402b47b2b1c8e892c7f447be3b05f32398c4433e0a1046502870eb01a9259c08

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.6MB
Sample261113-e5hblaf19l
SHA256 402b47b2b1c8e892c7f447be3b05f32398c4433e0a1046502870eb01a9259c08
MD5 4199a95da8507dcff6abd51b8f970c87
SHA1 16ae44d7024c4ed20417f7238940f888f454e875
SHA512 5b742ca0a413df8129add53c3659655a4b6125a7af6b73d0bda64e54fd623901d5af9567616fbf16e11cc96b933bd3d9ac0093bc20d8f3a8d903c5c71cb8db6a
SSDEEP 49152:pm/e/GiwDyzVbp5GeCDLYSpMcyWtrSRUxoouhXYbTh:1voyzVXOLoXWtrSRWoDXY
TLSH
T161C5D031B502C032D6B241719A7CAFAB94ACB6254F7528CBA3C40F6E59245D31E37B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe

Executes dropped EXE 1 IoCs

pid	Process
2648	uninst.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	uninst.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	uninst.exe
File opened for modification	C:\Windows\system32\msiexec.exe	uninst.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	uninst.exe
File opened for modification	C:\Windows\System32\alg.exe	uninst.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	uninst.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	uninst.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	uninst.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	uninst.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	uninst.exe
File opened for modification	C:\Windows\System32\vds.exe	uninst.exe
File opened for modification	C:\Windows\system32\vssvc.exe	uninst.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	uninst.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	uninst.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	uninst.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	uninst.exe
File opened for modification	C:\Windows\system32\locator.exe	uninst.exe
File opened for modification	C:\Windows\system32\spectrum.exe	uninst.exe
File opened for modification	C:\Windows\system32\wbengine.exe	uninst.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	uninst.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	uninst.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	uninst.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4068-6-0x0000000000810000-0x0000000000E7C000-memory.dmp	upx
behavioral1/files/0x0007000000024430-15.dat	upx
behavioral1/memory/2648-33-0x00000000005E0000-0x0000000000C4C000-memory.dmp	upx
behavioral1/memory/4068-34-0x0000000000810000-0x0000000000E7C000-memory.dmp	upx
behavioral1/files/0x000100000001700c-39.dat	upx
behavioral1/files/0x0001000000017049-40.dat	upx
behavioral1/files/0x0001000000017bd2-41.dat	upx
behavioral1/memory/2648-48-0x00000000005E0000-0x0000000000C4C000-memory.dmp	upx
behavioral1/files/0x000100000001742f-245.dat	upx
behavioral1/files/0x00010000000232cf-257.dat	upx
behavioral1/files/0x000100000000c516-262.dat	upx
behavioral1/files/0x000100000000c537-266.dat	upx
behavioral1/files/0x0002000000021aee-270.dat	upx
behavioral1/files/0x0001000000017ec6-274.dat	upx
behavioral1/files/0x000100000000fa68-278.dat	upx
behavioral1/files/0x000100000000c3fe-282.dat	upx
behavioral1/files/0x00010000000177ee-286.dat	upx
behavioral1/files/0x0001000000017814-290.dat	upx
behavioral1/files/0x000100000000c8e0-294.dat	upx
behavioral1/files/0x0001000000017852-298.dat	upx
behavioral1/files/0x0001000000017ec0-302.dat	upx
behavioral1/files/0x00010000000178cc-306.dat	upx
behavioral1/files/0x0001000000017037-310.dat	upx
behavioral1/files/0x000100000001797b-314.dat	upx
behavioral1/files/0x000100000001799a-318.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	uninst.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	uninst.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	uninst.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	uninst.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	uninst.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	uninst.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	uninst.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	uninst.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	uninst.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	uninst.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	uninst.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	uninst.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	uninst.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	uninst.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	uninst.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	uninst.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	uninst.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	uninst.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	uninst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	uninst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	uninst.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninst.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe
2648	uninst.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4068	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2648	uninst.exe
Token: SeDebugPrivilege	2648	uninst.exe
Token: SeDebugPrivilege	2648	uninst.exe
Token: SeDebugPrivilege	2648	uninst.exe
Token: SeDebugPrivilege	2648	uninst.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2648	4068	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\uninst.exe
  "C:\Users\Admin\AppData\Local\Temp\uninst.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.9MB
SHA256 e501cbd4a7aa5afd5750242dd144a6592b8ef0d72ed6e76bc2096f1fd785e63f
MD5 e22a19f25560a17e877051dd8d2b51b5
SHA1 73d70aa82e78b638fa98ad645e179a4e3857a76a
SHA512 a8cab833993a7f951c7ee5d039aee5cc3bedbf33943d3183c0fe76335ecebe304a580c6c2b15fc4709dd48f49ff96ec7c0b5f677ca0bc3855302f0aa1179a6ac
SSDEEP 49152:ub+6TyBuPkFKRrdE6oh7stBhuXjfS4LWxnlMcyWtrSRUxoouhXYbTh:wTe6gjBDXWtrSRWoDXY
TLSH
T116E5AD03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 3c69c0952b23855e02033bc218014d3230c4b24ef4040aa8fe85a3b4099e6745
MD5 7c9928da6328a49dacef6713f669c3e6
SHA1 5002bc9c78d7ce13431c4879d370740fec358e58
SHA512 81689f64cb9382621048cdb9d51c0515dd0c7c28e11d60237669d8a9e3a7982a4c46e101ca1a5bd9e294c48a6b53c9a2e8d94b491bb0aac2e23e0054dd911a8e
SSDEEP 24576:8XYYDHczAOEk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:uHc3bMcyWtrSRUxoouhXYbTh
TLSH
T15425022877E108F9ED57827DCC728912EA33B8514374EB9B03E495651F633985E3EB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 998KB
SHA256 7fcb10abf60d9f8e8a3e302d04d29d8be834800ed07112f4d768bbe5e52f1c9a
MD5 6f5ce9e7e9ceef1c3ab46c6f069cab82
SHA1 2052f2714480e25bd6d8030b91a57996d93cb7f1
SHA512 1df2ceeb99665d86de22dd55c26c01fc7682a6b32791b50ce49435c7a3ea1c4ad8b9d3c39d1b841626528c5c6cc82fa6bfb73bba599ee0913a8edcac99ae8c72
SSDEEP 24576:ZwutOWlk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:Zw2OfMcyWtrSRUxoouhXYbTh
TLSH
T1A325014976A51CF9EA678639C8578532F7B3B8022634CB1F0760C69B6F73321AD2DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 9a68e051c91bd8667ed012dd23a482119431b3d10ab7ecbb5bd726996adf2329
MD5 0d7e189283cfcd5ba976247a86414f64
SHA1 b0a1e9a021a0152ecb0909fa3b4145e9e32f5edb
SHA512 c7083c0b145f8d7b8d19d77324fcd8fd75a0b6ba2ebe772f9f6182912ecf4e941a8936f4db342cdba94a6068c71e04fd60c1f1b690ecd952924557696debc95b
SSDEEP 49152:Ka+taZ3usBWOBr4tEGp0bqx0z+n217aau1glGMcyWtrSRUxoouhXYbTh:ru6JmTxd2dhXWtrSRWoDXY
TLSH
T1D3E5AE13F1DA01E8D05ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninst.exe

Path C:\Users\Admin\AppData\Local\Temp\uninst.exe
Size 2.6MB
SHA256 402b47b2b1c8e892c7f447be3b05f32398c4433e0a1046502870eb01a9259c08
MD5 4199a95da8507dcff6abd51b8f970c87
SHA1 16ae44d7024c4ed20417f7238940f888f454e875
SHA512 5b742ca0a413df8129add53c3659655a4b6125a7af6b73d0bda64e54fd623901d5af9567616fbf16e11cc96b933bd3d9ac0093bc20d8f3a8d903c5c71cb8db6a
SSDEEP 49152:pm/e/GiwDyzVbp5GeCDLYSpMcyWtrSRUxoouhXYbTh:1voyzVXOLoXWtrSRWoDXY
TLSH
T161C5D031B502C032D6B241719A7CAFAB94ACB6254F7528CBA3C40F6E59245D31E37B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a01b26959b11239b.bin

Path C:\Users\Admin\AppData\Roaming\a01b26959b11239b.bin
Size 12KB
SHA256 d7df5cfe6bbf6b1385929bbe375cf8004b9a6f2a51479ff43b36d8a9a20d639f
MD5 52ffe2427a96282f195328acb777f23f
SHA1 aa98c7ecebd321ea0cd0f33907985e377c807c6f
SHA512 b8105dbcd798a81f67ba9956df39e6c20ae0537ec398ef87fc34b973c537a819247ab1a737a7a7fe99f2ae4e389f21f16db5add7656a6602d7f3dcb16c02e8b3
SSDEEP 192:kWa/pDvrUB8ouFIMSlCnGeQqKGrvpKn7ZI2wON/GhATAKPgQBwEmbD:qvoOouSMS6G5mrvQ9P/GkD4gQD
TLSH
T19742DF6A19BD321EBCC27EBDCEBC35604DA0D0906B534689A1B12E1DA53E582303C136
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 778KB
SHA256 1a634a3f740028ffa4366052ab07657c1ca83d42dcdca4d17dd9fe83707cf421
MD5 927dd8df0b2721f85e25bfb26e7999e2
SHA1 2cef4ff6dfd1b0b42fe814635bf513c2be210935
SHA512 3c1862089bb3ea7604627eb4c8c9b779c68d08a09725defef4dd8901fc476f6fd8610ed22bfbdef31a64a928e028af86ef1a0022deda6e9d0e49ec8117542f23
SSDEEP 24576:LJk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:LOMcyWtrSRUxoouhXYbTh
TLSH
T1C5052314FAA66843F65E8A7288375D32253BF415C6B8CED6285720C53BE03738D19BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.9MB
SHA256 f04299189a01d2a172237e2c77e9faa6f7cd4c508c014dd557ceff9b163d967a
MD5 560ca9fb7d54694eab08768dc926d167
SHA1 690493afa73ebca4f5d647dc80dd934c56896473
SHA512 70438658913835e6216cff08bc44db00eca4cf89689593b051c8deab9cc55190a63042b1026676038e51b16c771aaca27aa4030506023b032b55af7654317105
SSDEEP 49152:xa0h2GEkuAe73q3ppt6zwwQAMcyWtrSRUxoouhXYbTh:xa0hNYGtJw+XWtrSRWoDXY
TLSH
T1E495BF1D67EC82B5D0BAD278C9A6854BE6B2B4220B3156CF1151853D3F37EE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.4MB
SHA256 2deedbb4c566c3b0573ab756c27039073f2a8c96e031abce082f9b2c23d07fdc
MD5 1c5ab6edee8f8591b5b3284d26c71fb9
SHA1 60004dcf2928b251ab65a075d0a1190f96ccfe4d
SHA512 04a3ae15246f8d49041e46a1e29ad7d00152c45a524e3f10c92fb343c14f955a025b9e5e1855abb862226a88097a850ba7630af39c8a355a287c7753cd8c2375
SSDEEP 24576:IV4gkjcRTk4yti+R5dUR/vk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:IOgkITk46pUR/MMcyWtrSRUxoouhXYbl
TLSH
T17765C02DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF16EE85E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 768KB
SHA256 0b9cb993f2a9b09485365377a78f35aaab580f24e2037da93fcda565c07d09da
MD5 4b5153cfdec42974b7387c10bb4f8a67
SHA1 3a914a993155a30252b18d13dc94aa6933ca27cd
SHA512 376c350a15ab8b8032b6c390e13f03ca8ff8b49171b816edccfe898d622c0639c7d90a074a68f325c69e877d8bb80642bd800e820341dc519fb93e342b0484f8
SSDEEP 12288:hC2k7gr+GPKsFX5WiXz9e4dCjikpt/i62hSENQERFx9jxDZiFMpSIEwN16kTVDXP:hBk7a9cqz9lzStrSB2sF3j1ZUMpSIhNs
TLSH
T1F2F42358BAA36843FB0E8AB78C276D235527E40681B8CFE51CA720D53BD43375919BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0f9bf5a5ce18b9af7e3b1aeac907f524c6a4b811511d022c80a205d32927591c
MD5 5a0ece87c3311c1510f0d4fd49f138bc
SHA1 2c4d57a52a93147f96c6c7d792e099c6a85abb78
SHA512 296dc471af7bbc26e2bd5bca133a27551ea15bbf4a7c905ff44b836804597cd33572942bfd803f7cd3484ea54c1741bb40dba5e7aeeb43315afd15f7ccc6cf70
SSDEEP 24576:cxLBUT/k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:cxLBUoMcyWtrSRUxoouhXYbTh
TLSH
T1C3350154F7A500F5E96BC23DC8678A12E272B45D0364EBDF03A94AA51F533E24E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 861KB
SHA256 c4392777882d11f2a572aafb8d73ebe8575c58449f438c0f67315205c2a23154
MD5 8f46a617392ffe1fcbed218c6147ae67
SHA1 481aa945b35f580a21ac4d2c1449b9b00f8f4a78
SHA512 e5c316bbc6e7ef14b37a389b0dd586f5ae14ce2808807deafdc3813c350aae45f576aedda4f9236a5cc0f427a1b5b1c798b3ce89111b0e42779d8bac458d76b4
SSDEEP 24576:WO7k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:WOwMcyWtrSRUxoouhXYbTh
TLSH
T19C15121836ED20D5E57A913D8853560AD372F85647219BEF05D180BE1FE3BF85C3AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.9MB
SHA256 b2e941932d42d0ba824a48c84cb8178263f26a6b478aff278061e6134181085e
MD5 370c0c1ee58835ec99eaa2778bdb9969
SHA1 53eba40e174c958ac471ed69bc430d903e9a40c4
SHA512 447f25815bfa899877228a4cdd30274e337e880c31d1fcdcadec6904516fc0b9bca66c6f549d66343f7b48e7122098f10974e3bf28dae5e674fc4bb66361ca43
SSDEEP 49152:oF2YuHNETovIvNYf8kmUMcyWtrSRUxoouhXYbTh:t6ZCf8kmXWtrSRWoDXY
TLSH
T118959F6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\SgrmBroker.exe
Size 1.0MB
SHA256 091c3e5a81259b31795b820adb2098cb6918e1308d3510a33e3660b0b7613b58
MD5 a61e8cf22c6764fdd26585f58ea586fe
SHA1 12dba1cceb9a10c00d6bde2310f2164f76f325e3
SHA512 92c1d15ed82a2a7785bce980983fc31a6a8b2735020989a3d8722feb210ee3aad4a4d2a3cce4f1db7adf97fd52a65470ba00e42ef06baa7d43311986e6cd1445
SSDEEP 24576:WTMdOz0FFS+HmSLPk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:y0K+HmSLsMcyWtrSRUxoouhXYbTh
TLSH
T13035F13DA3AD14E5E53BC27DD9138906E67374620321AADB06A1C0B93F97FE43939B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.6MB
SHA256 9c36c7a1ef0c2a1911395230e3c850208cf4c85d7b0f7c726bd310080b61ee0f
MD5 f34c65085d4323da4c0166a3d85e314c
SHA1 e8aa32c2dbbba025e6cb19b5cb5d4078f5ddbeda
SHA512 c5342691181ab7306ef1e50846158e10eff206ed330020832ed5aea228c9a714b6b2cd8ba8a07da40353482426fe10ac4854106f5765ec72bcf0b6b917596e9b
SSDEEP 24576:gAFs06+OmlfzNXEbTo9k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:1Fs060lBXudMcyWtrSRUxoouhXYbTh
TLSH
T1BD75CF2F66EC00D5E07ED17E8997C91AF6B1746303255ACB0160867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.1MB
SHA256 6d85766c7749793b2e8759789b63b55208929fcda229520eff0d743b064dff8f
MD5 09031478e734968a73d343a41fbe5cde
SHA1 50188dab2a763de07dc059465ffe7c60840200ff
SHA512 2cac30881301e3472d042f8cdfec8a570f9c2b7148230ed2f72ac357cdf66ba8f41abf7e9d3573cb9f952e45129c89b4789b3700552b33543d018ff74de4133b
SSDEEP 24576:LJnJ5D3W2/k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:LJnJ5DG2cMcyWtrSRUxoouhXYbTh
TLSH
T1F635E12CD2A810E4E4B7C2B4815A1B56FE72343D2B22AEC728B4D5353F12FE09979F45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.1MB
SHA256 90a22809440c9be0316e76969c37b771e44ed1f11406b65b6eafebba0971fcc4
MD5 50595e24eebbc660726e66dfc4f7145c
SHA1 023e3d4976363aadd673a4fa5483101ada4da7e4
SHA512 f7d9511869fabbc8b00263d5cd2f266a2a6e11b96f1c4d01ede0690c5da375b24e4fafb3dc65749311f61ea79e52d626a4c5dd2e2a5baf1be9b4dd9150c0f9d4
SSDEEP 49152:wF06DIKdwc+eQnSt65aVJMcyWtrSRUxoouhXYbTh:E0XWtrSRWoDXY
TLSH
T1C7A57D15B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 e143c083162e3ae164839c7daee9eaf772c5c1cbe968043679dae4cfad4c2185
MD5 b9212b4317f12970f1848d1ceb0f63bc
SHA1 77abf33147194cbaf8871099159f1fc738a54b0d
SHA512 6a1adeb3b172453f1bbea52c655f1c3cd3514db3acfc4c1341c4346810b873f455905df3f1f91064c8d4a67d7efaf48c9f615003a462aa8bb36aa3e0a02138b4
SSDEEP 24576:WiOk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:Wi1McyWtrSRUxoouhXYbTh
TLSH
T12805126C7BAD70D6E12A817E84628A02D373F06147615BEF05A3817D4FA26F61D3DF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 902KB
SHA256 74e76b6107184dfb56b10f1587d3af40ce54164c6a084aff6932ab5507045524
MD5 ee800da38e02b27621c7a50c7e95060d
SHA1 6721a79dae90ea82b929e2e2f1d3d3ed852fd418
SHA512 3b5c1e3e656f33b35226ef5d15abdf957d6544fe0a5b0dbc37358aa72e92a2371f6ba8ef25acd35c2eab189194062f836e9013978ff7e1f3a20f13a72318bead
SSDEEP 24576:iIy3k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:iIlMcyWtrSRUxoouhXYbTh
TLSH
T16C15230477A56481F66A4639C83345619A32FC218B34CBEF1492B17E6FB27E5AC34F87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 825KB
SHA256 22043b69df71fd000ad10d5a89a576112e27903f0bb732c6978d36ffe9467ddc
MD5 ccff95eb42732bd1c54f87f7e428f33f
SHA1 0afa32cea647178bee405de8422ba6ef730ec177
SHA512 f17e02eb1bd4951638bde9d74ebf9155e15b609085c21b7e2ecccdcbb6b4c66c8061b7bd4ccb5fa718e83c741014fdfd6917f6de863701708a020e8f6c5258a8
SSDEEP 24576:FIk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:FXMcyWtrSRUxoouhXYbTh
TLSH
T1B005220C67E534C1F5268676883719129632F82643749FFF28E2D4BA5FB23E58939B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 773KB
SHA256 671a85f81e9f31098fe5ab951130c90c68927c0268bb52e33e96a95659b6c429
MD5 d4222ad53905f910438a6c4e86836d05
SHA1 4572b1d7b4981b6f22f115329ec05b82ea170924
SHA512 087245c6035b4f2879d1886da087baab890292860ba10ac36fa8acafc8e8b4c6a8a2368b5e074d5a9b9d5b7dc7b9b1f583d8032c6de227c16950c7ce1528b4fe
SSDEEP 24576:l5k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:l+McyWtrSRUxoouhXYbTh
TLSH
T142F4235CBAA33842FA0A8A7688372D125533F4158278DEFB18E760F16BE03675519FC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 145af0c08a1b3133b2d79045614e540382915315c029819886acd35951a0be82
MD5 26bc36c5f4859f64f2cd4a0ed8920f97
SHA1 32de4872bb1b2a6e98b067e0e6cc3cb8a2f6cdfa
SHA512 5e09b16e9120cca7b418b93d0bd5bea4da5e1a24a9bd5bfe777cf4c00283fc043ebb6666958ccbdb3f050c376aacc48882ce4a5962966db19b7e6aa8c5c16ead
SSDEEP 24576:8Q9MxZKdcz9ew3kk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:8VKi7McyWtrSRUxoouhXYbTh
TLSH
T1BD659E2DABE9058AE177C275D4A250C3A633B4311B35D6CF2449D03D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 e39f9b4b17bf90bc62e109e0058852de79172fe30929f187ed0b0dc9c888ce6f
MD5 48e6c3053e21696c9b1fa51e1553ef5c
SHA1 9ab62d84204475a7e3c0af2ad89c06b035b05752
SHA512 f83e20b5c7d3f6ff3194d893be4853b3ee7de533f8927835b2f70be4f76179c131026f1059e2afe72faf4ae7c6c7a3695db50b5ef2fec41e5cd741182f5f55f8
SSDEEP 24576:k1QT7EcpfxR+N5AWAz3ooiYhjMqb8k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThY:ZTDxR+N5YzTTjMYMcyWtrSRUxoouhXYp
TLSH
T1E575D12EA7F915E9E17EC5798A23C512FA727821033193CB42A0C17E1F6B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 849KB
SHA256 0547e5517480761679257a5d3fbc8814a19a0c645068a0ccedd8d66bb010c2f7
MD5 616fc97bf5d6dab845d4659af524edc9
SHA1 088e7688bed2b2ac7dd03e42ecf5f46d1fb09d96
SHA512 c89bf9d368a35d9f5bfca45fdcc5874720db333bb73c82859be25a36e533a6119de514ded4fdaecfa69e1e86f10d15de6ff24cd9cf5d5c91ab731de8308d1f0a
SSDEEP 24576:8hbHjPBk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:8hbHjOMcyWtrSRUxoouhXYbTh
TLSH
T11E05127C26AD20C5F676D27E88664907D732F8260320DBEF16D341B91F66AE54C39F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2648-33-0x00000000005E0000-0x0000000000C4C000-memory.dmp

Download

memory/2648-25-0x0000000002900000-0x0000000002985000-memory.dmp

Download

memory/2648-31-0x0000000002900000-0x0000000002985000-memory.dmp

Download

memory/2648-48-0x00000000005E0000-0x0000000000C4C000-memory.dmp

Download

memory/4068-6-0x0000000000810000-0x0000000000E7C000-memory.dmp

Download

memory/4068-5-0x00000000030F0000-0x0000000003175000-memory.dmp

Download

memory/4068-1-0x00000000030F0000-0x0000000003175000-memory.dmp

Download

memory/4068-34-0x0000000000810000-0x0000000000E7C000-memory.dmp

Download