Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
- Size 3.5MB
- Sample261023-ehexyscb68
- SHA256 c6eb2604bf9df6a4da1967033bf4aaf71d44e699a2fdddc0b8ba28506219cea5
- MD5 ec3c9a60442e3be0e3cccb0032afdaec
- SHA1 4abe9446991f76a462b26768f7d28539eb351642
- SHA512 95ad797f28015ea8afad336fd6d53926980e9189ba63c904ff023cb35e3db20f762759de0917f44d88f7e8fb0b2752a27cd84751323abbc7419f4735c5c1c76b
- SSDEEP 49152:EZBATAK7IjnDreNwL934vsDEuJUNliAceq58uCiqHUzj23P2BuOaHBUs+Ped:EZuTWDreQDEuJU9mGji/uvHBt+U
- TLSH T10DF5AF31B741C476D55302B0ADBDEA5F456DBE218F7404CBB3D82F6E15B19C22A32A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe -
resource yara_rule behavioral2/files/0x0001000000009323-214.dat upx behavioral2/files/0x00010000000093b2-218.dat upx behavioral2/files/0x000100000000994e-222.dat upx behavioral2/files/0x000100000001b987-234.dat upx behavioral2/files/0x0001000000009cd2-238.dat upx behavioral2/files/0x0001000000009cfa-242.dat upx behavioral2/files/0x000300000001a29e-246.dat upx behavioral2/files/0x000100000000b972-250.dat upx behavioral2/files/0x000100000000df1e-254.dat upx behavioral2/files/0x0001000000009fd0-258.dat upx behavioral2/files/0x0001000000009b8e-262.dat upx behavioral2/files/0x0001000000006211-266.dat upx behavioral2/files/0x000100000000a04c-270.dat upx behavioral2/files/0x000100000000ba3b-274.dat upx behavioral2/files/0x000100000000a0ca-278.dat upx behavioral2/files/0x000100000000b94c-282.dat upx behavioral2/files/0x000100000000a1d0-286.dat upx behavioral2/files/0x0001000000009369-290.dat upx behavioral2/files/0x000100000000a2bd-294.dat upx behavioral2/files/0x000100000000a300-298.dat upx behavioral2/files/0x000100000000a315-302.dat upx behavioral2/files/0x000100000000621f-306.dat upx behavioral2/files/0x000100000000bd4b-310.dat upx behavioral2/files/0x0001000000006276-314.dat upx behavioral2/files/0x000100000000a028-318.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\DebugSync.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Token: SeTakeOwnershipPrivilege 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Token: SeDebugPrivilege 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Token: SeDebugPrivilege 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Token: SeDebugPrivilege 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe Token: SeDebugPrivilege 4056 2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 2ca63036a7235031d892bd59d4eb5aa6a00c0467c7117952aa101f92e5e74356
- MD5 0e2b4f470582ade747e68c21d652ed4b
- SHA1 4b66ecb41e90d0bd303697b8b7d73a8d97704b41
- SHA512 31ea8fd409877b99d4f52b191fab5f50e8f2836479ed245378977218c2e9db04c4df2ea0540a91059d754f0b9dc28285df9c6526681fdbcece017388a5ed815f
- SSDEEP 49152:8b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnmuOaHBUs+Ped:m3q6gjBPuvHBt+U
- TLSH T115E5AD03F2D900E9E06AD1B8D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 42b2b9cfe7e1ac4cd958a3b7cb3e3583d4c4a17d460ea2ded4fe55d54f4dad56
- MD5 031b24c3a05ad0729e4c045954e29485
- SHA1 5e10667fea109831bab265c912b9d54b07f2d91a
- SHA512 7e2e53645830308d86866a566753b31a31c40ce41ddbb79071ee0407bbd97e6f19d192c16e8d06d140818dd05fc766bcc88480be74b4a60e5287273ad7300bd5
- SSDEEP 24576:AXYB8tczAiU76VkOaWw7x/uV8S+ekUsFvvs0meXis:KtcruOaHBUs+Ped
- TLSH T13B250138F7E508FADD6782B9C8A1C511EE3378454364E69B03E4856D1F233986E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 a4df2f2cc0335d0123532d8e66bba497fbdda402881949d2ae5cb6bd14cbf014
- MD5 7b93b2dd5e40d6fc38516f158c8c1cae
- SHA1 c4f24aa62697b02ae073fabdf4940cb2562e50a0
- SHA512 f4b3099f2c1c34d46b4d4e638d01d9f687f5540f9c7cd489fdfc1caa2919710cae69bd5ddebcc7c3afb3ed86a0dbe3cc5d615756b5b7b4030c745d6381e34b54
- SSDEEP 24576:dwu7OWLU76VkOaWw7x/uV8S+ekUsFvvs0meXi:dwIOsuOaHBUs+Pe
- TLSH T10B250155B7A90CFAD5678679859BC136EBB778012A34CB1F07A0C65E2F33321BD29720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 848be7d5555ab02af96218c43b338ac09b2b30beae678a1b595e48013a88e051
- MD5 87882c1433a1d0c3915556e88951b57b
- SHA1 be95a0779d2848728a8ff64e14ce171ceb4ea7ae
- SHA512 174f38c8efa5d907b1a47a577c7aad4d319e86c46c61e21efc910ba725857b62d58e0292647e23ee5e7888b600af8d684656265311adf2cfa5c4b89d5e5ae65e
- SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ul:0QRQyi36YOcP8Lvw2gAf+PN3KuvHBt+U
- TLSH T1C9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 b8f029502e7e4d3eab2ec65ac64233b829b8c0436edc607d7152f0254ff00a31
- MD5 043e858b663d3efe631821f018cbdd63
- SHA1 e1039ac907846354bd1640fc8a3eb3b46d6ad83f
- SHA512 0b208ebb45cb6b6fc25599811fde07a561d296f6f283eec12fb1e117cc98e81927fc56e7056735bd6bcca51c4d2aedbbafe2c016776e3ddbf2f1802c2b5872d0
- SSDEEP 49152:WB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl/uOaHBUs+Ped:ku6JmTxd2d/uvHBt+U
- TLSH T174E5AE13F2DA01E8D05ED578974A9233E962BC490B34B6EF0A9073552E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 557a7903eac7481d80b84f47ea88cdef8c43da90abb21e3cc6b87a4f7d500623
- MD5 11976722c264d0d3d33bb9ff90f11002
- SHA1 b2bfc790d9449a6a9b358b2ab76336f5f80d5f9a
- SHA512 aa43c5a552b14145092df258cad5f0d9330b045ae8a5484d12ece0064ce3fd99874c2a5492f7268a285cb8f4483350f00b92a85caeb2ca10c860b36920c46aa7
- SSDEEP 24576:fPwvtk9RX6wkyAIkMU76VkOaWw7x/uV8S+ekUsFvvs0meXis:EMnYIkCuOaHBUs+Ped
- TLSH T13D45E029EBDC44A6E177927C99B7860AF6B178590B31C6CF029A436D0E33FD46D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.7MB
- SHA256 1c6257aae4029aa258b66f5ae4a9eb141d81915f9e9a75cf5a9fb5e986cf7144
- MD5 982fdb782719111adf3dd09714888e86
- SHA1 d8f02e2dc2b961f4d2024ef1257654873eee15a5
- SHA512 0fa16145b53e223bfab518d104212bec644e92fb1933ea285a61bd8deb6d79e52983115b493202dd3c5eba9ae7381d0356b38042ce145da9366a45a9efa07d52
- SSDEEP 49152:OYu2Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0euOaHBUs+Ped:RySzPmuvHBt+U
- TLSH T16D067D56A1AC01D5C1B9C1B98B1BCC1BFA7134490335ABEB03E546935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.6MB
- SHA256 5b595a17b0de254beaa017c55e12bf0a16a0d0c374241d86c9c61ef9a767d386
- MD5 3469fd309b34e0e45ac900095b35ebce
- SHA1 dd98a69f9fabcf9d9f2bd33b3fb825925f334da6
- SHA512 e12e2d7cfee13ac1e75ebddb6d753f06c308d94e9e1bfa0fe722287e5aa8be1cbfe60319e5db6e7d19c0f29282d59ea667a86fd8d25dbe8af47dd5c6463c8878
- SSDEEP 49152:Y67JUQjXirIhCnDHUPfF/QuOaHBUs+Ped:xJtglD0POuvHBt+U
- TLSH T12475BE1DA3EC01E5E1BA927885558A1AEE71742E1B31CACF1270837D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 9cea6cd2025f46705f4869af0c8f79d247b61cef2983ed18cd11f0ded20ac603
- MD5 d45c8ae14b1e5410855bc48c4ebd3528
- SHA1 36782a2a4eb88d25fdf796f8933511f80ba6cd06
- SHA512 9a050ea8898fd00b9e51f566ae18aab3e273959a43127991659e78b0ac66b5fa34b7b47145c864aac39742446b97e16de27abbe224d9b42958034cac879cb7d2
- SSDEEP 24576:CkU76VkOaWw7x/uV8S+ekUsFvvs0meXis:CquOaHBUs+Ped
- TLSH T1680523B1E7AF9D33C157AEF120ACE6351C2F3B454738849BE587409C2636B22BD71256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.6MB
- SHA256 1bad2344f9c83ad03736a59bd22861d8303a0b752ff2d49f42ccbd5b5feb91a9
- MD5 086750150409de7eda0c4092b39ead0d
- SHA1 31e1c0e10e732c6cd9f23b048939f1ffcd0bf0e8
- SHA512 8e289e2677c7c03d788d3dc36efe2db19b8f3a5cb93581d87ceeadb5c4f226f66bd57ac39096f752abb5d854b782e6f8422c78f1e78bfd01892a5a5829192e5b
- SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYNU76VkOaWw7x/uV8S+ekUsFvvs0meXis:7gb4mBIBhGF6uOaHBUs+Ped
- TLSH T13A75BF1E22EC02F5E0F6E2B89DAA4417D6B378160731D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 ecd09703622786b512772eee779c721b3538e383608335150390558d5ec9e5e2
- MD5 0ce06f9e8c29362fe7de7d83ae34dc89
- SHA1 605fead2024e525dca62901d5dac167db79e159a
- SHA512 71ff821e3ec34a020db4e2a3ffe6c61d2be5c2a28e149016a77980593f43f366ebed03e1ac0d9e0801b595ece3367d58566aad97b1ecac1f6c28b562e88364d6
- SSDEEP 24576:6TkNvNnaFeYhJNtmZBmAU76VkOaWw7x/uV8S+ekUsFvvs0meXis:6TMwBtOm+uOaHBUs+Ped
- TLSH T1E275C06EBBF846E4D1FEC6B58D238512EA727451073292CF9290C13E0E279D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 828KB
- SHA256 f94a8ce2d3cbaf036ea01302692527d5991b7ab307468489b34c6b610bfae866
- MD5 132d1ccfa35240ac899bb9eceea0bfc5
- SHA1 42f8e2f731b4db46e089aea2418e88a80bd7440b
- SHA512 eb0d17016cb36d9a40a040eea4c207a6766085fdd67ad0566d8accbd7d5edcbe944fcf0085017b2e0f66ff711e8c11a3a76a635ad51a1f238138d23574237733
- SSDEEP 24576:eGzU76VkOaWw7x/uV8S+ekUsFvvs0meXis:eGpuOaHBUs+Ped
- TLSH T17C052278F7FF6876C127DAF120A8D6262C7B3680433844EF85D6807C5B267E1BA34995
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 792KB
- SHA256 9a05239955af01d74885d3932415eb9d283f7c75d7e65b46a5bae35bbcc15bd9
- MD5 2b517cb4d8a207ff94d86b80392cbb9f
- SHA1 a0ed903705f08f16821979c071f79cbe7a4b7374
- SHA512 52a698c714760c62e26959993e097369d093e0f8886af9767db2154ad63cb91427ed7438ff64a2f4564a51eb7b4406138fa9c4afdd129b8d99eab67248b61fd8
- SSDEEP 24576:yzU76VkOaWw7x/uV8S+ekUsFvvs0meXis:ypuOaHBUs+Ped
- TLSH T1C60523B4E7AF9D33C243AEF220ACE6250C2F3745473948EB9597409C12267E7BD711A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.3MB
- SHA256 94aaabc10f2d3d5aa6dba99021394e4b1b2c2d963df60499cb60458cb3ade41a
- MD5 7286d26563e3e1e12bee2b2dfb802c60
- SHA1 a338a26f82b43d3f49d27a589da59756109cf30f
- SHA512 d5a7f2dcc974e3ab625d1c407b1672a2a45675aa7b3e0ec6de7c982393b3c068f62949a21f5483290364befa43358dfa63503a2e54e457a1be64815df33ad189
- SSDEEP 24576:suk8u8FpJqH1ozria7/mWU76VkOaWw7x/uV8S+ekUsFvvs0meXis:zjZFPqVXa7/puOaHBUs+Ped
- TLSH T188550165B7E501F1C077D13889868663FAB2B4150334EFDF06A88A591F23BE15B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 996KB
- SHA256 cb46b9c7a090e4adc8580a711def077bf252160e09fc6f3bbed5212e3ea5fa1d
- MD5 86e514b81d03fc2939ee804a6903efe6
- SHA1 67943c116f93c1765f5cbb37eddbbb090e7dbfa2
- SHA512 aa4e9bf5aab726c83338d2a48b044b252e239ed83f6f470c89825052d8283708bac3242e8c4fa2850aa0448ddd09a851db54e0e6732e9f0b03b1d88512da16e6
- SSDEEP 24576:OPUr+NQAU76VkOaWw7x/uV8S+ekUsFvvs0meXis:OJQ+uOaHBUs+Ped
- TLSH T12925F12EA7ED1CF5E677E1BD85858719EA727452031192CF02D1817E0F27AE8BD39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 118880cba2c27be7a5c5175347f7c2f6a6e5b44d2d6e7931fbe4214e41119434
- MD5 01b9c70eecbde9e0f315fda80785fbe1
- SHA1 54952bb6d4bd408333e7ffddd7724a88ca84b1af
- SHA512 e7a5fc11ac3e2915e695dca36b055bf273512de4b7576300e8641bae24990d7e4f3730f7567241c833cd765d285a05688a811a1f7d8dfe60e5f4f4dcaae5db11
- SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQuOaHBUs+Ped:6G05lO43bruvHBt+U
- TLSH T151D5C06AA2EC11F9D1BBD17CD9C6860BEBB23415033456CF02A486A91F27FF4697E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 b84e8bd1287ce6ec97d65a78348b682e5b14f2a2aa6ad90d4a0aa26cc0f07540
- MD5 b9c2e431a79ac27834a9e358639d866d
- SHA1 896a1c1ee163a2b9c487231685e68c8b921dc08e
- SHA512 c9ef979deebc4c7675d8e816e631845e3b8ed94eb8ae806eb639e6ed473bad7f938b5b5dabd711a65850007312877b2cf9ca1bc79a798970401a31cdd7230b0f
- SSDEEP 24576:NFa5POZ3dpbWVM50JicR2hG0lasx2+47eidn1U76VkOaWw7x/uV8S+ekUsFvvs0t:za5POZ3wJt2pasx2+mFuOaHBUs+Ped
- TLSH T1A875C05EA7FD01D5D17AD17DC583861AE5B2342153319ACF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 4f5fc7ba505ecdd2382d2c0ea342ed3470a0a5a2db46aadafb86ac2b4b602095
- MD5 f36d245279125c25b116a427b4c06f40
- SHA1 fe373066e2fb39ef5865e6a2b2351931a4f67344
- SHA512 33f198160222ab93e6b642c2a5197faa77d6d324f07432eddd74965eb8e1b65c1b758840b681f66983a29c871b3013cdf3bbe3bd262c37ab83edbb07dda12553
- SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7Fk6U76VkOaWw7x/uV8S+ekUsFvvs0meXis:DNc/zEOVHF9uOaHBUs+Ped
- TLSH T105959D2663E901E4E1BBE1BE89779546FA717865133486CF0291811F1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.1MB
- SHA256 b0464fcb0fb9f52ae385aeb0dc6d5414a1c8d9e8c9aba07be860a9e3ec016720
- MD5 ae9263f4c622c68aff861ceb4cc8258e
- SHA1 5ff35df6628c1437ee74381e82ca5fbdfa1382dc
- SHA512 eb6e3dd40a11afa4011ac817c9fb69adb1d9f2a398d5713c792337b601aaab8e8ac5d07982daa8d0cf21d1e81dee481b9374aa485ae794557b554078cd5f8ce1
- SSDEEP 24576:CD3FHshBIYQgAKU76VkOaWw7x/uV8S+ekUsFvvs0meXis:CDVHeBIAAwuOaHBUs+Ped
- TLSH T11245F13DE7AD04E5D57BD1BC96A38A06EA7238A8033155CB02D481BD1F2BEE47D39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 cbc267bd54604576d73e00a7716ce9259723adcaf37faea2a420a4b2dc30dabc
- MD5 05abf33ed238ec6657eee86291041023
- SHA1 c59c5c573eaa2f1fe52019fa7b3f30715f3d7f2e
- SHA512 3f17f87c8a94f6106071b82ed9c96ef6476086095e1e4b2fcbeda8842a66fff9220376aed98e95bc53fc5fdc7b6ca81461b2549fd42089dcb50a300d7208c547
- SSDEEP 24576:GJnJPbzB4SWU76VkOaWw7x/uV8S+ekUsFvvs0meXis:GJnJv6SEuOaHBUs+Ped
- TLSH T14135F13DD2A810E9D4B7C2B4415A575AFE32386D2B2569CB59B4C4383F12FE0B939F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 97a0a8dd0eef24596bff3aee666997419e632ec63764bbd0ed2149a21a85e6fd
- MD5 9db65bb6ab85df0499ac9e6090752485
- SHA1 bcd0c2273d34256d8d96c293d60380be3d721441
- SHA512 a707f2af7a45ef539a7544d06315d719bd3ae2516ecc356a68d9fa314d8614345a8585aaf31a25a404414b302ec6a7e7b5f447ccca65551ae1b9bdd59a610033
- SSDEEP 24576:WCLHGL0MoeVtFumTijCmlKQWDkzU76VkOaWw7x/uV8S+ekUsFvvs0meXis:WCLHGeeV5ijCmlDWDkpuOaHBUs+Ped
- TLSH T11FA57B15E7EB5184E8F3CAF5CA2694168E327C449B34F7EF4A80C96A1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 944KB
- SHA256 80fbc07b4d81773a4b3c2184bf4a68cfc0880805b25421ac561fa387dee57f23
- MD5 2b539b90ebbf68b9726b4d0b203769e3
- SHA1 c6c9dde8a2c71f6d897748db82f11fc66e5418ad
- SHA512 c20fa8d724a8b6dea0eb84c5b8ac31ce72937bf920d044166650f27d54260ce91400884c88035d9916dafb2eef751ae221ec1dccc88b953399ec92f8b9ec2e01
- SSDEEP 24576:46DIJU76VkOaWw7x/uV8S+ekUsFvvs0meXis:46DInuOaHBUs+Ped
- TLSH T15C25126CB3BB10B6C167D0BE91828512D9B771A1832249DF4AD5C4BD4F63FD8BD38A81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 928KB
- SHA256 ea1b65c9ac2416b21ea175045b6b8b3c7c955b2125f20195f35a279a47ced32c
- MD5 defccb7fa9d78b2e311446e4a41af323
- SHA1 fd70418640b4488c26deb9ad87da2f4b9fef7582
- SHA512 1204374868f2d44442b81b0c85b652872c50c5386d4088d864340926d2ef03e79cee1e83acb2d7d7cb257a8b65dc365f17957e8b5701c125aabf2e91df8a8dbf
- SSDEEP 24576:wtyiU76VkOaWw7x/uV8S+ekUsFvvs0meXis:wtFuOaHBUs+Ped
- TLSH T1BA152264E3AD6472D2A75AF425A6C2614D3B3D104B3086EF95D2C23D2F36BE1BD30752
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 936KB
- SHA256 9f6023ec146809a6cf3b2d4a6109ce7f90940f299e3a1d2939bbab4e6923d999
- MD5 4b1660626624a744e63c404c42282e08
- SHA1 d6bed6b3e81692e96d2e70de10e512b9b5816619
- SHA512 f7459e2916265779ebbb52639b5c9469a3ae7688f49f32db19e3e9a93725628a4e71601153354a95faa67cf0bdc81f88152020efdc5cae210c1807ccf064dfc3
- SSDEEP 24576:B6UqjpnU76VkOaWw7x/uV8S+ekUsFvvs0meXis:B6U6uOaHBUs+Ped
- TLSH T19C15226DE7E968B6D03796F064A8C2364C7A3D62033544EF71C9817D4B32BD1F93AA21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 800KB
- SHA256 7d29635550628f920fde2f9e9cf97452bb1b0ac39694a750a4dcd8e2b739e149
- MD5 0d647a0a8849d47e20d70dc39abe2005
- SHA1 f9ed4752d9e08e5750e7e6876ba82e618b5bbd8b
- SHA512 6721518e7fa63a89c7566354a8560ea7511b699de0d91404ee8b3742bed34931af6dc5d31dd614c2308b5f6f583b67751d5f242fae7cb2066259e522b8150abd
- SSDEEP 24576:lgU76VkOaWw7x/uV8S+ekUsFvvs0meXis:leuOaHBUs+Ped
- TLSH T10F0522B8E7AF6833C247AEF120A8D6260C2F3641473948EF95D7807C57267E2BD70592
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 9c3181c32f54a97e6eed8d14f23e189f922c113c883bd04a37e4268976fa3946
- MD5 24e068fc497796b34a2e36eb7fb8fbfb
- SHA1 374e0939b9556ee6f75237eb746e63042991973e
- SHA512 7bdab723292ec02704d61bad75a7f6159436aaf7b2c39836ffa5c25dd5a3e392662ff4972c7d7b1206fe34e504d4f67d98ee18410c69c4a1ff03c42f36bb9b0b
- SSDEEP 24576:0ggILoTfaidZSU76VkOaWw7x/uV8S+ekUsFvvs0meXis:5gHTrZouOaHBUs+Ped
- TLSH T1EB65AE1DA7EA05DAE2B2D675D8725493DA33B4311372C6CF2448C03A4DABED8AE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 960KB
- SHA256 28ee0b941c83e90248147d064602f1c654dcb7dc91ea31fb0f24763f0484851f
- MD5 f26e9508c07694c0c5e0f7f4d6315056
- SHA1 02c7097d611b9a5a9a89558cedbc63706e285a9e
- SHA512 d0fdac3cd938cf3695f52efef03d5efad75130ba672ad72ee14d972987ed2cfd6e386affd7c4c99e68d2a173ca5a46895e965cd5973a259b781cd3a33f17f455
- SSDEEP 24576:QrcmR7U76VkOaWw7x/uV8S+ekUsFvvs0meXis:ycmRhuOaHBUs+Ped
- TLSH T16F25026EF3AF00B6D1B7D1BC88858616EA733020532157DF42A2C77D4A27AEA7D34B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.2MB
- SHA256 db6989c70d03a86dadf8bb356232568586ffd8613075d13213c8d4a50022d92e
- MD5 29cd88c57823c5e9947190e17824e023
- SHA1 4e1920bb56bab91a5867ce25087aa1d19a718f1e
- SHA512 a0453675531e55fd9fdf7c70c2a8852004a9d4e88b44482cb690eddf86f2c634c50e64eea7a62d413856608daa8002b1d9fd05c6cffd180da7b48f46b6459e7a
- SSDEEP 49152:UDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS30uOaHBUs+Ped:R3Upow8sBfuvHBt+U
- TLSH T1ECB58C3DA2E810A8C9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH