61deaf8f627a66916930955d045773d47f3b573389fd08b8863f4bb9794fcad0

Analysis

max time kernel
147s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Size 3.3MB
Sample261001-h2phaatdlc
SHA256 61deaf8f627a66916930955d045773d47f3b573389fd08b8863f4bb9794fcad0
MD5 ba033e7264b4dc74a244f6828f9124fe
SHA1 ffbd92eac748ce48a409e15cfb1f6ba87b422e33
SHA512 93f9783b98a412b95a9f86051a8ebba1a8122a3d951a0cba7e287d12f94fdeacfe5c08c7c658bb96f43a8b9ae3bd22309d47e2559361b5c99e43004bc5bce1c0
SSDEEP 49152:+Z9ATAK7IjnDreNwL934vsDEuJUNliAceq58uCiqHUzj23P2Fh0jpIMlXn:+ZCTWDreQDEuJU9mGjiZ61
TLSH
T1B3F5AF317701C4B6D95202B0ADBDEA5F816DBD218F7414C7B3D82F6E55B19C22B32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4284	alg.exe
464	GameInputSvc.exe
4488	GameInputSvc.exe
4120	elevation_service.exe
3640	elevation_service.exe
1896	maintenanceservice.exe
5420	msdtc.exe
4324	OSE.EXE
1356	PerceptionSimulationService.exe
4796	perfhost.exe
1868	ReFsDedupSvc.exe
3088	locator.exe
3980	SensorDataService.exe
5804	snmptrap.exe
3412	ssh-agent.exe
2172	TieringEngineService.exe
756	AgentService.exe
5720	vds.exe
5700	vssvc.exe
3708	wbengine.exe
4376	WmiApSrv.exe
1776	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
	\??\F:\	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\940d45d6b68fd3f0.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054294a937451dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002bd8e2937451dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7e0e5a17451dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f4f37937451dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f00dc7ce7451dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093a911cf7451dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072176b957451dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000043aa70957451dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4488	GameInputSvc.exe
4488	GameInputSvc.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTakeOwnershipPrivilege	5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTcbPrivilege	464	GameInputSvc.exe
Token: SeBackupPrivilege	1868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2172	TieringEngineService.exe
Token: SeManageVolumePrivilege	2172	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	756	AgentService.exe
Token: SeBackupPrivilege	5700	vssvc.exe
Token: SeRestorePrivilege	5700	vssvc.exe
Token: SeAuditPrivilege	5700	vssvc.exe
Token: SeBackupPrivilege	3708	wbengine.exe
Token: SeRestorePrivilege	3708	wbengine.exe
Token: SeSecurityPrivilege	3708	wbengine.exe
Token: 33	1776	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeDebugPrivilege	5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	5212	2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4488	464	GameInputSvc.exe	91
PID 1776 wrote to memory of 4300	1776	SearchIndexer.exe	112
PID 1776 wrote to memory of 5504	1776	SearchIndexer.exe	114
PID 1776 wrote to memory of 1108	1776	SearchIndexer.exe	115
PID 1776 wrote to memory of 4564	1776	SearchIndexer.exe	116
PID 1776 wrote to memory of 5864	1776	SearchIndexer.exe	117
PID 1776 wrote to memory of 5028	1776	SearchIndexer.exe	118
PID 1776 wrote to memory of 2384	1776	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_ba033e7264b4dc74a244f6828f9124fe_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5212

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4284

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3640

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1896

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1356

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4796

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3980

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5804

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4376

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2960 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2992 3000 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4564
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2992 3000 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2960 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2dcd68dabb09a4990738e411d42e76d1d61a37a634fc430e5b2497178d7d07fc
MD5 81802e6840c436e67e5c9f8516446a50
SHA1 2b7cdbbb11c89cc4464601298f03385465f7b851
SHA512 b70460aa91e474a8b67c96fdd0c4767df0946b5eea492ec0256e6b2da15f42e1c328387e9311ccc01439a0e6491f2197d7f4cb98118eaadeceab0e92b4a5e6a4
SSDEEP 49152:r8F632BuPkFKRrdE6oh7stBhuXjfS4LWxn/h0jpIMlXn:b3q6gjBi61
TLSH
T170D59D03F29900E9E069D178D7469133E9A2BC890B34B6DF0790B7562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 32f850639a610c262d0cd1efdf9a69089e7a1d88de06f7f5734c5f043fea144d
MD5 0bce2a665480736ac013b3ebd986f2bc
SHA1 99fe8934019acfb35b43a1b344cbdd85d5211639
SHA512 a397493a85330f23ce4291cc54a870b19a112602ba8045bf6cf1c8baa101baf1c2f61e6b3fdf3fb1ce0d04ab882777ae045ce1ab30d88e2537f8aba9b768414c
SSDEEP 12288:61XLs4hgZxzPBh4TczAEzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:QXYKEOczAEKOW0jxuBIRIMKsLPPn
TLSH
T12B05013877D049F9ED7B413DC8A28511EA7378514760EB9B03B4D6361E233989E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 6cbe140cc170c3f24d7dd6c6d83992f235f45e96dca7ff7a1bf12cd830b3626d
MD5 6770f82db5f0c9695fe5a0b1b39dd959
SHA1 d65dc038a8acdd176b890c777ea03fd2cd87523d
SHA512 111cd4779361c62ad70106bb3f8a1185adeee9740b1a08dc4fe64ba4e60a8fda8bde4a721196fad5b330b95768c4a7f97bacbdeff49694909e8e4f3a20a92e01
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CCBzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPv:uwuuOW7KOW0jxuBIRIMKsLPPn
TLSH
T1C405F15576946CF9E9B74139C587C136EBF2BC122A20CB1F0370C66B6F27361AE19B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e48e79c89f44d63782255e48507ca322a171aef2a01d4f1586b8dca38eb37ac1
MD5 8ca3d0a4ab8b3750c6f755586e2ce716
SHA1 c43a22c8596b258eabc20d2e685399ce08e3551a
SHA512 32128af5090f9ebff902c503582050609e50ab51238ef8ff3a1057f5f0fd59371e3545eda37bacfc6f549a2d5416251eb1834d500646497411fe8296a6a5ba96
SSDEEP 49152:TI+taZ3usBWOBr4tEGp0bqx0z+n217aau1glOh0jpIMlXn:4u6JmTxd2dq61
TLSH
T158D59E13F1D901E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 576KB
SHA256 811381e8e0602c4da151274473e2151fc3e7b6a8c6c5174b488a3dac68a38f75
MD5 cabff0997df7b9519d92232110e6ec14
SHA1 7392b36ce61255bdf38405306a93b7c18268aa16
SHA512 e22ff702757b1c4cf912cfaad1be7fdbc4a1f0770dd02c11e07bfbc8a8960db5337d381576cb6b38e430e7cf8c922fac0a5ab253dc7d32666e1a620fbd5f2603
SSDEEP 12288:bNwvD5ue64Lk3tRX69qkyAI5jdzXb/kZX0:bNwvtk9RX6wkyAI3h
TLSH
T1FAC48D29EBDC44E5E1B7923C99B7460AF6B178691B31C2CF025A53AD0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 611KB
SHA256 772ae96ca33b244b56b542d5f724f58d87861d7e3bcb73aa38b341ddf7a9d7e3
MD5 dc0c15ba6eedd003b8f10b7b9a81620f
SHA1 9a783b364e323073ff98b52ed95324da81a885a7
SHA512 af860d849ad4d43c8d9ebce0c4d68b42f54454e14f09cfb719f0dd09c8ea1ec4676bf5f009c130ae1761801e67656d743b9b33defed875cf7602b39a88349b53
SSDEEP 12288:Id7IzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:4IKOW0jxuBIRIMKsLPPn
TLSH
T1A7D42371A949FFADFA7D1074A087A3249D6A78A5AF04C9DB4039C27B38947C4DE00ED7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0f0528354cacceebd313129fd10aedeade97ec4a5d995e451552408ffd7822db
MD5 0639807cd266447e42e8fa640895e3d4
SHA1 786d833d9d2804c9f4c96920ba847ae4370d3022
SHA512 e5cad4e6ba3e8e0a557ac3138c7030a95d1f3bafe1a200f9573f7a4c5d2156a18143538c95e44f1290b71bff8aade2bfefb05425cac63cb79b30eb7c7e34c93d
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYUKOW0jxuBIRIMKsLPPn:Kgb4mBIBhGFkh0jpIMlXn
TLSH
T17165AE1E22E802F5E0FAD2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 5c271ca0f1be8f225d4cd78040076a8d62378c861ee87f2b788743da317ee3d0
MD5 8dce3714207fac3dad18daf4f1ebe3b2
SHA1 d78f3d7228bc3dfbb3da5d6fd3c50de4ecc7ca54
SHA512 45b6837db31dd2b749bfb0d53802f417117f156073e3a2f4a97c12386ebdc1f00104d46be5a4c14904ea762a7a48fbfb7f2d9843cfb32f3585439fa61eb6b055
SSDEEP 12288:9uG+zXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:8G+KOW0jxuBIRIMKsLPPn
TLSH
T1C1E4233C7495BAECC93A4179D052A262BCB138B06F1499FF04F5D23A6E886D0EB34DD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 18fc8c2e4550fc5c7431077d8e471572238974e7c83cf8b9f65afdd3c67d7e1b
MD5 f1b0fc48f5bad8b718138520a48de683
SHA1 af78ac07c9a8dd2b62ae1c289fcbe56852381a3f
SHA512 9c4496568ef023d86d858f54408c7d3494a03c2cf3cd9a73fa179dc06a4817bfb03e158469c9adb097a97875dbb309afd5361382c10aea9fe62269005a9be5d8
SSDEEP 12288:YpzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:YpKOW0jxuBIRIMKsLPPn
TLSH
T1E7D42374A445FFADEA791079A083A3549DB518A1BF44CAE7047AD23734C87C9EA30DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 f99dc2cafa2db8538b8f108e498a2884c7effb5cb31a50637145e6b825eaecc3
MD5 4328328be644f1d8884baad5e2871741
SHA1 b33f8ca0d100790b484d490b567ba5fdc3dce7f7
SHA512 283006185290c32b00137bf52b8257defab03010926904d6299bfe426af4723174e654c3d0f5df8066637ca2ef6c90163dab11f65444a84a21537730b8518ed8
SSDEEP 24576:otJ8t8FpJqH1xkrGV7/msKOW0jxuBIRIMKsLPPn:ou+FPqVrV7/sh0jpIMlXn
TLSH
T10235016576E102F0D47BD13889824663F6B2B4251364EFDF06A88B661F23BD54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 b02a486dbc8ffee66a7c39e6bc75dfd82e8ece44a3c443bde515b2930104c66e
MD5 2576f2150f233ce83c15439c4868dc24
SHA1 550bf430c8e116f50a31e5c9528c7eec8822470a
SHA512 5fc4b5b51b77e8aedaad1fa92a6e1fc348af13aec5864a9c0ed1cfcfb277a3563b098e6d4de5dcf0b9ff22700a8194849d0557682336df126af0cfe01bff8409
SSDEEP 12288:QHvUrBFrEjwaQqzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:QPUr+NQqKOW0jxuBIRIMKsLPPn
TLSH
T17A05F12F66982CE9E67AA17DC5828319E77178621711D2CF01E0C17E1E67ED8FD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 df26483c93428420ff69b773ff02cb3d0ce0d91efe4705bfaebb271350bd1304
MD5 76c83f799241f79c7e575c61ff824f7c
SHA1 01d84a0c5747c2127139d355b2148e9836c19050
SHA512 0a4deafa672b6ae1a2a107f26482307a7ad7a887cd8ee0b288bf2cd63f1824d55256790f91eee7cb96e508e4769794a9f54b37b7f42e8a9e7ff024abbb98c214
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdh0jpIMlXn:OG05lO43bG61
TLSH
T115D5CF6A62EC11F9D1BBD07CD9C6460BEBB23815033456CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 1.2MB
SHA256 ebe777a2525e9fa1b4d72cdcc66ecb1f5a286fc2449c00070483f3202524d412
MD5 42a6dbb0231772440715205a3c4f2726
SHA1 941fae9ed46cce2b1eaf8fef5af3d28f804149a4
SHA512 fb3d585b3331a03075e616a8bd9ee627f64130afef0cd39d37efd95efdfc52730ab85113356f598d2077de96705e61d4b17fc1bc7bdd11ae704b9032729cfb22
SSDEEP 24576:zZxLMhbo6KHgFPThMOrlANeGe+z6bX17BHpV61tKFPNlDlrUz8pHIH4Sd4fIzQ:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh47
TLSH
T1FF457C6D52F801F9D0BED16CC6878A0BEBB134265335A6CF02A486B95B27FF5613E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 f0b3a62827b8d8813cfdff57ab45c6ff7a04eadd73d9125021d93d5eaa19c33c
MD5 a27947e133dbd5c5d0283007427b417e
SHA1 31ebcb121cb82e61615ae243f0bea79298ee477f
SHA512 ff5bc58ea6146d7df9f90c4f548d23dd866abd44a8cdad133e786d5ae826e2b7c072416f52f9be6618d87132233830e290366375e43f1925ec23ce73d81a9b26
SSDEEP 24576:Sea5POZ3dpbWVM50JicR2hG0lasx2+47eidnXKOW0jxuBIRIMKsLPPn:na5POZ3wJt2pasx2+m0h0jpIMlXn
TLSH
T16065BF5EA6FC01D5E5B9D17DC583861AE5B1342253319BCF012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f7c7cc3326e029be78fbf619426c74ad6b83520944d742569d2dc147e979999f
MD5 b5bbc7457af119acd22f18cb1d957757
SHA1 ad68f663d9f7cfae2f00568a5396b3db27409012
SHA512 26a2d33fefbce61f2ae0b42f2d8ef2e2942df68c122090bdc10c93abf89b80dc3fe37b3f57796ec626669460db7e40b8b5e6efc1c326597755ccbb4caa6b2038
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7Fk6KOW0jxuBIRIMKsLPPn:uNc/zEOVHFqh0jpIMlXn
TLSH
T155858C2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 101KB
SHA256 fbd8597870574fb095e3d63441efdfcfe3026ddf9aad9c7ddc47bfd8717ab755
MD5 a54ac607666341245d15b7c26e54b259
SHA1 76f2e75e567419ee3903ab4f988b93da210ab177
SHA512 ad4bd996728b24c59a14e810608f5849278bda30fb662c52801a302c9f0e3f657358e89f15e4ecabed6ab8509619dbfd584e575af11dced7be2f69ff382ec950
SSDEEP 1536:g6uYwaElOmG2LzsRHdZhXeasELG9lQ8Ivu4dlnMm2B:g6u8ElJqDxLG9K8Mqt
TLSH
T1E7A3F88E045A01F5E97AE17ECE420386F1B078258B3711CB43A5416F2F7BBF6523BA65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 79f197bb3693e69ea6cde882335df69597cd6916e4c413e5b4762b162baf25ae
MD5 1c2be042ecddc5b149d0cfe014a1c526
SHA1 fd84aa12ebbee7438879e7812dd4c232fb3bd5e8
SHA512 6a3e80f8d9639ae00823e44aac94e927dc99ee4eb87a683977130a41cb347acbc9cc64a0d82c1a0ec54207a54f14677cc57f6443e6715519f623e815cb8b39a4
SSDEEP 12288:qKHPJnJP6szeCs6Rl28d/zXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:DJnJPbzB4S/KOW0jxuBIRIMKsLPPn
TLSH
T1F115D03DD29820E8E4B7C2B4815A175AFE71387D2F2169C718B4D5353F42EE0AA39F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e4adb4fda17e96199adb3dcda73d33f770ee0d6e664593df8ac0296a0ff18cc5
MD5 e8aeb829fbfffaa85e91f5385e4d6391
SHA1 80be7a8bbf99b20324c3aec5877033a7772e9fcf
SHA512 1cba8662f5a29a4743a5632e1d12a400c09738ea0ef2042b9cc7a92ec795815b23dd57956f260b5c65a0399c6d466fdab5726b99080dd925a9de2600134bd72b
SSDEEP 24576:UdLHGL0MoeVtFumTijCmlKQWDkMKOW0jxuBIRIMKsLPPn:UdLHGeeV5ijCmlDWDk1h0jpIMlXn
TLSH
T148A56B05E7EB5184E8F3CAF5C92294169E327C549B34F7EF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 c66d5157f2852d971c94850ce2710eb97b2cc217aa9dac1259300621161ebcb1
MD5 6acbb126c275ddb94e01c4160504b18d
SHA1 5046df4bb4b733c3059c4a520807f41e792ee491
SHA512 37c5df548dc3f0be1832864dfbe4a40f7f2859e105f74db075dfb3e6f79ab6a7c156b0a774b083737c3d0c12c7e7b53bcc2c1abbdea3beec51b41ec5532d0bc0
SSDEEP 12288:C1HekTC5ZI7mzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:cTYIaKOW0jxuBIRIMKsLPPn
TLSH
T17705026C736A21F9D17B903ED1830211D6B2B4B19B119ADF06A4C57E5E93ECCF938E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 6440ad413dcaa2cbfb93a934853d60f29138a14f7d6295ac68f18e853b59b5c3
MD5 9dc6d063261f5f545711d2fd560edcdb
SHA1 6d66c657e4a678089117e08a6fca36e8e4ddc095
SHA512 74101e235d3e85b96c7cd9e38523a02a84c1b408555a190bbe9b0f09a98efb1a04ee3e465bb2d93e5818ef1087e055502f2b491c0b6536eaa6695686226c2a3f
SSDEEP 12288:wG6kysTzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:htyoKOW0jxuBIRIMKsLPPn
TLSH
T1CAF412146384B9D8EAB91138956382A48E757C20AF20D6EF04B1E63F3E757D4ED30F96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 6fdb0f36b46fa37ec3dd86866213e99eeb4fd44ba90f4076358682a5c4951cca
MD5 85e8ecb1c4c7de1751d4804db578c41c
SHA1 ca71086ee954151cffc9aa44435299630b8fd065
SHA512 06906973551b18998159a8f7aa4d0c6db2c8356700eac8ac925a165b1b65c51728ff43c7c1315d7630678ec943d535c00ac3310a48c241755de53e13f6c6b826
SSDEEP 12288:PXvKzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:PvKKOW0jxuBIRIMKsLPPn
TLSH
T199D42378A441FFADEA791079A04393A58DB638B56F14C9EF04B5D23768883C5EB30DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 58eccfc6493859af59a4acfc27a59b020a9d7a2b36e2255d8f42523882dfdffe
MD5 925c9ce9432ae8c3e3610c39c9db5e9b
SHA1 c88dec557b30510452bdb399a7f3f80fdc8ff0d9
SHA512 f2782170451209e1bea84edae16f7610d90c9d16fe1fd6d1997ca36bda4efe40af3f70c852b55decdab704d2c1d90983654d5dd88f4c4ab55c29b2702a7c87ab
SSDEEP 12288:THgABZyFDK3tT5Tr7aVLIH9lH3cQzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbyT:THgAKoTfaidZfKOW0jxuBIRIMKsLPPn
TLSH
T127559D1D77EA19CAE2B2D235D8621493D633B4315772C6CF2458C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 18e23799a1d7a83b2d3799ced1aed6ae99cd8d60f663e80122e938e11984d49d
MD5 dea8b4e3dea74772483b54844609dfcf
SHA1 0e697b0b30487b8f305058745dfe5f35b0b8e147
SHA512 fefbfb4524feaf9b1722718f26ce5c99e9d534e25be3aaaf906d3c18352121133c3b2e39f8610380cf72c5bc3fdbb8f9de5ad67eb21e237a6088c4f1f3e6873d
SSDEEP 12288:MpJcm8CNdzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:MrcmRdKOW0jxuBIRIMKsLPPn
TLSH
T11005015EB2AE10E9E1BB813CC8824255EAB37030671197DF01A1C37E5E57AE9BE34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c9b01b1a40fcb7090bc5a7676d993f1cc0807fcb6854deec29176d90c21dbf77
MD5 badb5ca63e4a554829a8495b63b92e11
SHA1 eeade4f0d5a702546e8d7494648d5304f2b3a49f
SHA512 5e143ba99bd19d38b7c5301559e33344ee6ab7570cb5e723b622909a627874c56fafd4d0ff59ea3ba49fbf4fb8fb41bad7c7a497f513cd44c59a0a11368e7f97
SSDEEP 49152:vDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3yh0jpIMlXn:E3Upow8sB361
TLSH
T1AEA58C3DA2E810A8C9AAC379C54213A6EA71782D3F3055DB0174C178BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 349dafa09d0132920b4eba558f939735d5b3835b21d50c26bb3637d15ffa4c5e
MD5 d94942d493c03d43ab7f3a238922ebc6
SHA1 1109e938ab9ffbc83c806e83518df80620920ee4
SHA512 fe40a689491285a520d005b763ebd73bacb83e0f82b499a5d4663985fd623d9af2c9c5f4b3ebc9f4b4e1413f047d072ac11e4f1be2624c49e11042a9cb55c23d
SSDEEP 24576:vTkNvNnaFeYhJNtmZBmVKOW0jxuBIRIMKsLPPn:vTMwBtOmgh0jpIMlXn
TLSH
T1B355BF6EBAB846E4D1FEC6B4CD238512EA727461173293CB4290C13F1E679D89E35F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 1a5bcea6b06d6a57626448bafc29ae5f544cce2cd5945445cf710514009a2003
MD5 f502680ec09d2dd980817ff788c1fcb2
SHA1 2a5d4ae310ba882d462c7fb7dad024eb6115972f
SHA512 e45e6605ded8e53955c23fcb664a5622b29f43ae384694e7aa774282c069e321321847afb56c3e8bd00e0369085d160bb5c94ad83d3c020fe3dd2033b25688f5
SSDEEP 12288:Cye6b3IkxjbBzygzXb/kZX+yOW0BhXhp8BDkz9IiAUqTSoTRbym0LPP1J:86UqjpbKOW0jxuBIRIMKsLPPn
TLSH
T152F4236D66C0B9F9E4390134E452822589B17C722B64D9EF20F8D23F5E35BC4DA3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-29-0x000001B452720000-0x000001B452786000-memory.dmp

Download

memory/464-28-0x000001B452720000-0x000001B452786000-memory.dmp

Download

memory/464-26-0x00007FF6CF360000-0x00007FF6CF429000-memory.dmp

Download

memory/464-27-0x000001B452720000-0x000001B452786000-memory.dmp

Download

memory/464-102-0x00007FF6CF360000-0x00007FF6CF429000-memory.dmp

Download

memory/756-170-0x00007FF69D920000-0x00007FF69DC41000-memory.dmp

Download

memory/756-176-0x000001F417660000-0x000001F4176C6000-memory.dmp

Download

memory/756-171-0x000001F417660000-0x000001F4176C6000-memory.dmp

Download

memory/756-172-0x000001F417660000-0x000001F4176C6000-memory.dmp

Download

memory/756-178-0x00007FF69D920000-0x00007FF69DC41000-memory.dmp

Download

memory/1356-169-0x00007FF6DC170000-0x00007FF6DC2BA000-memory.dmp

Download

memory/1356-93-0x00007FF6DC170000-0x00007FF6DC2BA000-memory.dmp

Download

memory/1356-95-0x0000022918540000-0x00000229185A6000-memory.dmp

Download

memory/1356-96-0x0000022918540000-0x00000229185A6000-memory.dmp

Download

memory/1776-224-0x000001E362BC0000-0x000001E362C26000-memory.dmp

Download

memory/1776-223-0x000001E362BC0000-0x000001E362C26000-memory.dmp

Download

memory/1776-222-0x00007FF7C43B0000-0x00007FF7C46EF000-memory.dmp

Download

memory/1776-249-0x00007FF7C43B0000-0x00007FF7C46EF000-memory.dmp

Download

memory/1868-117-0x00007FF7D64F0000-0x00007FF7D6C34000-memory.dmp

Download

memory/1868-116-0x000001BADCC60000-0x000001BADCCC6000-memory.dmp

Download

memory/1868-259-0x00007FF7D64F0000-0x00007FF7D6C34000-memory.dmp

Download

memory/1868-190-0x00007FF7D64F0000-0x00007FF7D6C34000-memory.dmp

Download

memory/1868-257-0x000001BADCC60000-0x000001BADCCC6000-memory.dmp

Download

memory/1868-118-0x000001BADCC60000-0x000001BADCCC6000-memory.dmp

Download

memory/1896-62-0x00000187E7300000-0x00000187E7366000-memory.dmp

Download

memory/1896-61-0x00000187E7300000-0x00000187E7366000-memory.dmp

Download

memory/1896-73-0x00007FF766FB0000-0x00007FF767118000-memory.dmp

Download

memory/1896-60-0x00007FF766FB0000-0x00007FF767118000-memory.dmp

Download

memory/1896-68-0x00000187E7300000-0x00000187E7366000-memory.dmp

Download

memory/2172-163-0x0000020F19BD0000-0x0000020F19C36000-memory.dmp

Download

memory/2172-161-0x00007FF660650000-0x00007FF6607E5000-memory.dmp

Download

memory/2172-162-0x0000020F19BD0000-0x0000020F19C36000-memory.dmp

Download

memory/2172-221-0x00007FF660650000-0x00007FF6607E5000-memory.dmp

Download

memory/3088-126-0x00000208C7230000-0x00000208C7296000-memory.dmp

Download

memory/3088-125-0x00000208C7230000-0x00000208C7296000-memory.dmp

Download

memory/3088-124-0x00007FF6A8B80000-0x00007FF6A8C2E000-memory.dmp

Download

memory/3088-197-0x00007FF6A8B80000-0x00007FF6A8C2E000-memory.dmp

Download

memory/3412-152-0x00007FF60E5D0000-0x00007FF60E873000-memory.dmp

Download

memory/3412-154-0x000001D2B4C10000-0x000001D2B4C76000-memory.dmp

Download

memory/3412-219-0x00007FF60E5D0000-0x00007FF60E873000-memory.dmp

Download

memory/3412-153-0x000001D2B4C10000-0x000001D2B4C76000-memory.dmp

Download

memory/3640-52-0x000001EDD3D50000-0x000001EDD3DED000-memory.dmp

Download

memory/3640-53-0x000001EDD3F10000-0x000001EDD3F76000-memory.dmp

Download

memory/3640-55-0x000001EDD3F10000-0x000001EDD3F76000-memory.dmp

Download

memory/3708-247-0x00007FF767F00000-0x00007FF768407000-memory.dmp

Download

memory/3708-202-0x00007FF767F00000-0x00007FF768407000-memory.dmp

Download

memory/3708-200-0x000002A1A3040000-0x000002A1A30A6000-memory.dmp

Download

memory/3708-201-0x000002A1A3040000-0x000002A1A30A6000-memory.dmp

Download

memory/3980-134-0x000001ACDE390000-0x000001ACDE3F6000-memory.dmp

Download

memory/3980-206-0x00007FF679EE0000-0x00007FF67A2F7000-memory.dmp

Download

memory/3980-238-0x00007FF679EE0000-0x00007FF67A2F7000-memory.dmp

Download

memory/3980-236-0x000001ACDE390000-0x000001ACDE3F6000-memory.dmp

Download

memory/3980-133-0x00007FF679EE0000-0x00007FF67A2F7000-memory.dmp

Download

memory/3980-135-0x000001ACDE390000-0x000001ACDE3F6000-memory.dmp

Download

memory/4120-46-0x0000020C521F0000-0x0000020C52256000-memory.dmp

Download

memory/4120-45-0x0000020C521F0000-0x0000020C52256000-memory.dmp

Download

memory/4120-44-0x0000020C51FF0000-0x0000020C5208D000-memory.dmp

Download

memory/4284-16-0x000001F62EB10000-0x000001F62EB76000-memory.dmp

Download

memory/4284-15-0x00007FF660E60000-0x00007FF660F83000-memory.dmp

Download

memory/4284-18-0x000001F62EB10000-0x000001F62EB76000-memory.dmp

Download

memory/4284-71-0x00007FF660E60000-0x00007FF660F83000-memory.dmp

Download

memory/4324-87-0x000001D863DE0000-0x000001D863E46000-memory.dmp

Download

memory/4324-85-0x000001D863C10000-0x000001D863CAD000-memory.dmp

Download

memory/4324-86-0x000001D863DE0000-0x000001D863E46000-memory.dmp

Download

memory/4376-248-0x00007FF74CDF0000-0x00007FF74CF1F000-memory.dmp

Download

memory/4376-212-0x0000028A47BC0000-0x0000028A47C26000-memory.dmp

Download

memory/4376-211-0x00007FF74CDF0000-0x00007FF74CF1F000-memory.dmp

Download

memory/4376-213-0x0000028A47BC0000-0x0000028A47C26000-memory.dmp

Download

memory/4488-37-0x000002BC69FE0000-0x000002BC6A046000-memory.dmp

Download

memory/4488-115-0x00007FF6CF360000-0x00007FF6CF429000-memory.dmp

Download

memory/4488-35-0x00007FF6CF360000-0x00007FF6CF429000-memory.dmp

Download

memory/4488-38-0x000002BC69FE0000-0x000002BC6A046000-memory.dmp

Download

memory/4488-36-0x000002BC69FE0000-0x000002BC6A046000-memory.dmp

Download

memory/4796-104-0x0000000000A30000-0x0000000000A99000-memory.dmp

Download

memory/4796-181-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/4796-103-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/4796-109-0x0000000000A30000-0x0000000000A99000-memory.dmp

Download

memory/5212-6-0x0000000003460000-0x00000000034C9000-memory.dmp

Download

memory/5212-7-0x0000000003460000-0x00000000034C9000-memory.dmp

Download

memory/5212-1-0x0000000003460000-0x00000000034C9000-memory.dmp

Download

memory/5212-0-0x0000000003190000-0x0000000003307000-memory.dmp

Download

memory/5420-74-0x000001719F860000-0x000001719F8C6000-memory.dmp

Download

memory/5420-72-0x00007FF69BA30000-0x00007FF69BB4A000-memory.dmp

Download

memory/5420-75-0x000001719F860000-0x000001719F8C6000-memory.dmp

Download

memory/5420-160-0x00007FF69BA30000-0x00007FF69BB4A000-memory.dmp

Download

memory/5700-192-0x00007FF787760000-0x00007FF787C31000-memory.dmp

Download

memory/5700-244-0x00007FF787760000-0x00007FF787C31000-memory.dmp

Download

memory/5700-193-0x00000218DA550000-0x00000218DA5B6000-memory.dmp

Download

memory/5700-191-0x00000218DA550000-0x00000218DA5B6000-memory.dmp

Download

memory/5720-241-0x00007FF6C63E0000-0x00007FF6C666B000-memory.dmp

Download

memory/5720-184-0x000002B895FF0000-0x000002B896056000-memory.dmp

Download

memory/5720-183-0x000002B895FF0000-0x000002B896056000-memory.dmp

Download

memory/5720-182-0x00007FF6C63E0000-0x00007FF6C666B000-memory.dmp

Download

memory/5804-210-0x00007FF642360000-0x00007FF642414000-memory.dmp

Download

memory/5804-142-0x00007FF642360000-0x00007FF642414000-memory.dmp

Download

memory/5804-143-0x000001EA5FF80000-0x000001EA5FFE6000-memory.dmp

Download

memory/5804-144-0x000001EA5FF80000-0x000001EA5FFE6000-memory.dmp

Download