54d2ef44360745bc1ce27817
- MD5 6c413552474f315a0eebc8f72775599c
- SHA1 83777c31b4c13a140b4c9a3fd563bb1832289513
- SHA512 0048e29e0f01e22d68151d9c536a251cc0cc2e6457dac2bac99b2643a1f7f92bc15d965a3c22313e15ff3ab192441fe4aecfaedbca941e61707abb2ba74ec7c4
- SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJH77qM1:HUEtQevvqc2W1cpV2XF3277N
- TLSH T160474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 daabd6c5d7cd9deb52050d67254f7419030f2aab0e92e662ab8be49481a5fbaf
- MD5 f2a9d40a34732663f2544a7898470379
- SHA1 0664adcd4a9efb655cc9590e44b5f071c3ecf75e
- SHA512 0f7e33c852abc01f8852c76140cb2c3c2ffbb0f15782de632e455e149cefd5342c9c554bcb65598ae979a57cfaaae41d65c83e7fe1fb253788004d1f759dbf6c
- SSDEEP 49152:IkbRquA/m2yL5zMUFiV+XenmE3/zARJdd5dU:Poq6VjnmtRJ9a
- TLSH T1F9D58D0976B8C1E4D1F6C37886A6C647F37178154B31ABEF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 d8e7d8cfd6475c9c38bfb980f50d9d76073475c89137d4f27801e15de2bd938f
- MD5 8f0261578ae8628a7da78f59f88405f5
- SHA1 2587c7967f46e8614254cb92df91077388a1f3fd
- SHA512 44f97439289250a80806829b34098957dee3121713743775c0e98aa042a2ca3fe9ab7f2450d39f0ce69cf17cd4f7b44f2f70e3261ada5da732904905262eab8c
- SSDEEP 24576:RAhGLvPFoiwtA5l7S53AGsZCmn+7iFOz8kUyvN7ErR:RAMDFoiq57qCM+7qO3XvN
- TLSH T17345AE81E7F945D4F5B3AAB899B69570EAB6BCA95E30C20F1160C11F1E33A50DD24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 830KB
- SHA256 4fb50ba436fa08f8d1b2752acfee7bd9a29cbbe854e54b82ee27949e9bf546be
- MD5 750126ae4518c7e26cee46b3cdb435a1
- SHA1 31b36e1581697dc011b33ccf7bc0fd89bfd139be
- SHA512 dd3495a65ad7241e6777653398598ab71043a530765b0a97d68c69ece7cec093df762a1ff231279686221ab054192f14c12d07044e4a3718bdd92305c7aacb37
- SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+Cgmn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuu:QwuuOWK4cJa/0jHcMC8Y45dXkcj
- TLSH T10A05F14A73E51CF9EAA78238C59B8531E7F2BC111A65D71F03A0C75A5F33611AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 679KB
- SHA256 7c3eb7733c7746041ca94637145e320ec10f869d5e5d0c9a517ec1bff8922586
- MD5 537d8e637e6dc36e32513a8e23852a22
- SHA1 dc211a9877021a6977f4e91307dd0984ab250e0b
- SHA512 487e6de18be2233a3f77548a3bfc43d4a6b82b41f55a9b2c334ea3744fd1d528b627293a0773c825b7441e58c44c9447158aea0c94d43f359efab0f4e7be6a99
- SSDEEP 12288:ihA1IAkHQ1dF+npmZCmn10I3fZ+iFOFOALRJpM7RIGkUkjvNDHEwxiGk5:oAuGGsZCmn+7iFOz8kUyvN7ErR
- TLSH T1E0E412AA73E496BCE2AB467DC9D51B08E7F1B526133503CF012482652F317D2AC7E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 3d46bcad79cf0591eddf2028e1e38bfe01aa9e863eefc38c7dc97f3b26d24f8d
- MD5 a0c9d94018749d46566c6cb7c79a1332
- SHA1 ca2f979d6d3f1c9ab70236315be16e26d7265ba3
- SHA512 4299ad4c5e788c2ba4f7804de35fb91354df493e40d3f70c9c03bb364357beaced079e3fbcb216daa7eb03028d72bff8d2d0ea05e50429cbfa1207cda8d07cfd
- SSDEEP 49152:ft95l0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U6:HQRQyi36YOcP8Lvw2gAf+PN3wp7qM1
- TLSH T131667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 fdb0ab11bf99f12bb2cf892271309ad7070793417d95cf4f1ad7a5f80112954e
- MD5 fc8345016fad9910fad162624c64e821
- SHA1 d0aebd3d2719181541e297e1145f51f24c50c241
- SHA512 e3549a4769df582790b59c96ac6d7edb6b3fca9e742e6fea8718889a755bd2572a5fd8351b2b99176d60588530021273995b8da0837f30e8fbf3ae3f1a3970de
- SSDEEP 49152:ft95l0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uf:HQRQyi36YOcP8Lvw2gAf+PN3Bp7qM1
- TLSH T185667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 b60c2655bdb04e3f83525a4552dd3b471ed349afb52e68c32b985df9c2733d0a
- MD5 a0bcfac6a5e57b3162720fcf0875d7e4
- SHA1 3e300bc4e54b9ec995b94b3bc419c82ee14a0533
- SHA512 2a2df2a08cefc7bf809bbe9e5c738b1de5e1aee5fc4704f50153ccb7012a7dcd1bd8369221583eaf7a15ae4721727d2fb9a50fde1937692fd17d28c720ca1a06
- SSDEEP 24576:CwvlBf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0GGsZCmn+7iFOz89:z68Qg55nhMeWu7PNU3/wqCM+7qO3XvN
- TLSH T1C2B55A33B2F200A9C44DE1769F4A972196D27C758FE0E3DB851172161FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 1d6f8e4bde05dac352c120057619db3bbd747264668c93d65488b2be4b89f8c0
- MD5 756104e2200a7daf94d46eb9d23fd129
- SHA1 c7281caa0facf88130c8bccd5a55f5bb8065257c
- SHA512 e7ab1a48918b70fe9455218f5391d7aacac4294e7eca5d8b7328e957a14cf5caa0bc32fb824ec6f8e55517b24fe1b0f51890dd42bee80201afe7cd10ba653e20
- SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99n:my5112gYy5azzVv569nLKnhZ4p7qM1
- TLSH T10A168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 fdd69d11fb61f10b753cf9de66e89bd9162fd2b3382d74e2e2ebf2e9c297a355
- MD5 c18f8cb209ce53318ea2e66289f2a7ef
- SHA1 fd65e11d9a1e164ebf1c75569b30a8d37882b4b4
- SHA512 3f604ea7c549acae99d1e15ead1a6d4b4ed79521ad06bcbe87e6108bce00c8ed3e4caaba13c7c9523e896e80ea578cd3d00ba6257237cf6fd716bb55901af6bc
- SSDEEP 49152:sN+taZ3usBWOBr4tEGp0bqx0z+n217aau1glZRJdd5dU:6u6JmTxd2dZRJ9a
- TLSH T19DD59D13F1DA01E8D05ED178974A9233EA62BC490B35B6EF0A9073552E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 d9bc832f70609b91e10ffa124ea043de33e6fdecf47f15c1da686b0522200a36
- MD5 e5b32c62b27d01ea473d18a8609502bf
- SHA1 887ed4975091bcb55d1de7d46a4cbf930f6baa01
- SHA512 cd9414a4ba373202809d2eb24707beecb2f66d398254f390142ced37ce4171e79288bf8be3940cf5e062c2dd52e0d7a0a08cd4d4ae460c578b5000fab9e56d27
- SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xCqCM+7qO3XvN:NmifPbRzp7qM1
- TLSH T14EB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 0db8a13628e737fd4381a2449185f0973c488e9760c55ba84e35f7cc8955f5eb
- MD5 75f8f67048f1db4c8f697eef8df021fd
- SHA1 a1a46f2418751786a545d4e6f1b6436d046ee18d
- SHA512 d7507b84dacdc9100282b8772f8718e268ea6d2344bfd8e256524b5ab8dd158fbea5ee5a5638754dccfa13869bc46187bd2ea589c1024568171e12410ad4c5c6
- SSDEEP 49152:jSuZQIY0Be2K6RVtOnks6NMHqbuo9/HbKgk7SOjcL3M8:B5dKoi61yoxbPNL3M
- TLSH T10BC5BE03F2E900E8E0BED6748B669636EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 d5940fcd0bfa5e7e7ee340b00cc5d8295db1a3b78208c689b9d5d96decb1edd2
- MD5 6baa014d641e2ed1275811e7c2bb422a
- SHA1 b8e75ad829caed3bf7e46a5f9f739b8c4567fc08
- SHA512 d108a95b9eec4ebcc0dd9e0579a4c29ca723579b88977b571195bbb6f8f4344cafcfa957675a5bd423b43ae47312b89d91db4cc64e03bca35226dc45394c6e96
- SSDEEP 49152:WrFSn8EApI0figTgiDn0AP5weuo9/HbKgk7SOjcL3M8:pX2iyphsoxbPNL3M
- TLSH T1E6A5BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 602KB
- SHA256 ce524f70697d6f047aca32d9208065b9981205ef268750a73c28b46a72fe16c2
- MD5 8af2e22a0b86964800594033282eb964
- SHA1 588d3b38fb560415f02d84ac2d02f0d574b67982
- SHA512 4d6c403feea95415f2d049b1a10d6a65b5c944f4c81a851656675ecc6080e08e67c45f34c7233558a27c77327f294a48b2628badb328c0ba3f9a28dc97e624dd
- SSDEEP 12288:F1k8PwUTEdoUeiSbHfHFdVkSW46yk7k+ccFvuOjcFBMLUM+EeZwNj:FjwroUsbHfHbK1yk7SWvuOjcFB3M+Ee
- TLSH T158D42342ED930CCBE0649BF417F8EA2F42346A4317B6B17172ABD4A3CB5749A507D1D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 602KB
- SHA256 167aadf14a36fecb493ae28210a75f3652c74f2e05d8f3b53f97113d28f54a3b
- MD5 d2e4a04d65b2e4532e2a0d4ae12d0e42
- SHA1 31846ad03290e949316eb76e716942df24172674
- SHA512 754073e6a943597662fd2fc1c89932ba08c166faa83819b6c79a15d4436bb29239a732573401f495462cd809c6ff540d807731663023f9325115dc07a9811bc2
- SSDEEP 12288:Tak8PwUTEdoUeiSbHfHFdVkSW46yk7k+ccFvuOjcFBMLUM+EeZwNj:TMwroUsbHfHbK1yk7SWvuOjcFB3M+Ee
- TLSH T110D42342ED930CC7E06497F417F8EA2F4234AA4317B6B17172ABD4A3CB9749A50BD1D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 602KB
- SHA256 61597406710f68c1ff7b57455e26e304b283d0d5f4472189cf363b0a12db62aa
- MD5 9471bc695132c667064bc50ef6824609
- SHA1 99ca7666f21f54e3315579d6e7b32f6889a93d77
- SHA512 63f62876e6110ec08fc0314f264cb6dcd3a03701f6311230bb6d6381bf88e47c3572779559de342a795a5fe2b893d09faf36cec59c34cbc13bf926ed7a01ac29
- SSDEEP 12288:ZQk8PwUTEdoUeiSbHfHFdVkSW46yk7k+ccFvuOjcFBMLUM+EeZwNj:Z2wroUsbHfHbK1yk7SWvuOjcFB3M+Ee
- TLSH T1C2D42342ED930CC7E0645BF417F8EA2B4634AA4317B6B07172ABD4A3CB5749A50BD1DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 623KB
- SHA256 59c8b33cc990b3de2aa5ac3df6a3cb7627179e669d4149c6c51ca6c1c9f888bd
- MD5 31515208e73a46296053f7f0ff9a5bf0
- SHA1 779c1e5f452fca4b6e9a98ee0b5ab427e934aa9e
- SHA512 a70d471c284084842f1a1fd8a39b418a47d54a75f36b49e865adfcbbeecef64bbf91a218099d294dc86588848d60b3ec5ed89a3087458b1d4868d54dbad0983d
- SSDEEP 12288:BlOk8PwUTEdoUeiSbHfHFdVkSW46yk7k+ccFvuOjcFBMLUM+EeZwNj:UwroUsbHfHbK1yk7SWvuOjcFB3M+Ee
- TLSH T106D42302EE9308C6E071D7F48AF5EA2B8374BD821772B27B635644A38F63199547C7D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 602KB
- SHA256 b3ac9c4fcaf411226e6a7f9e96ded77af2e03b00a4718bae26d05c3d363eaf93
- MD5 1b98b77866de891ed89bd1d87d601679
- SHA1 c77fef7a0d7d6cb99230a769cf0d30a64a205f58
- SHA512 7d9844127bac3edd82e5522d472df4af73af6841e87ac3f151e5e9281f8b3715cec75ec45b652021c2c771bef0dd04fe0c64285c9ac59cc6db6954e904dfab14
- SSDEEP 12288:YAk8PwUTEdoUeiSbHfHFdVkSW46yk7k+ccFvuOjcFBMLUM+EeZwNj:YGwroUsbHfHbK1yk7SWvuOjcFB3M+Ee
- TLSH T1E9D42342ED930CC7E0649BF017F9EA2B46346A4317B7B07172ABD4A3CB5749A50BD2D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 602KB
- SHA256 77517ec63091ed7aa8779b613872a50f946a68c11e352d29d8fd39a852989f12
- MD5 39a4f9f146d341f2559250beaf31c425
- SHA1 5e25340e599bfd5fa654ab93f067a7b58174d721
- SHA512 e5dc7bd266cb03c45abf449a5192b5b7f426cf5f122c6fe806f7b9d6561af1c5383544a53d2084c5b0f8ba407b68bfcb6c6c80401f96d9ba51bc98005a43d638
- SSDEEP 12288:7Nk8PwUTEdoUeiSbHfHFdVkSW46yk7k+ccFvuOjcFBMLUM+EeZwNj:7bwroUsbHfHbK1yk7SWvuOjcFB3M+Ee
- TLSH T164D42342ED930CC7E0649BF017F8FA2B4634AA4317B6B17172ABD4A3C75749A50BD2D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 602KB
- SHA256 49cd943aefad2ef23f20caf3406975e2228e6ddc71f5b13560ee835b8924ba2f
- MD5 7d370536af4047fa615dc224dec3e42e
- SHA1 83a143a79df9b45ab625e30baf2e35e0b0b5b716
- SHA512 975d7cbfbb8ee7ef06a602fbaee3d76b5ecaa13371256c395c07a6e9ad7634e1cf2888266a1b0b5365973d4f7fe8e8f8fbaf4d61f06fb552041ea495bdb4af11
- SSDEEP 12288:AKk8PwUTEdoUeiSbHfHFdVkSW46yk7k+ccFvuOjcFBMLUM+EeZwNj:AcwroUsbHfHbK1yk7SWvuOjcFB3M+Ee
- TLSH T124D42342ED930CC7E06497F017F8FA2B4634AA4316B6B17172ABD4A3C75746A50BD2DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 864KB
- SHA256 6c74660461ffbf814bbf69010fea1e220ea31651790005362c790886368ba427
- MD5 762ecd2bc87cbabfc616e423ac3c1f86
- SHA1 e4be890f2e3937fcfb4a7eab0f6f9f3f5e7479dc
- SHA512 8d694acc9f37d45a25d205ce2911b8175cf08b571687c9019601c33fed82f7e925df488d5c51361b127c5f17188ff2d5eb1422290d32f9c3df61d4901b6fa27f
- SSDEEP 24576:RZMNzFVSk4wroUsbHfHbK1yk7SWvuOjcFB3M+Ee:RZMNzfuuo9/HbKgk7SOjcL3M8
- TLSH T188150195B3901CF9EC63827EC9A59916D2B27C560B70C61F13B836674F332A11C3EB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 602KB
- SHA256 fdbc940fd0ef0c6caecd3b8096c20f6f83047470cea9bc37424d77f5a316da1c
- MD5 1fe20ca773be20edc25e4c4f12adf79d
- SHA1 cba3657d6965f26bbc8a15fab74a759c8e9f4c11
- SHA512 2e19095cb2bde66d76aa16c7c32a144c87e8034c2bec77ac3692e6fc88fe9b2700278e48250e0dcb505fd5fdf2160c6ff0cef44ab11559092b2ff8ceca79587a
- SSDEEP 12288:9VCmk8PwUTEdoUeiSbHfHFdVkSW46yk7k+ccFvuOjcFBMLUM+EeZwNj:9VCwwroUsbHfHbK1yk7SWvuOjcFB3M+h
- TLSH T1C8D42342ED930CC7E0645BF017F8EA2B4634AA4317B6B0B172ABD4A3CB5749A50BD1DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 602KB
- SHA256 b80f2b338016194af6a988c8ea2b2fe04380ef243bbb39f69cacfa46e12baf33
- MD5 327638fb705fa435ecb5ed4a451a94d9
- SHA1 82e5f613534a6dfdbfd2fcfcbf08e219b240900c
- SHA512 32c06703ac4ac42113d00c19e3a8d4be4b4f05d45e568f6b0769a77fb6c904699b0266054098bf31e9ac85b95ae0741d87dc921ff95d87395052aa4bcf11a43a
- SSDEEP 12288:XHk8PwUTEdoUeiSbHfHFdVkSW46yk7k+ccFvuOjcFBMLUM+EeZwNj:XhwroUsbHfHbK1yk7SWvuOjcFB3M+Ee
- TLSH T10BD42342ED930CC7E0649BF407F8EA2F4634AA4317B7B17172AB94A3CB5749A50BD1D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.1MB
- SHA256 2f24a1a7353a5ef3d7ee7251db57f82ff5fdc9b8ceeefa222380e15399aa1552
- MD5 a38e06122ecb8eac1232db5e1cbf5188
- SHA1 b4a4e26b2330f89041225ddaa0ad713d1df39b8d
- SHA512 3b2a2f20b98ab3041c66378358c9b7a94bac38d7b6cc726c5e0023f78548439eb8d3d20d4906ff10319062c5963a8bf62266ccfcea72918f59cc0868586c40b0
- SSDEEP 24576:ahwvtk9RX6wkyAI54cJa/0jHcMC8Y45dXkcj:JMnYI5RJdd5dU
- TLSH T1BF35D029EBDC44E5E1B7927C89B7460AF6B178690B31C6CF029A53AD0E33ED49D39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.6MB
- SHA256 dc2719a93f883baa0009b05a39fb6ee427d7554f088cb647c2051604c4be2fd8
- MD5 9bad8827ebef7ff8b3e592c1c47ea871
- SHA1 274e91a871211469b16e240f7524dacaa11e1378
- SHA512 840f84104143538e5872c3a8bbfe29a55a880956f4f2a0569770d1129bf6bd319b812a204192c4893f406063ddfb3f33fc66e19ab3024ebc06391f294e0b9555
- SSDEEP 49152:QYHuNpsykuC7puzfFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dRJdd5dU:KySzPFRJ9a
- TLSH T11F067C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 04accdebad0b5f72cd9de5e377c9046eb88e74322953c8256a4cdad3d80c1fbb
- MD5 f1c6354bffc9fb9210e0f0ccb3ec218d
- SHA1 2f5151397fef58c91ea322cc4434be35b6e5d13f
- SHA512 3f94e3d97ee98bc7d19b82e22e71cd57606befeef0de6be985c09d2611cfdb8a207e9a0b3d570cc438b2474cc91a92abd631dfd4b5407e9551dabe5314476335
- SSDEEP 24576:iA7ab1aQZRXLfOrIhnjFN8rnDHU2+fF/AY74cJa/0jHcMC8Y45dXkcj:iA7aUQjXirIhCnDHUPfF/xRJdd5dU
- TLSH T1A465AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF12B0437D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 723KB
- SHA256 fbfbc77e4ffd070c15521fbda6a1b19fc5f25b11bc3e7f8c26e0c0005d3b4be9
- MD5 b54f09f70594f98b04b929c823e1b5f4
- SHA1 c80bc5565e601c87a57cb1dfc195b5613ad12898
- SHA512 575bc9680912855be3ac134627c8172929479ace4396bead42128becb48380bbc3840b7407a9d291179e1acda105a0483a21d1cf3f835537f14731d68fd9ed12
- SSDEEP 12288:mZsf1oHQ1dF+npmZCmn10I3fZ+iFOFOALRJpM7RIGkUkjvNDHEwxiGk5:D1vGsZCmn+7iFOz8kUyvN7ErR
- TLSH T1C1F4015AE29486E8D06E6279C7461B44B7B3BD2543E193CB52D0F13E1F312D0ACEAB53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 610KB
- SHA256 7763a26197543d0f0bee17808ce2ef8b3d604f22224b2b2d6a638f0e9d52394c
- MD5 ee96ec6279a4a7b27ef901352845ce58
- SHA1 23a7558c42f6ec5a6657a23bb9f2426eb6878b0b
- SHA512 cf33e420e1c836cc8ae9236d9aa9e2af29a3935ef1f04a67460b25cf3fdaf3de7d30c1a2231383ca1743527591ba22d6a7dea5fdf183bbae5aacf5934300f06a
- SSDEEP 12288:sr7gmn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGPXkcjIm:S74cJa/0jHcMC8Y45dXkcj
- TLSH T16CD423CEE39D9899FAE693B885FC55505A397D600F86E0F72286339C9C30D44EC1AE1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 92bb74edf111d3683f298aa939505038426902eabd6ce667e73dee76cf5afd6f
- MD5 b789f761d096de3a572872ff3e69172e
- SHA1 f8562ac1b7097db146c77878ca33bbd19f4564cd
- SHA512 213a383ff45fcb8c2ec4e30743b940303d8d63201d91246287ef1d301fbc5bd93246c876e32271f29afa7e0b4516f01c117c39bdf16c6bd891ad0aa2dfe2c39e
- SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bY/4cJa/0jHcMC8Y45dXkcj:Ggb4mBIBhGFKRJdd5dU
- TLSH T10C65AE1E22EC02F5E1FAD2B8CDAA4417D6B278160732D2DF1251426D2F37EE89D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 664KB
- SHA256 4cc1c66132f88ed132bfaac31367c04a99ea38162c2519a42e21c5d1285eb312
- MD5 4e889bffe63337bcafa8c0bdc98e1d98
- SHA1 eae9c08e0faa5f001b2575e69d9de089f8575665
- SHA512 c5cddad19facc96a0cd088e1740a9bc44bbcafc766bab40bb3c8d23d888731daa85b60bbdd001b254cd3b8c7c6614cb48058b7ad2c2bf309ef46ff2aa1edb364
- SSDEEP 12288:UIGAmn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGPXkcjIm:hGb4cJa/0jHcMC8Y45dXkcj
- TLSH T1AEE4128EA2EA74D8CAB6C3BC89BC559179703D600B5665FF02D1A27CCE20DD0E939D58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 628KB
- SHA256 d4ac55d756daf318487b7983a7ab733306f619991263d7675b37b59af7503188
- MD5 4d0a3ba9938de95d8e6bed38d0761cd7
- SHA1 99cea1cc77bab79c25478e0dff773c66ef54c5af
- SHA512 af7e8748bc07ecde6565a4a1bca9d718dc920038d0a11d5d0502250320bcd1308af060c553886ca0bdc78eb0c4e48a545e6c86cd7f4119098be14ed696f1e9d2
- SSDEEP 12288:Qcmn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGPXkcjIm:QP4cJa/0jHcMC8Y45dXkcj
- TLSH T10DD423CDE2AED8D9EBD283BC89BD598059346D210FD765F712C6328C9C60DC4E83AD58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 30e2a9b88a37b00ff103880aae3342df6086d5ec5194cac757f4a341bfb39e7c
- MD5 86249d3e7a286f29601512ea9cc1b9cb
- SHA1 b1cd26c3154ac9640429aa714c032e450d174c66
- SHA512 01ea67b974c825a93fe42237a43ebaad0ef6eb2bee9e928cb7fb3466b25c360aaa0a48da365101f3bc864a57fa41475b397a6730850f01921f085ed48066c046
- SSDEEP 24576:HG88u8FpJqH1Qzria7/mk4cJa/0jHcMC8Y45dXkcj:m7ZFPqVva7/FRJdd5dU
- TLSH T1D835F165B3E501F0D4B7D1388A964663F6B2B8210365EBDF07A88B551F23AD44B3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 832KB
- SHA256 8f27fac6d5445a5dbd2d07d48bc94864330b21cba2e29e7ef1084545531b668c
- MD5 fc508ed46524537a67e4c918d3fe4b4d
- SHA1 30f536518c35048c8c951762de9dbf955066614e
- SHA512 58b125ac92b6450bfb26007aae06129bc78f20b7ee7d10f3f76ed7e3e04e2343620bfb62cb953038ae3a186c46697ac633c4b2155fc678f18b11027e8585e7f3
- SSDEEP 12288:IHvUrBFrEjwaQ0mn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGPZ:IPUr+NQH4cJa/0jHcMC8Y45dXkcj
- TLSH T13305F15F62ED18E5E6B6E17CC9964609E77178620712E2DF02D1817E4E23ED8BC3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 0dc5404eb56eb5a12377c385a096f9ada4525fa21f4f789547e6f3862f9861e8
- MD5 e23a2a6ea8a1038915a0ba9051050d45
- SHA1 49991d406fdf13b8d54af6f904aa043c137d68e1
- SHA512 9fb3da10d161c04605e69dbb2d6bd5b759ef5d167ba301671320ff91cdf1da98d127208677340c246017bd99bf6fe2994cee92d44648fba2b2b3d5029e7728b3
- SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1RJdd5dU:IG05lO43beRJ9a
- TLSH T1C2D5CF6E62EC11F9D1BBD17CD9C6460BEBB23815032556CF02A486A91F23FF4997E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 cd7a913d15f54e3234dca9436b19c4b581dc098ba0b0dd150ac3d7c37012ba46
- MD5 4ae4976e47ccfdc417c20a9e1df1a43e
- SHA1 641008061438f0a2ea95e20610ffaa5f11e6e2ec
- SHA512 ea22f2c8dd39d8907c2ca287f7612f19de9cfb23b4f373a2eac1b0843a6b3b33d2fac7f387e0f4ad654e8beeebd873436727aa2d638791cfbaf800c2ddee53a4
- SSDEEP 24576:HKa5POZ3dpbWVM50JicR2hG0lasx2+47eidn34cJa/0jHcMC8Y45dXkcj:qa5POZ3wJt2pasx2+mJRJdd5dU
- TLSH T1D965AF5EA7FC01D5E5B9D17DC583461AE5B1342153329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 4719eb854177d360f6634d8d68bbfc9f0e3578ea44f3ac2904cef4da47457127
- MD5 e11cd58aff4781238cbb9a2315daa17a
- SHA1 9d0548ef19b179e0ab4c2576236dc8bcde802ae0
- SHA512 17cc71a713b4045a556fb512023f002d9eaef2d7e6dd143ef8ee6a022c28f9a4be51516187c34aba848c2aca3a22a75c2296358ab71a90511584b1198e16281e
- SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkB4cJa/0jHcMC8Y45dXkcj:PNc/zEOVHF4RJdd5dU
- TLSH T1D4858B1A23E901E4F5BBE1BE897B9546FA71786517308ACF0291811E1E73BF45C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 936KB
- SHA256 a1815d26de6ab76a56f59229d1fc09ff411b091e742a34df58c2477ddad93ad2
- MD5 793695f3f7452a5e73dce381ac19a885
- SHA1 ac85d04cb1c5e99d2a652a6869f09ad2acf3d50f
- SHA512 8cc53359f8b29d72219005ed78dc8eaf9544c350a9e776f13ba08726b36e8617541ac9c18ee0d553d5f03b567a40719e5421cfbf797983a8d3cefbb0cb77d03c
- SSDEEP 12288:6rHPJnJP6szeCs6Rl28dlNzmn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuu:gJnJPbzB4Se4cJa/0jHcMC8Y45dXkcj
- TLSH T12D15E06DD2A810E8E4B7C2B4815A1B99FF31387D2F2269D719B4D5343F12ED0A939F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 0998e3cd5ca028de86ab056b47b5e1f11c627d81909971f05c87791a359f2eae
- MD5 f5b58d15cd5ea9efaf8b86fee7a3f2c3
- SHA1 3246d93d991cbc793f7c88baee304c2bfc7f5051
- SHA512 0af445f66f2d822e4c90f1184b26accdffdbb64ed2889e9400ad7d2db26d6505be58f7caa1a974d08ccb7112aed44549f1e5f6fdeef95dc9cf7850fa1c3077fc
- SSDEEP 24576:pCLHGL0MoeVtFumTijCmlKQWDkK4cJa/0jHcMC8Y45dXkcj:pCLHGeeV5ijCmlDWDkKRJdd5dU
- TLSH T1C5A56B05E7EB5184E8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD0D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 780KB
- SHA256 c081b1015b6fedf3eefaa6339c6896336e29730509c90dd56fdd508e229bf66d
- MD5 b9aa108149739b68ca86c1ec01f7e95a
- SHA1 f0678f5cf8810861ac9c71b36e740a4f88e89e7f
- SHA512 792a811ad49f6829a91b2956d94bed9f7c4dc5ebedfe81168428ddb80570ed27492873ff8d0ea5b649ff5becff702b459d69fb030860e10a59bae3c80cbaa1a3
- SSDEEP 12288:p1H+kKc5ZI7Emn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGPXkS:nKyIz4cJa/0jHcMC8Y45dXkcj
- TLSH T19705018D63BA10F9D1A7D13DC6960541D2B2B47087626AEF07D495BC8EA3EC8F83DE41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 764KB
- SHA256 97e0554ae455b23a4a970ecd1275be6d7930bf474c30b8b2582a1a330b06bc6a
- MD5 e7f04dd8147fe9f3cef09924b765b747
- SHA1 6db181b86e44a2b1ab45354e379876f6af8bc64d
- SHA512 713e8dc4370a26b5262b270ac9899169702360b31d441e2076245cc24ef96371cc8fd1eec8efebc24d93808b2b122eecb373042e8f572fa9f674255121a2446f
- SSDEEP 12288:fG6kyimn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGPXkcjIm:utyp4cJa/0jHcMC8Y45dXkcj
- TLSH T1C8F41249A398A4D8EAF64378CABA45909E357C200F5292EF12D1B72D6E31FC4EC35F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 636KB
- SHA256 36809d2b1abb455859413edff8ff9f4f4ef341b44c6a9c34d4e8bb035e05ef36
- MD5 9083008f25531818cf13a98497b1a00c
- SHA1 65e4a4b7a139d350285347b8a7f03d690c07e239
- SHA512 54c2d9b5c0fc60466c24582c8333f1365ee5838e2d5da16be0d87a6c4783c22d706cebf606724f917cff6ef15cf3a4068e5f46d8ec713479c9832b2f3fcaf7b9
- SSDEEP 12288:kO9mn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGPXkcjIm:9M4cJa/0jHcMC8Y45dXkcj
- TLSH T168D423CDE2AAA4D9EAD293BC85BC198055747D710F9765FB12C2767CCD20DC0E83AD08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 0706e88767e68dfc735da4ee9119165094b471a3ebf1b1416fc06bcfcb19e2b5
- MD5 a497e35e4a6edb7f0cb2e535fa533c52
- SHA1 608db166190165ed651f2c362c2c84d97043796e
- SHA512 36fbbf279559c6721c6359ae9b0b874daeb2e8d0960a42bdf461447bdb25505749fb568a5480c0099136a84c3b3d0131357ac27747c5af90715898e43cd89c38
- SSDEEP 24576:nbgeYoTfaidZi4cJa/0jHcMC8Y45dXkcj:bgETrZiRJdd5dU
- TLSH T1DB558D1DA3EA05CAE2B2D279D9721493D633B4311772D6DF2448C03A4DABED8AE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 796KB
- SHA256 14cb5dc4cd1a3eb9c4e7f1884d954cf1609a0b1cf8ad352c331c466920699f18
- MD5 89f9e0939552237fed439a273b8823df
- SHA1 5fd5d9001211c3436b5e4976764f1dbbd3a9a0da
- SHA512 858491baa15b756814d88287a8c973d39a6be4f68cdbefac4c669d95e8e2d8a4d9c9584720cf5a7b232b028c655b2b458811ee1ec56c4c84c77fc355050aee3a
- SSDEEP 12288:kpJcm8CNCmn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGPXkcjIm:krcmRJ4cJa/0jHcMC8Y45dXkcj
- TLSH T14105F14EB2AE00E5E2B7C27CC9994545E6B37430175267EF02E1877D8E23AD9BD39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 bfa8b27cd734068a95f8b8dd5b77853703f63cb96452405ea9f62ecf24edf897
- MD5 c45f34324a9cdbaa1b300fd14f5e9f1d
- SHA1 30046b17842d05bd67360408cc7bbb74cec52560
- SHA512 360d3ce900d243ec1aaa34fee3024e9f994729170cb75f3bdae31c31ca021b07140b4efa95ea5c01b89c117ccb10cc44cdd742f7a42f781332e34ec361f12678
- SSDEEP 49152:VDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS31xRJdd5dU:23Upow8sBERJ9a
- TLSH T188A58C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BDF19A39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 da4b9f2fcfdcbd713f45f7e39a1ef1e5a1177c4d17994c10ff6f74b92dfde233
- MD5 3e52a0deed61a02b5487cd061e810f83
- SHA1 d6a2b8b44470cf46b00fd0ce1a6d6ed29955d41b
- SHA512 42a0063bbdf415c0cb04b197019f4e7009abfeca42f54cda3cd28cf24ff795b51e0697e9a025b4ff7ff25f5255dc171fe80857bd268b3f772ad007ca2d124efb
- SSDEEP 24576:aTkNvNnaFeYhJNtmZBmA4cJa/0jHcMC8Y45dXkcj:aTMwBtOmARJdd5dU
- TLSH T15555AF6EB6F845E4D1FAC6B4CD238512EA727861073293CB5390C13E4E679D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 992KB
- SHA256 84f65bfbb367f1f74d01f169f1c42778d4756da34d41ddc586d28d610ed5461c
- MD5 9ea99e60e6b5fa3122c14b5e1a19013b
- SHA1 1601cd3b1ff0cebb29c1214bc70138d894fac193
- SHA512 e6016baba7199b83588966ed55ede80d5a4f7d636e379aac5ecc734e208bfa57e7146f430ab14899f8f36632a3bc9271dfc09bb64965b3e323c9c09489b0543c
- SSDEEP 24576:3D3FHshBIYQgA/4cJa/0jHcMC8Y45dXkcj:3DVHeBIAA/RJdd5dU
- TLSH T12D25E17EE69C04E4E57BC2BCCA638A06E77138A9032265DB02D481B95F67ED47D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 772KB
- SHA256 8c05f47510c5b7ac2ff27bb803f8f809a85ff55e87b4e552280f6b38947c31da
- MD5 d21c683c9c086e5226a39a9fb74623d0
- SHA1 bdf2306096ecd1b6baddfb845698877b2f160885
- SHA512 f4228658d33c87a33f5a71b6d069c12c72cdc8daeb8276d2c9e8712e44b9cac36c75997896b62f52de5c522d657b217ed02416b8e9c57b5a6d2dbcaaa3ea9358
- SSDEEP 12288:LyY6b3IkxjbBzWmn4cfTNa/0jHhLJhmvQyBPNMmc8nLnYdu45dRznuPG3OZcoGPZ:H6UqjpF4cJa/0jHcMC8Y45dXkcj
- TLSH T113F4128EA2D864E8E5B64378D9B9415585707C320BA6A5FF32C4A67D8E31EC0D93FF10
- MD5 SHA1 SHA512 SSDEEP TLSH