7de779ee1e7b10e0a2d1d29abb1eb6cbe0b4d8183e90bc46ac9fb7eca248f18c

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Size 20.3MB
Sample261011-hdazzsdc23
SHA256 7de779ee1e7b10e0a2d1d29abb1eb6cbe0b4d8183e90bc46ac9fb7eca248f18c
MD5 a3c7e98205330fc2f969ce9d5b155c5e
SHA1 5aaf60fb5216ee83599d3f8f0ef8432ea944cca0
SHA512 de8af51746bf0f81feec32abbd1ef04c90cd173ffffe6add4f13f210902ec63c142583c3623a92ff00c9e06f87780705cd8db900aa5c8ffc5a3db6f608bd2100
SSDEEP 393216:0nzDLkPDezzAiia7wowy0WCQIVLJsv6tWKFdu9CxIcj:mkLev6a/50WqIA
TLSH
T14327E142B6C340B5EA611170992BE36A8735BD158BB6C6D7B3883BDD9F31290793B343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3780	elevation_service.exe
3132	maintenanceservice.exe
6112	OSE.EXE
4976	PerceptionSimulationService.exe
2696	perfhost.exe
3448	ReFsDedupSvc.exe
1344	SensorDataService.exe
1992	ssh-agent.exe
3020	AgentService.exe
3524	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8be272a967fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000001b94f-165.dat	upx
behavioral2/files/0x0001000000006214-195.dat	upx
behavioral2/files/0x000100000000932b-367.dat	upx
behavioral2/files/0x00010000000093c8-368.dat	upx
behavioral2/files/0x000100000000994b-369.dat	upx
behavioral2/files/0x0001000000009cf8-373.dat	upx
behavioral2/files/0x000100000000a0c8-379.dat	upx
behavioral2/files/0x000100000000ba39-378.dat	upx
behavioral2/files/0x0001000000009b8c-375.dat	upx
behavioral2/files/0x0001000000009cd0-372.dat	upx
behavioral2/files/0x000100000000a1ce-380.dat	upx
behavioral2/files/0x000100000000a2fe-383.dat	upx
behavioral2/files/0x0001000000006279-387.dat	upx
behavioral2/files/0x000100000000bd49-386.dat	upx
behavioral2/files/0x0001000000006222-385.dat	upx
behavioral2/files/0x000100000000a313-384.dat	upx
behavioral2/files/0x000100000000a2bb-382.dat	upx
behavioral2/files/0x000100000000936e-381.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff3e873f4b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a59cc044b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b4091024b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008635c8024b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051a730064b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22002 = "Disk Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000735c1a014b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
3780	elevation_service.exe
3780	elevation_service.exe
3780	elevation_service.exe
3780	elevation_service.exe
3780	elevation_service.exe
3780	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Token: SeAssignPrimaryTokenPrivilege	3020	AgentService.exe
Token: 33	3524	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3524	SearchIndexer.exe
Token: SeBackupPrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3448	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Token: SeDebugPrivilege	4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Token: SeDebugPrivilege	4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Token: SeDebugPrivilege	4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Token: SeDebugPrivilege	4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Token: SeDebugPrivilege	4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Token: SeDebugPrivilege	4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Token: SeDebugPrivilege	4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
Token: SeDebugPrivilege	3780	elevation_service.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
4336	2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 3328	3524	SearchIndexer.exe	98
PID 3524 wrote to memory of 5996	3524	SearchIndexer.exe	99
PID 3524 wrote to memory of 5344	3524	SearchIndexer.exe	100
PID 3524 wrote to memory of 3824	3524	SearchIndexer.exe	101
PID 3524 wrote to memory of 4012	3524	SearchIndexer.exe	103
PID 3524 wrote to memory of 3376	3524	SearchIndexer.exe	104
PID 3524 wrote to memory of 3396	3524	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_a3c7e98205330fc2f969ce9d5b155c5e_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6112

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2696

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1344

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2876 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2876 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7538f37342674a9d32e741f748840866192fe21e609e2734fd21e8bfe45af5a1
MD5 826aa5845dc2b7cdae53023428cb251c
SHA1 6c55d8acc3c6da03fa9c979f0a9cef7f61f3fe47
SHA512 1d1e47e5c1ed1a2a90d04f10248310121006816c8fe6633215b0750497dc9bb0bb275c85fe759525198fd8711fe6418c04b8e7b22e741bbf46b65064a13fc7d7
SSDEEP 49152:fb+632BuPkFKRrdE6ohrstBhuXjfS4LWxngR+ft983Dl3gEe8xA+:d3q60jBXR+l9EDl3VxA+
TLSH
T19DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 dafce053e6ae5010f5c47d027624a2ec618a17ecfb50de5741a2d8b48eaedb7a
MD5 10661e8e7a6718dfe41a19bec0d19ca5
SHA1 9fcd66f90a50adf0f3e5a8377b17905da39976b4
SHA512 14b0f53e03ddb8084fd0c17e12e3e3408e9345a2bcd712f4b2f8cf87383349467f54a136c263db5d9996afa5185e1bed94979e76d9671c9ee2a015c9a58fedf4
SSDEEP 49152:+JcyR+ft983Dl3gEe8xA+a7SDPO7QD1y37die4h:+TR+l9EDl3VxA+k6O7Zah
TLSH
T1287512187B9508F5ED3781BCDDA18115E633BC5207B0EB9B03A489326F3768C5E3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 1ffa9499c09a95ee09fb2c6240cc6294a3699ccdee1cb836442b58e840972c56
MD5 4dcafef79e5cbedcb4c5268995926ece
SHA1 6aa4c7b9bfed5680b5c3d9f1af761719fd65fa09
SHA512 b362689ac7c1cc853f31837850b8ed02742ba6c32a0415fbbf18cb3a9fcd2a63b5296f2f7bbbf7a08bbdb64918e2e94ec228870d03eef3836f29ed36b4ea945e
SSDEEP 24576:2XYfDtczAzRPWxNs298r3OCDIjG3gE9ow+8xA+:1tcyR+ft983Dl3gEe8xA+
TLSH
T1DA05F12877D408F5ED6B827DC9A28512E633BC4547A0E7DB03A089665F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a1ae4351162b27c92674c65cc0aaa2d85eec0b6998942400d54452b09faeec3a
MD5 00862bda038811fba620461ec0efebeb
SHA1 ba9eca4e3388c773918c9ded4ecdf958dbdb8921
SHA512 3906a96ceca76ff917d7baae31853817b262145eef7af2b07b0d97845af195f285191b04c4fac34cf4ed60715a6be7ed673d1b496ff7a97a9a29b187a0c1905e
SSDEEP 24576:0wuXOW1RPWxNs298r3OCDIjG3gE9ow+8xA+:0wsOqR+ft983Dl3gEe8xA+
TLSH
T14A05F14536981CF5E96B81788687D132F7B3BC022A75DB2F4760C65B6F37321AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 b90f99316f4c6291a973c0d8d389fa07a25b460c1fabd57cad7d0aae3efcf860
MD5 2fe08e54dbf256762f272ce40c045594
SHA1 1d8d65abc31d717a5991c60ff30965d051cc3c81
SHA512 81a9dbfbe99fc40e6e89c05a1c7317435a1a8fb0aed092f2b97954f15c0ed6984d44a0a2f7372e07894af73d46de2d2988a5a65a87c10f1eaac4f724a79cea6f
SSDEEP 49152:wE+taZ3usBWOBr4tEGp0bqx0z+n217aau1glZ7SDPO7QD1y37die4h:3u6JmTxd2dh6O7Zah
TLSH
T1F6E5AE13F1DA01E8D06AD478974A9233FA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 599a32e6c156b95fe6d000d7efef14344829fd5fdc11dbbf143d071509d6dbd2
MD5 2c99c1de91ea2e11cf547191dc445ed4
SHA1 d892ac96ab0b5a9f41283e600d18d4e89ebc0f5d
SHA512 b21ef05ef3cd556b04ab03bf0014a26954ac0ccc13ccac25b1465f28cd95a2bbc8313b3fc573361f7446d3763e2bc8327c08691dd40c674c2d6d4e119d8c3f2d
SSDEEP 49152:SMnYIcR+ft983Dl3gEe8xA+D7SDPO7QD1y37die4h:BqR+l9EDl3VxA+X6O7Zah
TLSH
T150850129EECC04E1E177917C99A3420AF2B178691B71C6CF025A53BE1E37ED46D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c3408147f23b27dfc5be053942c0900dda8f67267336baef4d2956d1c2057bcb
MD5 500d996b3b2cdb76a60ae21690adbe8f
SHA1 31fd6b63a5b1d934549352b0b73b6c6b322ec9eb
SHA512 ba542f052f5933d25367877c68d8e5a5a4b3c21908157331f4d207872437f767089e2fb128912cef2ba3d4482ac8fa60a11e46edb335127bd4a31d9ffc5f19ff
SSDEEP 49152:GYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TR+ft983Dl3gI:iySzPbR+l9EDl3VxA+
TLSH
T1AE066C56A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 5cd6297b5f5f8490c305f4e8c7fffc24a221add09d8c2c2bfb00d0e5232a88ee
MD5 cfcdcd480e6e76ac810335e836e74781
SHA1 4748a2ec6d76bf35e81cae39eeb9c7b8e9cb67f4
SHA512 882bc4389ef10b6f58bfd1a9d9aa9c8f4367ecf166ffabf1dbf0ec42ac486e06b93a2f3274c0537cd397703d005ba6981e1929b65703b1917be7ad3917e88652
SSDEEP 49152:RYmaNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TR+ft983Dl3gr:gySzPbR+l9EDl3VxA+N6O7Zah
TLSH
T119269D96A16801D5C5B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c6ff9cc1e9f4387bc40cac704b06f2962873085768309021d2553f96f7311c60
MD5 74818f6f0a1a26087017ca2824709039
SHA1 0dc1bc6faefec71243d6f2e59307a53cd6b8f900
SHA512 6839736f75d9daef3fdd0de4b6aef74ff6f5031bcae9bdadc972466e7b94e364d1ca161bcfc3365f5516d6cc1cde16cb985ef72929c39ec111f17ea4c95e1f57
SSDEEP 24576:H47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY9RPWxNs298r3OCDIjG3gE9ow+8xA+:H47JUQj4irIhCnDHUPfF/jR+ft983Dl1
TLSH
T1FA65AE1DA3EC01D5E1BA927885158A5AEA71782E1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 73e8b5473f36c54c7c8b148bd1e6226059ab730e2cd6d676cc93083d2ace143d
MD5 7087bda948d626c28c39b7ee7d361c05
SHA1 f73db1cf3547606656aa211f24e73ccfe208f085
SHA512 adfbac364c2cd50b6ad28fa6471d42d123e8f6b5a3678ac178f9e467c388f16592073c9c20689730ec0e67c09dbaf2443d526c1e58e715fa24c038c2892f768d
SSDEEP 49152:pD7JUQjqirIhCnDHUPfF/jR+ft983Dl3gEe8xA+l7SDPO7QD1y37die4h:lJ0glD0P1R+l9EDl3VxA+96O7Zah
TLSH
T164B5D01DA3EC01E5E1BA82788515465AEA71782E1F32CACF1270837D6F27ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 278903de81d6bf4de457cfe8cd2e053c4513600d9be23a351f7e332111a0efc1
MD5 e716651b3f1c880699752e37a0e24e56
SHA1 6e9f2d6a93af30bdbc21e40fa38b1899399dd96b
SHA512 fea721ced528b4a2cd75215278c5a3885e45ede3f71149dfe92c8f1cbd7165d2ef130e791765ed6a51b815f7ad9ea34ff66563ca897e9fd733e55e79c8a17825
SSDEEP 6144:RsBC2naj0sv/5H8vwotMxV/PZU3fIkkRI1WK+dMJBNDwYtLaXBwEqp7sqtB0mo9P:WIpZU3fwK8+BKdRrS7sqj0mo9jnwu
TLSH
T1C73518407666CB4FC66940325E32D2CCAB707D05EE04AF0773C98B3F9576659BAE2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 6f1b75307e001adc9a507c52ab8cd0fc572ea11f8cb155a5c8a85703c3a576cb
MD5 b9ee5c403727da8e3da1aa6d00a23e22
SHA1 3572c1516691477018ab8c9592567da4865ada6c
SHA512 67a503e0bb6f898aec4c398fa3676be79024dbd09843247a781db73aed21ea1c24414746bff94f17270b8a98225c6c93ea46fd847de47687f0dbac7e2f5c179c
SSDEEP 6144:LQf3rkxkIeiEDI1R/h1vEtMx5kAMoOsVaKU3TNLjcvEtMxLxyB4AKKSFGuVERH:4wkIeC/VkQlVaKU3TNLjlSFXu
TLSH
T101650A405537D78FD1BB6032033A6B8CBB64AC07BB096F26B3954539D86BB15A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 e5c85ee4235c57c78d56c613758530584c084f960a2fa14480df699e9fd56f30
MD5 e0a0d50c389e81efb47ca8159babe64b
SHA1 bfd22895596b9aa5288f2839990c29cf5c7961a7
SHA512 8ae025122f045d053a95159d83b18ebb1631d17e812eaa3f23737ba7a961dd916b425189c48591e71e02dc08c1d4a62070dfac8b378835640b1973acab36ea44
SSDEEP 12288:x07oRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:yoRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T15FD423002D4C29C2EA3F91F4598AE071B12BBD4E2FF465F3E41186A1AD796CDDDB052B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3b906092c151de2dfb9c98be2e6ba0b0432101bcdbe4430ae80124c63992cbb4
MD5 9d523595a96c9ab9dea8ecb6ceb26c92
SHA1 c37324821e80cc4226441d7c471bf8d9e91a0063
SHA512 a6b1c1103618b922b8b7b42ae07f0426f23adfb66fb53338aeea7dcf84a82c9ae70706078b337673ab3814cdb0910889a28c076eef951a068c02c81431365320
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYCRPWxNs298r3OCDIjG3gE9ow+8xA+:kgb4mBIBhGF9R+ft983Dl3gEe8xA+
TLSH
T14865AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 836KB
SHA256 ef2fa56a9ce5ab5dfe6e378c0a6890aa9f44039af085274f6b7e6ea8973b0a3a
MD5 2c4dfe196206c58a8c226c644b509d43
SHA1 468465635a51d12eb646abe3661ccbf969c42996
SHA512 f5199718b910cd1e79f874efb01554520251d33d56c55555c9ce61b0df464fa4e751d21e5d213bb781ef9894d93abec49a14b785c20b93bb2991f9691a3695c8
SSDEEP 24576:bGF7ebDPOOo2UO9uK1yDj7diGnvvZOWgo:bGF7SDPO7QD1y37die4h
TLSH
T1130522986DA33064DC3782BCB9A4126DB6B1743127614FFF06889831FB6D9D86176F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b8d739c6767d426a03ef651d41db5c48b1dc5ba4d24bdfd377e54a57c0031c81
MD5 031773b09290f93bb91298350e5c4f33
SHA1 c7f5b6a09458c90260b8dfc6785c49afca3e15e2
SHA512 ae6cff21e76a7f181d21b59fd9f30c1ac6f34f0be48ba6b2df9a3db49e7e4fa8787ace2b48ddd046cb119b3f594e27c695167464343a8f73f72a6c4e5393e6ac
SSDEEP 24576:jG88u8FpJqH1Wzria7/mtRPWxNs298r3OCDIjG3gE9ow+8xA+:S7ZFPqVha7/6R+ft983Dl3gEe8xA+
TLSH
T1D935012576E401F1D47BD1388A8246A3F6B2B8151374FFDF06A88B511F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 882f7db647a2859a3efbe0e28901b519d8901e94e5c5b12f76e34e95d0c68f28
MD5 f5eafd3d2026ddbd13fbbab0ff1b2411
SHA1 a5bcdff2458d54801b5b26ad6044fdbbf33f4ba8
SHA512 9af4e936bc983012d5e0a365465ffa48f9adedac22f73acf97f2ca9edbe64d952e03e7c4f39f6dbad98a8211265f40a1c31f4427749382d4dd852227666a8a88
SSDEEP 24576:zPUr+NQRRPWxNs298r3OCDIjG3gE9ow+8xA+:zJQRR+ft983Dl3gEe8xA+
TLSH
T11B05F11F269C18E1E67BE17D89828219F372B8521711A2DF01E0817E5F77ED8BD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ffd5dd8a7f0154c0259b81bcba22f03d80c94990d611218a71fd1d1913b5cfc1
MD5 6d3b7382ad1e82967d9d6bd3b15de7c3
SHA1 23494464cdd23b08f4fc6f7b0fe6193076a4da9c
SHA512 2fd377922655505265a7b60ffebee9e7560071e4ab5457cfe7a49f81545e1cf1f92cbc48dc9873bc23ed7512f089e7a39002edc6553d47435ccaa19d0c509794
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBR+ft983Dl3gEe8xF:eG05lO43b0R+l9EDl3VxA+
TLSH
T1DAD5C06E62EC11F5D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bd5e8b10bdd0168b1e5846e85da5bb36d47d00a8760fbe32b3a48beb89ffb391
MD5 bfa905f18efa2d8194061d4f6bcdea07
SHA1 b752ffaf7a85d58ead56715bd36752a22d10eece
SHA512 1627979aa0b379821a63c1cd22a4b23a093db66541582826711cdf1be0b2aba6af4ba756063891127b44dc2a1c13b8ad862d1cc5fad16732bb0973e28de6eceb
SSDEEP 24576:/fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnTRPWxNs298r3OCDIjG3gE9ow+8xF:Ha5POZ39Jt2pasx2+mJR+ft983Dl3gE9
TLSH
T1DE65BF5EA6FC01D5D579D17DC583861AF5B2342613329BCB012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1905ceacd45af3cc5905a4d970c8ec6babc2606ba28265ce8629209b746f00c3
MD5 86946e6101b87f493eefefefc93431c3
SHA1 2d022c5f3805e0e0480f6f36a6805a03abad2e69
SHA512 d4dda4bf24a5b3bf80bb508cba717c3c2e40e155249cd776b036c0729ef8bd8bc2312efa8071a3d2859407dea0b2940c08c188031d37316ef7f870edb462bc34
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkVRPWxNs298r3OCDIjG3gE9ow+8xA+:tNc/zEOVHFaR+ft983Dl3gEe8xA+
TLSH
T15C858C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 952KB
SHA256 663d7ee28aa86fa3103e366c2348da8a0ae7f2f23f6d2c457a2ba4b73835773a
MD5 1aa5e592d2b8b2f591f0d792e25a2b24
SHA1 5499ca38d81f23972793980242299f6a8d67cdcb
SHA512 6ef9b5546c3f0da5482a933dd41e93c112d2e208175256b09bc8e50cf046f02f46319e0930342392d77c9d78a4f0fb4f8349efc159f6290a033b3f7582256970
SSDEEP 24576:y6DIw7ebDPOOo2UO9uK1yDj7diGnvvZOWgo:y6DIw7SDPO7QD1y37die4h
TLSH
T15725014C676720B5D477D07DD6920219E2B2B07187624EDF0798C87AAFA7ECCB539E02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 936KB
SHA256 7d2da4a9e9942d28a8a33e7da94cf2ba01fcb9f972559a8707b77cb41388d506
MD5 ca8f1ba4d39d476e5c68af3809895b7d
SHA1 5a81c30f7e991cc80b6309625932bca79a8d6d2d
SHA512 059333b596ef8e00c745272a4e7c9f4863ef4aa9091e88c7251e09fe8bd0672ba47b46154b2dfaed7e9b2ac605890ae514eab85f8ed7c9fbb4f2bbc08238b469
SSDEEP 24576:ytyRq7ebDPOOo2UO9uK1yDj7diGnvvZOWgo:ytsq7SDPO7QD1y37die4h
TLSH
T13E1523445B527055ED7601B8EA72426C9B31BC315B624FEF0684EA3E7F3DBC86472B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 808KB
SHA256 258b37984cec8ed2a50a049e478869d219c4e462b91f0ec913f2ce091cffe02f
MD5 0be3c73c0418b6b08028707f8ad512e0
SHA1 cf914a4636abfd68d1f838493d72e63dd910677f
SHA512 55808542a036d6c18a9edfd0e2aaeaa07ab2c0ff795cdce9de286ec29f368e375f497a40ab2409ab8fc4d9de1dbc9f73b64d8ac48f62419bd387653d61e30a28
SSDEEP 24576:A57ebDPOOo2UO9uK1yDj7diGnvvZOWgo:A57SDPO7QD1y37die4h
TLSH
T1C40523889E537525EC3355FCB6A4136CA27174322BA24FFB06889871FB6D8C95173F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 fbd1743081ebcd2526d3eab1092493cc6dc399b4660d56a54888f42586ed9a5f
MD5 2159acb4ef1b790f9684469f5b5abf42
SHA1 76975119c75bad55bc11ee97954038bfd2d9965b
SHA512 ea10d2600024b796112aceea7bf011071233f663ed218cff4d54683ed2eb9dff4f0f092d9fc151458dc7a7b046ff2a45aa6ee1b9aae5fa7c928e3b796e60967f
SSDEEP 24576:U7g3boTfaidZi7ebDPOOo2UO9uK1yDj7diGnvvZOWgo:2gcTrZi7SDPO7QD1y37die4h
TLSH
T11965AD1DA7EA05CAE2B2D279D9721493D633B4311772C6DF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 e2ddb11d1f193e7aa93e94c8a756fdb40c488ab6b8ba544df65d842080d13053
MD5 63ab41b4aa8fe1b6a5aebdb25c558634
SHA1 a50f495f6ca4e41001bd4b0dbdb7157905c2ab07
SHA512 1ed95472b73fd8d782e9f2f0fdd39452bc6f7c20fa111192becab1f7332ee1ace70dea92755cbfc53cd653087a61597752763e8926c6ab4397cc431b84f9e00d
SSDEEP 49152:9gb4mBIBhGF9R+ft983Dl3gEe8xA+V7SDPO7QD1y37die4h:9tKR+l9EDl3VxA+t6O7Zah
TLSH
T120A5D01E22EC02F1E4FAD2B8DDAA4417D6B278161731D6DF015142392F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 639cb38b3c5dab1f089ee9bbc53de58eda4a0b8a97c755db29db3e61ad4c7957
MD5 0a071c6b97c04d0072815c8eafcba773
SHA1 fd3e3b31691d5572117a68e1f08db80f224d1419
SHA512 4609d30ea58fe92139924e4bdb079b7812ef57de19f15c5043cd275af91b777ec1e5da229ffbd0a5edcaece48ed81ababb099159554d54c6be82e7c4d2a32425
SSDEEP 24576:ZTkNvNnaFeYhJNtmZBmG7ebDPOOo2UO9uK1yDj7diGnvvZOWgo:ZTMwBtOmG7SDPO7QD1y37die4h
TLSH
T17175BF6EBAB806E4D1FAC6B4DE238116F6727461073293CB4390C13E5E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 96ed2a96b663ab570d09e2f81e262639861aec3ffa2b3d9cbe88085c75be31e8
MD5 6185fd1949fb12ed402ff2c776fb1d22
SHA1 87f777f8e5d540f33b21ce8a239f45dfe655987d
SHA512 3c587ec6ee9978e0ee29c6577e83686f02eb5d81fa02dbccb072f4ae7bd09920121f14225fe11216de913a8cccd0be0a184e1670f128ccce7c0c45f78e8be90a
SSDEEP 49152:ZDVHeBIAAER+ft983Dl3gEe8xA+B7SDPO7QD1y37die4h:kR+l9EDl3VxA+J6O7Zah
TLSH
T1BA85026DEA5D04E0E97BC1BCDA538606E37138A903725ADB0190C1B66F6FED86D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 214121ddd059efe6246f110667ab46e4abeb1b605227f71fe8661146703ff1c2
MD5 0352ac958582c4f1226b076c7a4c6ceb
SHA1 548e1bd3416fde029bd945df4f8dec2a09b98f64
SHA512 3443683e87994fc197c670ae77be41e1b5e4313200c2317b36f1a167f7293d8cb9d15bcbce4eb71b171ecdbb997a8abcbfd51afe6e1106f20dd44a96417b1e37
SSDEEP 24576:2JnJPbzB4SS7ebDPOOo2UO9uK1yDj7diGnvvZOWgo:2JnJv6SS7SDPO7QD1y37die4h
TLSH
T1DD35E12CD2A910E8E8B7C2B4815A1759FF31387D2B226DC719B8D4353F16ED0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 800KB
SHA256 36ca6db70e6cc60f31148301031ee9718acbcbed24555084d2342276f8770256
MD5 0429247df64dae9d41db9a8ab9e4c730
SHA1 652cf1f9d7a4fa402845480c3b5001bb36364d87
SHA512 269a5c8c0a908631f17fda67fb6e631c4678573116ec02616bc2f7592179d2c64ec638db8c13193bae9f50a9946830da456c330ea3574018c6e4fa3fd9dc170a
SSDEEP 24576:7y7ebDPOOo2UO9uK1yDj7diGnvvZOWgo:7y7SDPO7QD1y37die4h
TLSH
T13C0523849D436922ED7345FCBAA4136C6661B53227A24FE3060C5871FBADCCD61B3B0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 944KB
SHA256 b70ce1e5b1caed9f3f1f2ef470ccaaa8435e25fb2700bb8b4808135f2054f616
MD5 81c67bcd7973100c77eeee4a5ef65c6f
SHA1 27b7597cc236421ad1b147f7e677cb4b1fa938f8
SHA512 a1dc636df41e381eb48f8b20fea5ecaaadc320f637da550c966b54a3a1ae9ab495ad996c5060f871c9e69bcb4b279910d7ebb48204c648c5ee6e64e02bbbc2da
SSDEEP 24576:K6Uqjpe7ebDPOOo2UO9uK1yDj7diGnvvZOWgo:K6Ul7SDPO7QD1y37die4h
TLSH
T1FB25238C5A9224A5E83641B8F964422D9171BC3217B24FFF22CC997ADF39DC8913BF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 3fc382781162d541638eba96d80124affc1c931e5cd709be36bfe822d7e793fe
MD5 f7be2d5a2e6d75b32d04ae80c626f54e
SHA1 694668225e96faca6225212634458f407ef2e641
SHA512 252f662b5ed251aa5c9700f0304f8f69787ac2c28bb67fae02607012ee625bd0289a25f66d0c808c6e0ac7d62304db04e22a3749076ad4ea05fdef0eaa465876
SSDEEP 49152:VCLHGeeV5ijCmlDWDkn7SDPO7QD1y37die4h:MZ6O7Zah
TLSH
T13FA57C05E7EB5184E8F3CAF4CA2694169A327C509B34F7DF4A80C96A2E32FD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 968KB
SHA256 d79b71179d5432aa91539cac6ef4cdb11b29565942433148d4ec9cafc3d184bc
MD5 706e21645cc16daf82350df2fb4adccc
SHA1 126aaa73cc37ebb2d26311808e23ffa3dbb328ce
SHA512 7bbbfe74a8a886095618085e301900764627c28c29b30f8f3073f85529ac2ed4271d744d3d5b1168f11cc055b62c8d110e200fe0895840e26b262b9f006e0c2d
SSDEEP 24576:WrcmRc7ebDPOOo2UO9uK1yDj7diGnvvZOWgo:gcmRc7SDPO7QD1y37die4h
TLSH
T10325014EB66B00A6E5B7817CC9810219F6B3B03123625BDF0294C77EAF6B9DD7935B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 8d7be4ba44140f6cb2acb16a9905816c0f695e4bbced720367ba51c200d5e45d
MD5 0b9e8a11baa023a37ae4bda1d0cfb3d6
SHA1 f9cca3b6c26d6b91875e2638e3f2c67d101a5061
SHA512 2b6e3e3cbc5f99a3125ca16c1834f5c09c6532f22be47e866ae2f5e784be0d69c8f828e055f4db799246d11e4dea022df38613e83194942a5d2838a1f89d489e
SSDEEP 49152:LDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3m7SDPO7QD1y37die4h:g3Upow8sBt6O7Zah
TLSH
T1B7B59C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1344-109-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1344-340-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1344-103-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1344-341-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1344-343-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1992-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1992-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1992-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1992-344-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2696-88-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2696-332-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3020-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3020-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3020-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3020-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3020-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3132-59-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3132-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3132-55-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3132-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3132-49-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3448-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3448-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3448-97-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3448-356-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3448-354-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3524-351-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3524-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3524-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3524-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3780-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3780-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3780-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3780-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3780-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4336-0-0x0000000005FF0000-0x0000000006075000-memory.dmp

Download

memory/4336-13-0x0000000006A40000-0x0000000006AA7000-memory.dmp

Download

memory/4336-5-0x0000000005FF0000-0x0000000006075000-memory.dmp

Download

memory/4336-7-0x0000000000400000-0x0000000003F80000-memory.dmp

Download

memory/4336-8-0x0000000005DF0000-0x0000000005ECF000-memory.dmp

Download

memory/4336-20-0x0000000006A40000-0x0000000006AA7000-memory.dmp

Download

memory/4336-86-0x0000000000400000-0x0000000003F80000-memory.dmp

Download

memory/4976-87-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4976-81-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4976-75-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6112-306-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6112-64-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6112-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6112-70-0x00000000007D0000-0x0000000000830000-memory.dmp

Download