402b47b2b1c8e892c7f447be3b05f32398c4433e0a1046502870eb01a9259c08

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.6MB
Sample261113-e5hblaf19l
SHA256 402b47b2b1c8e892c7f447be3b05f32398c4433e0a1046502870eb01a9259c08
MD5 4199a95da8507dcff6abd51b8f970c87
SHA1 16ae44d7024c4ed20417f7238940f888f454e875
SHA512 5b742ca0a413df8129add53c3659655a4b6125a7af6b73d0bda64e54fd623901d5af9567616fbf16e11cc96b933bd3d9ac0093bc20d8f3a8d903c5c71cb8db6a
SSDEEP 49152:pm/e/GiwDyzVbp5GeCDLYSpMcyWtrSRUxoouhXYbTh:1voyzVXOLoXWtrSRWoDXY
TLSH
T161C5D031B502C032D6B241719A7CAFAB94ACB6254F7528CBA3C40F6E59245D31E37B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3800	uninst.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	uninst.exe

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	uninst.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	uninst.exe
File opened for modification	C:\Windows\system32\locator.exe	uninst.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	uninst.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	uninst.exe
File opened for modification	C:\Windows\System32\alg.exe	uninst.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	uninst.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	uninst.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	uninst.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	uninst.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	uninst.exe
File opened for modification	C:\Windows\system32\AgentService.exe	uninst.exe
File opened for modification	C:\Windows\system32\wbengine.exe	uninst.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	uninst.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	uninst.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	uninst.exe
File opened for modification	C:\Windows\System32\vds.exe	uninst.exe
File opened for modification	C:\Windows\system32\vssvc.exe	uninst.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	uninst.exe
File opened for modification	C:\Windows\system32\msiexec.exe	uninst.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5700-0-0x0000000000780000-0x0000000000DEC000-memory.dmp	upx
behavioral2/files/0x00030000000170ef-16.dat	upx
behavioral2/memory/5700-34-0x0000000000780000-0x0000000000DEC000-memory.dmp	upx
behavioral2/memory/3800-30-0x00000000008A0000-0x0000000000F0C000-memory.dmp	upx
behavioral2/files/0x000100000000934f-39.dat	upx
behavioral2/files/0x00010000000093de-40.dat	upx
behavioral2/files/0x0001000000009952-41.dat	upx
behavioral2/memory/3800-48-0x00000000008A0000-0x0000000000F0C000-memory.dmp	upx
behavioral2/files/0x000100000001b93c-260.dat	upx
behavioral2/files/0x0001000000009cd6-265.dat	upx
behavioral2/files/0x0001000000009cfe-269.dat	upx
behavioral2/files/0x000300000001a194-273.dat	upx
behavioral2/files/0x000100000000b96b-277.dat	upx
behavioral2/files/0x000100000000df16-281.dat	upx
behavioral2/files/0x0001000000009fd4-285.dat	upx
behavioral2/files/0x0001000000009b92-289.dat	upx
behavioral2/files/0x0001000000006215-293.dat	upx
behavioral2/files/0x000100000000a050-297.dat	upx
behavioral2/files/0x000100000000ba34-301.dat	upx
behavioral2/files/0x000100000000a0ce-305.dat	upx
behavioral2/files/0x000100000000b945-309.dat	upx
behavioral2/files/0x000100000000a1d4-313.dat	upx
behavioral2/files/0x0001000000009396-317.dat	upx
behavioral2/files/0x000100000000a2c1-321.dat	upx
behavioral2/files/0x000100000000a304-325.dat	upx
behavioral2/files/0x000100000000a319-329.dat	upx
behavioral2/files/0x0001000000006223-333.dat	upx
behavioral2/files/0x000100000000bd44-337.dat	upx
behavioral2/files/0x000100000000627a-341.dat	upx
behavioral2/files/0x000100000000a02c-345.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	uninst.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	uninst.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	uninst.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	uninst.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	uninst.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	uninst.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	uninst.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	uninst.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	uninst.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	uninst.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	uninst.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	uninst.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	uninst.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	uninst.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	uninst.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	uninst.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	uninst.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	uninst.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	uninst.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	uninst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	uninst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	uninst.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe
3800	uninst.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5700	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3800	uninst.exe
Token: SeDebugPrivilege	3800	uninst.exe
Token: SeDebugPrivilege	3800	uninst.exe
Token: SeDebugPrivilege	3800	uninst.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5700 wrote to memory of 3800	5700	2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_4199a95da8507dcff6abd51b8f970c87_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Users\Admin\AppData\Local\Temp\uninst.exe
  "C:\Users\Admin\AppData\Local\Temp\uninst.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.9MB
SHA256 2e9f49fce060e6373e7cb0183d8877db7760caa353ab3a0e648362c73943b8d6
MD5 1565a19b77810e1cbdb5ef8c9a216a48
SHA1 9d19ecb0cdb787f2e161cc250fdcbca0bc13f4d7
SHA512 735a60aaed1bbe952b5f23e1e149aeb6623e0a3c3716f60705bec90000564eb46a0133cdf1d366ffa8300c65c3e426fa6221ddffde8b4b15fe25274390f7dfba
SSDEEP 49152:ub+6TyBuPkFKRrdE6oh7stBhuXjfS4LWxnbMcyWtrSRUxoouhXYbTh:wTe6gjBhXWtrSRWoDXY
TLSH
T12CE5AD03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 d9b102c33ee466353de5b8e29ac02b450b3fcde66342abbaece2d4662d4622e1
MD5 670a190bd8d17dc5a4583b7cf43561d8
SHA1 802ff1f42603d27a445bea09c89ca9392bb548fd
SHA512 44d2c3b558fae22ed1aa5c2e7cc8453b2a3c1f2063c9ed1fe5c91203e0f7d3ca5d51d8d8dade683438ac4bb4f481f26540c99563897cbf8d6045b0125e0202e8
SSDEEP 24576:8XYYDHczAq9k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:uHcd6McyWtrSRUxoouhXYbTh
TLSH
T12325022877E108F9ED5B827DCC728912E633B8514374EB9B03E495651F633985E3EB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 998KB
SHA256 3c1218baf729d3e935aa46d12bdf63c3f946ba29df297acccb307ef409e83b78
MD5 581b186dbddeedb9435b7742b3cb136b
SHA1 52de13fab0d7f22c0946f4cd2b445b2469be2d8e
SHA512 2e89a667d7eb42f272c53f4158fe33fae481a0c2d59a01c209f6fcad3b800963ae9710195bb4983487efdd75ee7836a78594cc02446df14ae38c67e2ae714354
SSDEEP 24576:ZwutOWzk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:Zw2OxMcyWtrSRUxoouhXYbTh
TLSH
T10525014976A51CF9EA678639C857C532F7B3B8022624CB1F0760C69B6F73321AD2DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 baeabfa6e7d50603e73a0f5fd32bb3b26631850ddc8083ad7be83dd978500a7e
MD5 2bf63eea1b79c3ff7f952716977467b1
SHA1 0ea1def137e69f78dcf276325dc011f7ea333252
SHA512 73c1fdbbda1c673bf42433f2bba4c8e6368a737165e199131e66aa25750d14dae0e17c7461562a688c5cee5421f6bad53a54398eaa3f56606a975758cfc38440
SSDEEP 49152:Ka+taZ3usBWOBr4tEGp0bqx0z+n217aau1glMMcyWtrSRUxoouhXYbTh:ru6JmTxd2dHXWtrSRWoDXY
TLSH
T16EE5AE13F1DA01E8D05ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.2MB
SHA256 a92c49d09ad101cef30dea25a1bde95f54c28fdde2862272ee92da9cad8daf16
MD5 5d4554d676d9970a3d71c107b07f9246
SHA1 6fda0bdc75668dcba22fea67bf4139fc221760fd
SHA512 c24c07a7528da7f1108a5d43a373440759edeafa12f506f7421917be3b87d3469ae4a4136f521356ecafced875d47d739454c8161e2a4c8faf54970e85b28d99
SSDEEP 24576:Rlwvtk9RX6wkyAI+k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:EMnYIlMcyWtrSRUxoouhXYbTh
TLSH
T1DD45E029EBD844E5E177923C8CB7460AF6B2B8590B31C6CF029A53AD0E37EE45D39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.7MB
SHA256 83de5f62a610a52d400311dccb0c7d9dff8db0b8355c5c935e6b1891ffa982ca
MD5 3bdffe88b54708d8c78eb9bf36dc87f4
SHA1 498a10205e4fdf526ffafafe922ea03c9cce25dd
SHA512 4a267a3b4f11cc979ae366038ed27ee275dc16f8fbf5b41d94eb238c9315d97b484a33a6a7fbbec07ab0bfe391690bfc4e62870ff0201a11246e90b3533ccad0
SSDEEP 49152:1YPLNpsykPC7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01McyWtrSRUxos:gySzPKXWtrSRWoDXY
TLSH
T1E5067D96A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.6MB
SHA256 7e510d5da1f07864ad1e8ccb711e83bd26b7e15e2297aefd518d24ad4d44acb0
MD5 d724dabb2093c87d1c0c81ef9a562ea4
SHA1 3786f6af717f05eb80d00ddc48f80037c3d66a48
SHA512 77582a6d8747da77d614383a230984b38d7f87e3bccd5dd315095d6f0a81edc1c05216d99760c7ef376dddf2100e2f32ee7755a4a203a8cffdd4be7f4d8fd87e
SSDEEP 49152:pJ7JUQjXirIhCnDHUPfF/TMcyWtrSRUxoouhXYbTh:HJtglD0PeXWtrSRWoDXY
TLSH
T10575BE1DA3EC01E5E1BAC27885154A1AEA71742E5B31CACF127083BD6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninst.exe

Path C:\Users\Admin\AppData\Local\Temp\uninst.exe
Size 2.6MB
SHA256 402b47b2b1c8e892c7f447be3b05f32398c4433e0a1046502870eb01a9259c08
MD5 4199a95da8507dcff6abd51b8f970c87
SHA1 16ae44d7024c4ed20417f7238940f888f454e875
SHA512 5b742ca0a413df8129add53c3659655a4b6125a7af6b73d0bda64e54fd623901d5af9567616fbf16e11cc96b933bd3d9ac0093bc20d8f3a8d903c5c71cb8db6a
SSDEEP 49152:pm/e/GiwDyzVbp5GeCDLYSpMcyWtrSRUxoouhXYbTh:1voyzVXOLoXWtrSRWoDXY
TLSH
T161C5D031B502C032D6B241719A7CAFAB94ACB6254F7528CBA3C40F6E59245D31E37B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

451c1f113a35217a.bin

Path C:\Users\Admin\AppData\Roaming\451c1f113a35217a.bin
Size 12KB
SHA256 55003ee0f0bd25e267141d7ba6aa047f152bd9fd69bdc2172cb80c598ce6145b
MD5 c16d615392bc54c96e8b94508a2c0e09
SHA1 1a438f8955d9838c8b940c62e1b3d80d4f629151
SHA512 b46fb5845ffacb4a28b8ede5ee6c422dc1ec662c25e3ee826c7cbdc26df8cacb538bfd9414e07a49a2f99e182ab465b6fdc53f170da377a5785977eb9c5245bb
SSDEEP 192:4vEki8vy5/9GSslffLm2PN9/cm+B5MAWPOZ66ahyz1O3Mt5BKNz9A5EG3oa:4ckhy5VGlSBm+0AWubz1O3y5c45X3oa
TLSH
T1A242CF4B31F98CC725BB9210C76CC92E50D0358ED5766A42ADA18C3E32AE35FBB5D086
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 778KB
SHA256 0fc22a5a72b0ea7b580c6bcb21cf4b513e8480d1e60c5a9e62e25c98ed9b2b7d
MD5 3d588db7c16ee21c7053c7dc9ead8800
SHA1 d9bf32de1eac961a8f0ad856c0eeee393ac7951f
SHA512 589b9674f5368647743e8505f1da68dd7bac0b505d1e4bdcf2e462b45e9349615f076a4f5b60048f3e92f1401af3fa5192f1c60e8c1c75785477e51620d40177
SSDEEP 24576:T0k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:TLMcyWtrSRUxoouhXYbTh
TLSH
T15D052354BAA36C42FA1E8A72883B6D32652BF415C7B4CED7585720C53BF03624D19BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.6MB
SHA256 b6a5a8b43ed1531d2db86a005818ec8f4b83dd545cd0b02e50a5a7a602f728ac
MD5 1bd7b24ea267593aa327a0f46ddc5120
SHA1 9e7d6c7a1c1f96018222313cf033eaa321ebc3b5
SHA512 60e02f9d6eb6a68590c277dc984d6ea56cbec143c14135a80403d0af5b1541b08d865a5eac550ef3e903937d2837225535746581ddfe55aa172206cb66016677
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYFk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYp:ggb4mBIBhGFXMcyWtrSRUxoouhXYbTh
TLSH
T18F75BE1E22E802F5E0FAD2B8CDAA4417D6B378160731D6DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 b5f5dc40527ec1fdb876b135c61bba407f3c237e25f816a3a4771928ff76f072
MD5 de2ad15cc0c86a8e802956f2e4fe8991
SHA1 d9d0bf2a85e2d3e612d1b3674e432cb687387e41
SHA512 671e385e058db2102477bd36be55fe2e2cd59eb7c9ebf5329f023182250584d23e03fd391d876ce4ad730e0fd63fb408cdafc4f7544fc8f34e8733a29147f10e
SSDEEP 24576:XGKFk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:XGKCMcyWtrSRUxoouhXYbTh
TLSH
T1F105232C75F23481D53EC67A883669237872B45183649EFF08E3A0B56BD42F1663DEC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 796KB
SHA256 dd6d2e26dfc03285843d1d6fdd3e7aa488408c24649be5a5177f5dff7d25e4ca
MD5 dc82febf219ebff874d11848d3aee699
SHA1 2993978315bc11d411003625b0f16008acab1675
SHA512 17f8f13705d5efd516052618fe46b56307ca8a2515460c0c7c9a8dbc7a4264e18ebab8df69ec7d759e7a937ae3932ff563fb7918b5a8aee896ffe374142015a3
SSDEEP 24576:z8k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:zTMcyWtrSRUxoouhXYbTh
TLSH
T139052354B9A36882FB0E8A7788276D235927E41683B8CFE3186720C167D43F75539BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.3MB
SHA256 288d5cd1bbd489757e06e91e1a3991ce5bd5f55866a2f6365d9784785767bbe1
MD5 0b48c4560ee7670867918ec8563bd003
SHA1 0a417104dfaee7ce28b6412ab4abb74069a7a500
SHA512 4888a23104d8f27645891534c5b9265864f9b71497a066b138d08171a081e37203bcf79e5b93affd55973701d0be5a347d819b9f45ba42a6c2b1d1890224c95b
SSDEEP 24576:WG88u8FpJqH12zria7/m/k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:97ZFPqVBa7/FMcyWtrSRUxoouhXYbTh
TLSH
T172550165B6E101F1E47BD13889464A63F6B2B4250374EFDF0AA88A911F237E54B3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1000KB
SHA256 0574a89d89872ffcdcde8aed0c73117b8a0e26fc7544502e160ab2a609a0e82b
MD5 d93ad675cf831b3ef5302b36ccfb0c3c
SHA1 e3c773a43a611b1384dc7211837d77c1f1682bf5
SHA512 7b9b329b47d87fbe4a5f73e813df345bd5c25f0fc9a6c4053bf0c8b5ddc78a233b984bc901e2a9cde1676904a4cca586d9702787b09b31199e079e77159a496b
SSDEEP 24576:kPUr+NQFk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:kJQCMcyWtrSRUxoouhXYbTh
TLSH
T13425022E26E91CE5F67AE17D89424709F772B4620311D6CF02E1817E1F63AE8AC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.8MB
SHA256 38409e43e34123c124f5146702f66f970570ac5e641114ec1339bde7c49119a2
MD5 d902c4cb225325dc6f1270b8d35102dd
SHA1 2cf25639b943ec9e28ea6ddb4c3e540e3d320cd2
SHA512 bf5d74fd563f74d146c5ecbe8927815de9725ac818b0ccbf3e65853a0952445063a6746ec6112f01a136cb5fa08fd166be868ea9a5119fbc6f35179d005fc4e4
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnMcyWtrSRUxoouhXI:8G05lO43bbXWtrSRWoDXY
TLSH
T18ED5C06E62EC11F9D1BBC17CD9864A0BEBB23415033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.6MB
SHA256 6caa196f7dca57f976fc4a4d287c827a34053b338d6f6fccb59f24eea07836b4
MD5 8e4241a3e7e0d9723daec79043499f76
SHA1 0d5ebf23219ec7625e7435ef4876f8a29ce47b83
SHA512 b635ac116f695eb44d8a05354368c2c70c60777982a6cd518fbc80b3a56200545adb13de656ebb01c3ff1fa80508656bd4b9071b9ebaf66d67146801bd7be417
SSDEEP 49152:+a5POZ3wJt2pasx2+mZMcyWtrSRUxoouhXYbTh:KUAXWtrSRWoDXY
TLSH
T1DC75CF5DA6F801D5E579D17DC5838A1AF5B2342253319BCB022182BE3F27EF89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.9MB
SHA256 a3d56d4785d3f524ab55a3ceba2430dfc076bd07f9ccf123b87e2083ff07233a
MD5 4e01195c4a4ef0ffa5245d3d9cef7e34
SHA1 fa8d907258e19316c1b7175da33abc6dc1712f9e
SHA512 6c38632840a432021a1a27f428eaec922043346df855636cfe6bd8416e4bd731060a724cfa0e1d2c5785cfa72d15b2ee085438e181fd251e98d0386232e7931c
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkGk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThY:LNc/zEOVHFsMcyWtrSRUxoouhXYbTh
TLSH
T159959D1623E901E4F5BBE1BE89779546FA71786553308ACF0292811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 1.1MB
SHA256 d3192704c79a29de3c0f0294ebda5bf37e35680dcc6e953daa2b32277d74a2b8
MD5 00e036133ff4ffdaa1496a230612e2d4
SHA1 f990ae94dbd4c7562d9d469b1ca5d00d989327c9
SHA512 bb01b44329ed2a93907ad4a1017ef5d54424c455c110e919fc3aec0d2abd67775e63617c66c0e82a95948b52e588062e8f1fbf66159b7d610732295812a2aa5a
SSDEEP 24576:ZD3FHshBIYQgAbk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:ZDVHeBIAAQMcyWtrSRUxoouhXYbTh
TLSH
T14445F13DEA9904E4E57BC1BCC9638A06E77278A903315ACB05D581B61F6BEE42D3DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.1MB
SHA256 c80fb42c27859b8333dd533221f99f87680d1eb08d6695c1355cd0e0fa717f9d
MD5 dd41fa870bf7af19243bc3992939caa2
SHA1 551dc3778e05664ee297fa6b38c6b20d7f51cc0b
SHA512 8ea4618e12c8c375165abb86fe2f801d9af9e83900a7182cb03f2b190b2e84bb957122c4bfb350365c2c7cc94193b504a1610700d3f22ea4e72daed37f814567
SSDEEP 24576:KJnJPbzB4SCk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:KJnJv6SRMcyWtrSRUxoouhXYbTh
TLSH
T1FD35F13CD2A810E8E4B7C2B4811A1B56FF32386D2B2569C719B5D4343F52FE0A939F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.2MB
SHA256 863fbea7f038e062642482c0353745428cf6b198659ff2bc1b7718f7dba21d6b
MD5 af7236c00fcc770b72dc1c61348d92a1
SHA1 588b41989552115a81548c0e7adfc878697cdc10
SHA512 67c06098b4e005d750e1633dc8f0fe2693f51727e43a697e0a1822af57f4c8788b2a5797f174028259b618e06329d8b3868dac3ad24accc2d86c9ff3d327d18c
SSDEEP 49152:KCLHGeeV5ijCmlDWDkMMcyWtrSRUxoouhXYbTh:R1XWtrSRWoDXY
TLSH
T18EA57C05A7EB5184F8F3CAF5C92294169A327C549B34F7EF4E80C96A2E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 992e1cbf6d9b2bb7b70e380ea120f28883b5ab329ef981e7c72bacc058fc6571
MD5 9a7dc1e21b6dcf61db4e72e827f17a5b
SHA1 3998364e2d7b79634d51d2d14c9810e08d042095
SHA512 a50601dd25f5abe81d35de41dd8cd200a82a090e1e8ebb6621079b6b88c7f8785321fc95c94f409d69280d3761b38a7720b24eca0db08e6a666f287448353001
SSDEEP 24576:2TDIVk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:2TDISMcyWtrSRUxoouhXYbTh
TLSH
T18125025C73B610F6E16BC03EC5530912D2B2B07183659ADF0A9584B95FE3ED9B93CE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 d9fe3bef29162ceb713114ca59821da46ef7ce8a648fc97d424d5528d5538c1a
MD5 be1146c7516b16bee0277bfe7fa9cc8c
SHA1 39f37293a094980e80a145f1378f828a74684e4d
SHA512 93d87261fd4a7b237a3f2c7e3c7140ad83d4dc2881b4ace29a19db74fa4f6b38632810cad8000b8b03ba853f8279e20bfafad0ee35a4bb917e9bcd8d2b99412b
SSDEEP 24576:Ity0k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:It+McyWtrSRUxoouhXYbTh
TLSH
T1AD152304A7A164C1FA6E4679CC3345619E36FC108770CBDF14A2A26E2FB13E5A935F87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 940KB
SHA256 560e7c663449c9cfe9f6c5ac67e3e6acfcb9293060d2af2e93724656f8ebb619
MD5 7730de7367af296e8ddbb8c24aa582af
SHA1 f04fd92b2fe17b706a3f7b7c9ca0f827caf8bdea
SHA512 5063398b5c28e74ce0caee4f7679546168f44f54388f5803c79568bf96c779b79be41b9c7b2aeeccac03748fcf5b009f659f39e1e8ceeb138f2b68f8ab517c68
SSDEEP 24576:S6Uqjp2k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:S6UyMcyWtrSRUxoouhXYbTh
TLSH
T13525235C66E128D5F53E8634D83685228572FC3203B49EEF24DA91BA8F717E1853EF42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 b1a2f9bf9b86a0714eb7896807627fba7dfbca4f8b200fd1f192c744a8fadfd0
MD5 5da0bbd61655a4bffb8fffac7bfe747f
SHA1 f144ba586296fc48a4a3b3f5b7d862c2c3863094
SHA512 ee6bf910b4e5a43279b79e5f03f5e09c34c286f7d146e58e2db8ffa1d6c7119d324c0decddeeb80425a23e1b98bb25a236c7a489fe4dc4bcd639bd118ad18b1c
SSDEEP 24576:HOk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:H1McyWtrSRUxoouhXYbTh
TLSH
T18C052358BAA33882EA0D8A7648371D135537F42183B4CFEB18A750E56BE43E25539FC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 92c8580def15d8da6a96efb95e491291594147b28c7a6bc0d87c43b4c57a7cd1
MD5 75d80771c85450ffd09c0d99bd2f6032
SHA1 02e57de33a1bf95140f7a3c74500df716971f3bd
SHA512 e9313503ac7f997b6bdbb4e7a9b921b8ad33a051570bdc4cd3eaf5d2e7aee715bc8bc07b01c813ab880f6f7487c45e7cad15d4ab9f4531b4c9de3e22dce1bce7
SSDEEP 24576:CJgv4oTfaidZHk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:agFTrZEMcyWtrSRUxoouhXYbTh
TLSH
T1D665AD1DB7EA09CAE2B2D675D8321493D633B4315772C6DF2448C03A4DAAED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 964KB
SHA256 912f70f7e8f0e42423dde9b5200c5ed8f2afd04ecddf15c458c9d07a47cf1126
MD5 0bcfb9f69679a8c31db51daaa3aed8d7
SHA1 76847b61dccd826e3c9a477af91fcb021bb8411c
SHA512 e7470c8da1c24a06fc8fe1bcf0329a7cfb4ab83ecf2f5308b0179c1ad37284c825bf47090b5dcb3c4cf0863adf93cb2d7525f055299bf794879fe8a0d66bc287
SSDEEP 24576:arcmR6k7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:ccmRpMcyWtrSRUxoouhXYbTh
TLSH
T1AF25014EB6AB00E2E17BC17CCC424512E6B3B03153619BDF05A287BD5E976EA7D38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.2MB
SHA256 88ac1f71bbdac66fca932eea47936bb940c27b998280120b162b103c677e70c9
MD5 70e6bea7ddc2b7c1e061530b24bf7deb
SHA1 cccd705ea4ba3b93add52099d5f3f66b7e18804d
SHA512 1a92678abfe5c6db17f5252c56aac96c70dde64a48768f7c300744532745a3ba90e73ed95643cde30f9409b5fda2bc003d86c5f59bea2edd0935c5f84a022a79
SSDEEP 49152:4DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3IMcyWtrSRUxoouhXYbTh:l3Upow8sBAXWtrSRWoDXY
TLSH
T178B59D3DA2E810A8D9AAC379C44213A6EA71742D3F3055DB0174C1B8BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 15cbc458232588177304d9722753dca9d3a6509a8e4369fbfd0e58739c5abb11
MD5 6223055c1729f13558227ead6e3f2b09
SHA1 baff9f0425c2bf7ec592e26edc055cfe332564d0
SHA512 17229a88ddf909d07c3fc19a95ab705f41b16c20728c4bd62eb0833edd30342860e3cf6ca759377472f1df20ae5492a3ba2776254764a7dbfb0bcc1748eca23a
SSDEEP 24576:kTkNvNnaFeYhJNtmZBmZk7a9cqz9lzStrSB2sF3j1ZUMpSIhN16kThXYbg1Gh:kTMwBtOmeMcyWtrSRUxoouhXYbTh
TLSH
T19C75B06EBAF805E4E1FEC6B5CD238512EA727461073293CB5290C13E1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3800-32-0x0000000002CA0000-0x0000000002D25000-memory.dmp

Download

memory/3800-25-0x0000000002CA0000-0x0000000002D25000-memory.dmp

Download

memory/3800-30-0x00000000008A0000-0x0000000000F0C000-memory.dmp

Download

memory/3800-31-0x0000000002CA0000-0x0000000002D25000-memory.dmp

Download

memory/3800-48-0x00000000008A0000-0x0000000000F0C000-memory.dmp

Download

memory/5700-34-0x0000000000780000-0x0000000000DEC000-memory.dmp

Download

memory/5700-7-0x0000000003190000-0x0000000003215000-memory.dmp

Download

memory/5700-0-0x0000000000780000-0x0000000000DEC000-memory.dmp

Download

memory/5700-6-0x0000000003190000-0x0000000003215000-memory.dmp

Download

memory/5700-1-0x0000000003190000-0x0000000003215000-memory.dmp

Download