Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 06:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Resource
win11-20260130-en
windows11-21h2-x64
24 signatures
150 seconds
General
- Target 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
- Size 10.0MB
- Sample260417-hex6xagy4n
- SHA256 9817989db478807b67e4455c5e3a9301883b669885e1e6e6751538e2bd5469d7
- MD5 847ced11b536dd7294adb21a51dec10c
- SHA1 4c35baf630187a86452df8a7e07dda5e2b315fb5
- SHA512 1f9de53d449871494c1de199091fb5bf78145f8069d8663473d446498d68f9074cd0be1e92bf8c77fb34310910436aa81076c0246e677f06df3c3cd990494c22
- SSDEEP 196608:odAiJX9lb9+RO4ERBGZNIbwAFUPz9RBDPmO7sT6p:oT9l+ZebwAFU5eis
- TLSH T128B6CF22F940C031E9C202B2A6BDAFB65D7C99340B7854C767C45DB959305E33B3AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 5 IoCs
resource yara_rule behavioral1/memory/2412-11-0x0000000000400000-0x0000000001017000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2412-78-0x0000000000400000-0x0000000001017000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/files/0x000700000002454e-370.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/files/0x0007000000024d36-415.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2412-577-0x0000000000400000-0x0000000001017000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Executes dropped EXE 23 IoCs
pid Process 3276 alg.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 768 fxssvc.exe 4896 elevation_service.exe 5048 elevation_service.exe 4444 maintenanceservice.exe 4560 msdtc.exe 4068 OSE.EXE 4720 PerceptionSimulationService.exe 748 perfhost.exe 1128 locator.exe 436 SensorDataService.exe 3936 snmptrap.exe 2216 spectrum.exe 4428 ssh-agent.exe 4176 TieringEngineService.exe 3284 AgentService.exe 3068 vds.exe 2644 vssvc.exe 4660 wbengine.exe 544 WmiApSrv.exe 3648 SearchIndexer.exe 2984 RobloxPlayerBeta.exe - Loads dropped DLL 1 IoCs
pid Process 2984 RobloxPlayerBeta.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\system32\vssvc.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\vds.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\fdf297d5b6a01835.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2984 RobloxPlayerBeta.exe 2984 RobloxPlayerBeta.exe 2984 RobloxPlayerBeta.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93281\javaw.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\avatar\defaultShirt.rbxm 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarEditorImages\Stretch\gr-tail.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Gear.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted60.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\RedSpeakerLight\Unmuted0.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VR\recenter.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\Controls\DesignSystem\ButtonSelect.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\PurchasePrompt\SingleButtonDown.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\configs\DateTimeLocaleConfigs\zh-cjv.json 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_4.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\ic-blue-dot.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\DarkThemeLoadingCircle.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\transformTwentyTwoDegrees.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\NotoSansKhmerUI-Regular.ttf 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\graphic\gr-add.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\MicLight\Connecting.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\AvatarExperience\PPEWidgetBackgroundLightTheme.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaDiscussions\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio-12x12.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\scroll-top.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DefaultController\ButtonSelect.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\PlayStationController\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\PlayerList\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\ExternalSite\facebook.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\9-slice\hello-button.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\graphic\add_friends_graphics_x3.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChatV2\common_search.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\ButtonR1.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\LoadingScreen\BackgroundLight.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\PurchasePrompt\RightButton.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Settings\LeaveGame\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Settings\Players\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VR\notifier_glow.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\families\Nunito.json 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\grid2.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\graphic\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\ButtonL2.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\PlayStationController\ButtonL1.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7ceb20f35cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051e4ba0f35cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c333d1035cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073743a1035cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0ae151035cedc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000848c8c1035cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000782af70f35cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000937f191035cedc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-9d412f44a6fe4081" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-9d412f44a6fe4081" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-4e426689616b482d" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2984 RobloxPlayerBeta.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4416 DiagnosticsHub.StandardCollector.Service.exe 4896 elevation_service.exe 4896 elevation_service.exe 4896 elevation_service.exe 4896 elevation_service.exe 4896 elevation_service.exe 4896 elevation_service.exe 4896 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeAuditPrivilege 768 fxssvc.exe Token: SeRestorePrivilege 4176 TieringEngineService.exe Token: SeManageVolumePrivilege 4176 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3284 AgentService.exe Token: SeBackupPrivilege 2644 vssvc.exe Token: SeRestorePrivilege 2644 vssvc.exe Token: SeAuditPrivilege 2644 vssvc.exe Token: SeBackupPrivilege 4660 wbengine.exe Token: SeRestorePrivilege 4660 wbengine.exe Token: SeSecurityPrivilege 4660 wbengine.exe Token: 33 3648 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3648 SearchIndexer.exe Token: SeDebugPrivilege 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 4416 DiagnosticsHub.StandardCollector.Service.exe Token: SeDebugPrivilege 4896 elevation_service.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3648 wrote to memory of 404 3648 SearchIndexer.exe 111 PID 3648 wrote to memory of 3284 3648 SearchIndexer.exe 112 PID 2412 wrote to memory of 2984 2412 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 115 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 24122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2984
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:3276
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4520
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:768
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5048
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4444
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4560
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4068
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4720
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:748
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1128
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:436
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3936
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2216
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4428
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2760
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3284
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3068
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:544
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:404
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:3284
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 1f198e6371296a308d8892fe190a94bef82670c7e18487c25a5bf4ef2641e91b
- MD5 ad1489fbb0107ba19fa8ddc9d9a7f012
- SHA1 5adb2db6fec172a4776b77c96e301897c0b4bbb0
- SHA512 180ecd7f2a81e2b088bc73eee82fdd14dad12d4bee9ea53a7b555a97202d3203971275ef5084f85930cf3c8179239f37852e228b04d83f802343f2bf293cb515
- SSDEEP 49152:eb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnyb5+Pl6bJTIZ5jdgp:g3q6mjBZslgJTIZ5Bgp
- TLSH T1F3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 c189bf7bf5c8111ed20b7ec5484340ea171fe822f2d483d9c610ab5c549006e6
- MD5 20f5377b2c7eb7c98e1ee95ce87fa29b
- SHA1 e525f3425a93505ddb48bec877363ad453be226a
- SHA512 6ed2138045a54cbf79b53eb48bce7c2eb808516b699b02b20807a76f7820e53a2d0835ea8b997df1a594885fd963341101ff071f48e34501db3a27c88038cb17
- SSDEEP 24576:GXYfDtczA+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ltcob5+Pl6bJTIZ5jdgp
- TLSH T18585F11967E508F9EC67823DC8E1C601EA73B85587A0E79B03B499265F333D86D3E742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
- Size 10.0MB
- SHA256 f02134d1fbba0303857c92054ce2eb3bbc1d9e8c3016c23a6e7a5851dbcca8b3
- MD5 f190e4515e083b21ee80e692395be0cd
- SHA1 b16987e8dcd1e15a59e9e56fad8d4186b8781bdc
- SHA512 4c563d5828951807d5355992cbd5fc965f3fabf2167ed56543d98f52c91e6c468b52fb3d2cb92ad566357c16255ebc90bc1fcb5733b80b0483cabd040a95314e
- SSDEEP 196608:x4PQlojheOkR8jCp6VdGOEF6wIfE9nmRHa0BBsLQrZ:xwLkWGXF6VfE9nmRPB
- TLSH T195B6CF12F940C031E9D202B2A6BDAFB65D7C99241B3984C767C45DBC59305E33B3AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.dll
- Size 15.5MB
- SHA256 80e1c990de61dc21b61a9c3f978236bfe1266cd0cc09af4673f9d73d91b3d8c3
- MD5 1cbd430b2924d0686d6dbbd0e3faf168
- SHA1 08ea475fcdfc0463ddf3bf393c90d7081b6a1ec9
- SHA512 5b8d3d1c8d8b370619b4719aa03efd17891cd647e2d595828c8e0a0830897eb72d5478641c792877973e86c2fbdc7add46167222eaae3ead55f31c6bc4e5de95
- SSDEEP 98304:Kf/AG0tdGNAnLI7BPHfoR8pRLlXSyTN52m6iof2+5Q3NKGv4qyDDo7W7Pwi/qWND:Kw/WpnRLlJx+fL63Bz9i/qo
- TLSH T18CF6BE5EF4E249A8D0B24035E15F13D3EB12B0CC476C69F707AC51503AB369EAA19F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 fb25323f76b1b1d022eded00cb3f7e4ce1720f18a7444326156d790e96d840a0
- MD5 022fb90e326cecab3412d7f6b54e238f
- SHA1 966b5e3958b11aa59831e120e118ebb69d58ce03
- SHA512 f8f3182338c844e6d3cae43408a282e6833e2f2d6a6962fbcf73048660ef3c660c5edccf1207c972e9bfeecb17009061ffbb7a575bcfd199ef5677470286acdc
- SSDEEP 24576:N0Le5ji0hmxyrMjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:NPji0AITb5+Pl6bJTIZ5jdgp
- TLSH T1CD95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 ff21306317e137cf0503eccd7db54fae6929c430a9efd2682207186ef0d6a303
- MD5 621189ac3d301e9c73d71e37feb22552
- SHA1 d57e0b19d8bde9a13707613a58d9033488055be3
- SHA512 0a04aa0bacf8f10176abaf753533af5b64d50a02ecbe30f4d91432ec32ee6056d432e60f577aee31ff88860508696e0c0c271a252639e677afb856aad0462eff
- SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWj6q8wyu1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Y/ezSC6vUzPv+Hjynb5+Pl6bJTIZ5jdw
- TLSH T121756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 ea9cc324d4ac295cb1474e74b4c158e04d29678c367148057761c4c9a7be1550
- MD5 ed1f7940377206bd8276c595ecf852d6
- SHA1 c3b02c274ee8bd9c6fe8f4828235b55aeb96f146
- SHA512 f2932bbc2c28210c5235a88b84d6b39cb6ec33d01ebf245c3a403a6d27fca9fbb7e05b9b27826d41ef57700c954cf16d80b466e1881943536c576e76828fbcea
- SSDEEP 24576:sVbqPb88hv/l+BSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:sVO88hXl+zb5+Pl6bJTIZ5jdgp
- TLSH T1AD559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 a049e60a55de13e0c77e0a9f00d17672f91293a67160f31df03a67e26dc2b58a
- MD5 9c4403d79df8bc2c41ce3e4543633c13
- SHA1 eead7142b31fcbe1a5d89f4d74cc03aa6e6716fe
- SHA512 4283bb5aeb86a4cee8ac3e6b3841691ca190d8a884379c500b8f6a0459b17dddf5d10eb3585f028e1ec38df767c6dca811cc14d6ba0031e9e1412f7a7934c0cb
- SSDEEP 24576:zFHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:8b5+Pl6bJTIZ5jdgp
- TLSH T1316523838B6970C5E5AB1739E9CCDF00B87AEF55CD862B76C5752C2BE034249B85220B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 e83fff54a49800e576b1aa83b134d0793137920338aad7d00e9c64ba66a0a75b
- MD5 e74437c4dab8232dc83dceefd3cf1f23
- SHA1 e37df07917357f56f703f8d9eb7ebddf81de7263
- SHA512 1547599369d079d78455fc01cae73fde2fb8dcd01a3bc7a76ac2a18fed598774fd33110e85e0725223a07b237a26ceef7a473d4bc95df4d8eab0ef94e859e688
- SSDEEP 24576:OJIUamb57GBiOl6a8JTth/RWZvR6wQQ92pN3:OJIUFb5+Pl6bJTIZ5jdgp
- TLSH T18E85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55E76815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 8dcf249a2d6641da244999442f3a052ba80fec9981a97cb6c0e53cbb5469656f
- MD5 1238c1f15bff866822a7ecf18082b0f2
- SHA1 baeb00cd0629ae0fff6e9bad48ef2e3047317866
- SHA512 317b4450065216d1308171bc7a58f454c3399f4157acec889932a03e582c75b71efc4bd9971a6a1589b6a5bcb16f3bb6a72222c58ec5bcd1acf2c9f47e76f431
- SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THr:CQvGAdlCEL8c/WRNw5CGslgJTIZ5Bgp
- TLSH T137266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 04957dfe8de0a4ac6d64000312960634d9c6eb27136bf0fe820e2e439011b4b7
- MD5 49b8cc50385a15e2b66fd6e511ca463a
- SHA1 a5aa80edb2e957bc80f77be67931715725ad6a80
- SHA512 64f9b352f024efd5186b9d1563f286c82cddc011e8b8cb2626cf541ad506fffbd28bbf4ab28ba35c1d06133a380a231834687d3d1eaab5c2a22e4495537e3c3b
- SSDEEP 24576:fOewsAjUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Wljjb5+Pl6bJTIZ5jdgp
- TLSH T1EC85E031FE74E036C2BB0DB65B65C706643DBA208F511AC3E3B84D9E99302D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 0662dae7dd1108cc5ad9062f222e34419e4520c866eb637ff5c236d6e1ccb57a
- MD5 1ca7259d3500feb20a9be6e6c08c3bcc
- SHA1 5d63e3681c388a1671899d79dd9fd8e9a69b4b40
- SHA512 b63850684f092f62b54f389031bd2dede6dc453c363bf46ba00f7a0939e062734fdc1ac8c1392a7b07545caded36b611c929df05e06d89268d4ccc286e1bb31b
- SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHvsT6p:WUEtQevvqc2W1cpV20I32vs
- TLSH T156474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 a10e8fa7c998385ea1a6b87bdd88076e8de11a3d33291472352891167ae6e6fe
- MD5 027182107418eed20e8da855bfd13d63
- SHA1 0afe11787f22c73c19d4a698bf56faac2302da2e
- SHA512 9361d8bd6d719a2184cc8c56c481d6d20c64424044e1f0856509bdefd266d0267d470820aa2d29bd780e7d4e539de4a15b844d721ed1e3c9e777488dfff2ab41
- SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zDb5+Pl6bJTIZ5jdgp:UoqtVjnm6slgJTIZ5Bgp
- TLSH T1B5D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 e4fba307872a9d8535f5ab8497f74ab53e6381cfa11446dd7bab5c94e8d8c9c1
- MD5 f685dd3bec139b6be192d1bdeae12c2c
- SHA1 513e9a121e7b69fed0e6d65daf342a529e0f8d0a
- SHA512 838e3fde22e7d439b6130ef8f0ee89e16a42a61f3e076c3fa6f5e89ab320c5ba137ac4b576bf8e0e8970efff5745d8091ec633e40d0c662e113358ec904ef968
- SSDEEP 24576:rAhGL6IFoiwtA5l7S53Bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:rAM5Foiq5Mb5+Pl6bJTIZ5jdgp
- TLSH T1BA359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 f5ff284f54608905264f44084c8b4b6c8b519a563761227847e6d01674c3b2ea
- MD5 62eac42cca1322ed7fe7f9f517c64881
- SHA1 b9c4faa920404590e7434a5f68cb68bfa6f4180e
- SHA512 8311bbf5f3796d5ea4e59d05138e6c132b2dc109d06e3f309230ca8f7acc21f018a83b2f20f4f4eb0635183576a5201ef83ed2bbce016670d83dbc2467eeb842
- SSDEEP 24576:qwuGOWQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:qwNOgb5+Pl6bJTIZ5jdgp
- TLSH T15F75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 423ffc76c916d0aaedb64d70a45b5111bb54e530d8deb541ea29e32850b8f9db
- MD5 38174cf98a1bacf23f854b239df76553
- SHA1 f093dcd9f6ec2e22b1049ba2381d1925b085d86d
- SHA512 e59925cb66913784b8d40b51ff4aa27c960321f5f47d5466a782c043746ac58b355af226849946cc062c48680878fef8e624d15f4dc5e4932bc788a1d4c3dd0a
- SSDEEP 24576:uZuLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:eb5+Pl6bJTIZ5jdgp
- TLSH T14265128A17A830F9E1A7523CCCE48B00E772B8529B7653CF4674456AAF33BC52D36312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 5eb201f88d73e985a2da4c4b66bf207f791d36189b0f0b6e2533b8214c5ad78e
- MD5 ac792113cbe3554570b78c7ba300a594
- SHA1 5c435fa7addfb955fe4df64ef9844039d6c31c5f
- SHA512 4735519482302ec275682bda3d64f7af61dbacdb4bf9cb61e4dd328264b7c38ee2ca450009182f1065ba7dbb324f06cdf0261e8985ca7215acca231455ac5224
- SSDEEP 98304:VQRQyi36YOcPDLvw2gAf+PN3VslgJTIZ5Bgp:sQyiKanX+PNlsT6p
- TLSH T148666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 eb21967b41715d30ae7fe3d5fa10f51534c0a1843fa9a6eec2eb99bbc908de5e
- MD5 29409a50e284062dacee20e1402386bd
- SHA1 e88d66f1fb2eedd480e58d1ef317a153cf4c16f2
- SHA512 5077271f91b186157d302dbcec3f197c7a17fa900f8ee1516504fe5848798f90f9edf1e05f41a95afcb559c22bab0c88e6081aa4bb5ecee666dfafacbb012368
- SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3VslgJTIZ5Bgp:dQyiKanX+PNlsT6p
- TLSH T19B666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 fefbda506f9df2a2270102e4590896d89a0f0ba74c9c528b48303d834e71d9cf
- MD5 b62c459d1946c938c2499bb516bf14e5
- SHA1 ec47e79b5eb5061a526f7d2fca0345498dee5fb8
- SHA512 88f370e753a5481fa154032d95c325c2b79cbcee072088da132c12f47e78909f5c1335ede889ebb03509dc5cce8fe32b74a849e64b3005e5d40d34b1fed263b9
- SSDEEP 49152:T68Qg55nhkeWu7PNU3/Tb5+Pl6bJTIZ5jdgp:NthTRc/XslgJTIZ5Bgp
- TLSH T177B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 3bade192cb59eb2b5c44a0071bf1be8fffa538f1576b9efa8703b347f85a3132
- MD5 e7f51914ebc79518a0ce4c41e3ad8f2d
- SHA1 9f806c0c4c5bd8114ad7a1f6f5bac308abe39ae6
- SHA512 9cfe96dbc68b2078ec1f5cc7e899122e722770a599f0aad37286e510c462d8fe098667c4fce025f93623e0a9b81d74b938b8d2869a0adb444b2478275a5c273b
- SSDEEP 98304:7y5112gYy5azzVvU69nLKnhZ8slgJTIZ5Bgp:WLIHRWhCsT6p
- TLSH T176167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 594fcc874f15895d47bbdc4318c5a9db3d8294d9a561ce1dba14aeb8d39643c2
- MD5 02311ef0cea128eea335c531f7b1645e
- SHA1 4bf5bc86734e834daf30151e19cfe79d477a572f
- SHA512 06683c998dfa222922b4ca89ce83584af229f411de214e535e5cd55a15b3410060a8436af87cd193e5128241a8b5713b32104ccad609421f730163d275c0e3f7
- SSDEEP 49152:CB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glRb5+Pl6bJTIZ5jdgp:wu6JmIxd2dNslgJTIZ5Bgp
- TLSH T1C4D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 37db85b7bdeb2e3b500fcaa9a372c70f958fb4f4efc52e61f00fe90bf0d46da9
- MD5 b6cd5a6927b27c4d879fa1ff3a5ceb6a
- SHA1 43dcf5ad3aaf74266091d19163a338bcae598860
- SHA512 ab6a37cdb348635a8b9cf798aeda03e293dc8eded6773eaaa61e221b6e4599ecf7842cfd663ccbc1d641e771cc73e244ba7301f9d5411fbf1c5992c415afd759
- SSDEEP 49152:H1hpsNoJpF1A67U44CwH7R4xlb5+Pl6bJTIZ5jdgp:HmifPqR6slgJTIZ5Bgp
- TLSH T18CB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 b9343a349633d97a04c752c265f45ad95b05b2926c8fdef45c9e6d1ef296e20f
- MD5 d0b5ae15de2e53985c8e238bb997b6e2
- SHA1 cfe2a66d848dd25460968215a47c57b029f13a27
- SHA512 a51d7c511d3edc45e063f67dd44247cf5e617e03e6069ad41835513b70ed4ec5f14e13e931b9cb430edf1d9ec7e35364ab7fc494df1859980e5996ef3ca62c1c
- SSDEEP 49152:SSuZQIY0Be2KkRVtOnks6NMHqCb5+Pl6bJTIZ5jdgp:M5dKqi61IslgJTIZ5Bgp
- TLSH T185C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF065072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 0946e3489c1585fa6b8a4c9eb1e7a4f0fd8995129e0014300796c12f205db595
- MD5 46855dfb2df0e46caeaa37dfe97a5184
- SHA1 58e981e2e98afb05eee813777d217c19591603e3
- SHA512 0f2bee7c95a3775c9c857601e7df024b80de32e5c78f170de2f3de575cb617bf01df8b5a684f7beee3a43018419576ad45da0bd0a09de76d042cbf9564eabf83
- SSDEEP 49152:MhtSn8EApI0figjgiDn0AP5whb5+Pl6bJTIZ5jdgp:tX2iWphuslgJTIZ5Bgp
- TLSH T13995BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 b7435cbd437d5c8191218c678bc0b2eb2c651be9e822550956b0a6d9e1cdc796
- MD5 10c64e0e8a1783a713e3ebbd34ff625a
- SHA1 12b2075f2177f88b486a319b0b2f44baafbf01c6
- SHA512 25818040e606ce4514ef1ed12dcd1673235a569a3965cdac84956930a45ff3353f3ebdd9df39cbf92fc8cff241f9bcf7a6d3650ebdf537ba279f507a2996511b
- SSDEEP 24576:svmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Pb5+Pl6bJTIZ5jdgp
- TLSH T13B6523874D6B30CAE05B5739D9C8DB00F87EAF56DE8627B6C67D0827F131389385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 f668cf1113a3b70a0549994ded26e993a4826c65560384e9a72e5775585b9914
- MD5 5347c918ecde0595b80059188f62d732
- SHA1 a128420248a0dda4012d28846df952ff65c1743a
- SHA512 53a698e0bfc40fab5025b07515bb46070cbf1563d6c3851240f70d24ad6264bef2ada06f08eac6646c9f8a4ae9f6ddfc30305f55acdb0d4999498ffc3ba27f94
- SSDEEP 24576:KImb57GBiOl6a8JTth/RWZvR6wQQ92pN3:0b5+Pl6bJTIZ5jdgp
- TLSH T1616523874D6B20C6E45B5739D9C8DB00F87AAF57EE8727B6C67D0827F131389385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 9dbf991835ab1496bd53ae781ef24d083b11b6297ae70b7e6c2d7da3e4eecdd1
- MD5 ced91bc564aef9cf67a1ca6667e4eb71
- SHA1 ea131e5871d533f59d860e6e90af208be19862c1
- SHA512 0c9d02951a8e3af320c794dde773458253951f3682a6a46d1dde087f796352991e1dfe459748bea6c63a2018040734616c03b7772cafcac788c273a2e6c18507
- SSDEEP 24576:ACmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:4b5+Pl6bJTIZ5jdgp
- TLSH T1D36523824D6B30CAE05B5739D9C9DB00F87AAF57EE8727B6C57D0827F131389385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 a0528ed8e266ab96af212077683ca23081f0c06091f6adcfc80667c70ba17a78
- MD5 3bc217ecb36f1572da9bbeb3d85c93c0
- SHA1 d4c27c0e576e97359ebeb7be4053f4174096c92b
- SHA512 ad264a70d46064357515ad0ee92733c04f9be67811375e7fb2e69e220cc4a5af9a21da5d6d1bf5e3021441766bf92a98d9402864e65282146a489c81cbc22865
- SSDEEP 24576:Cmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Nb5+Pl6bJTIZ5jdgp
- TLSH T1D96523424B6A20C5E4679339C9D5D700F4BABE96DF5667FFC675082BAA31388383134A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 51c698ca475ef9f51c30eb5d2b97431b883fe4be7d4b01b29c518b6c713fbfdc
- MD5 ba043b7e0b0c5ecedc7ad4e851f2ece1
- SHA1 1903970533747002e8a114ea05048c5c763f55bc
- SHA512 ecfb40e8163c89a43b1c7feb9d1aefcecf1f3777bfe5ad4cdab00c5d5c8f92765157258f59aa4d9417e2b830138a28adbd440266b5647de769482503656b1cee
- SSDEEP 24576:q5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:tb5+Pl6bJTIZ5jdgp
- TLSH T1ED6523874D6B30C6E05B5739D9C9DB00F87AAF57EE8627B6C57D0827F131389385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 39a19d87d88d77354d8b92e07ad295d1204b2827a82e5309c1293e5833dbaf57
- MD5 4f386faee4e8e5fec287ea6ffe41ef7b
- SHA1 edd5baf4d2452aee4a49ce5bf47aec1d3365050b
- SHA512 a6061194fae00d174ab9bae37db40e6bad5b60e4edbd3e37957a40d1d14565fe99b644d77ea8bd941365319c516a0cbbcbae10cf4ba12a33e686363a08d653d9
- SSDEEP 24576:kcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:kb5+Pl6bJTIZ5jdgp
- TLSH T1CD6523874D6B20C6E05B5739D9C8DB00F87AAF57EE8627B6C57D0827F131389385224E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 a918b578659f6cd3f7e4d77ee0517220594a47dcd9caff067463a377925ece58
- MD5 4583166616a22b5094e83f4cf370f77b
- SHA1 ea9350d24500f1531e83d54f7e691358bc846cc6
- SHA512 42c1e0720b636533f669376f38051febe4a7297e56ebe63629b11f6ff90d84b2a91613d08fb120703781d05cf941154a2e9433e8a070b4c027eb309099c99ac7
- SSDEEP 24576:6Amb57GBiOl6a8JTth/RWZvR6wQQ92pN3:sb5+Pl6bJTIZ5jdgp
- TLSH T1B96523878D6B20C6E45B5739D9C8DB00F87EAF97DD8627B6C67D4827F231349381224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 d9ac0c3b7a4dc724a7529077566e00193ca76f584ce45ac3c453bf8d3f38adbf
- MD5 571b964155a0237723c51ecdab5b465e
- SHA1 84521ba308602a7a10ce1ba42b9abd98f7400891
- SHA512 09e8e3cb5378fdc625bfd6c72c38c5ec05078ca7361a168a4e73c7e37bcd117c3a206d22e5089ff4198a355f5809292a96b43c58514243f812c62e4d44b5907b
- SSDEEP 24576:hZMazFVSOomb57GBiOl6a8JTth/RWZvR6wQQ92pN3:hZMazf7b5+Pl6bJTIZ5jdgp
- TLSH T15B85F195B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 db70b507ba58d709c6cacab1434204ea82c0573fd6b70db6f8670e6857f2b1e8
- MD5 143597b31d8119087c10e693a1d40689
- SHA1 29bf2f01e46b38836ccea774949d10ab4ce1976d
- SHA512 949f899314a40db2344c2f4e1410a5b48a4f974264f122b3e262593bdd12f3aa23698a720396c8b26c5fde9dbfe4f1744e7bfb59a485b565c9db0e9707cad97c
- SSDEEP 24576:9cP4mcvIjkGOxhKP2l71nNKbrh/8KBTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:CP4m4IpOO67W8KIb5+Pl6bJTIZ5jdgp
- TLSH T18F65AE2DABDC0096D0BB913885A58A49FAB1742A1F3286CB1170933D7F77EE54E35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 499655bc5e50d172f60c4adfe07fe31ccc1d2ec23b8135c9b735377625c648f8
- MD5 688a9c5038bac520c1ee089ee7c95d84
- SHA1 a101be61cc220881569d564d746ac44281f83ea6
- SHA512 92612632195be6fe4a1b475ca74f60e835d01d58617c1221859e011872a5001baec0eab1c70f9ffd8cd83776618ec8ea214777619e4ef3ddd4a96064a714ccef
- SSDEEP 24576:yLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Xb5+Pl6bJTIZ5jdgp
- TLSH T11475F14AC29811D8D06F6279CB858A00F7377D659BE1A3DB86E0F43E1F366846DE6703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
- Size 1KB
- SHA256 75d01e617e5e76c70a6c11f46bcb27f64d15ea7f2a2df214f333462a92d7b937
- MD5 a9d760c8cf07197dcba488e40c88ccde
- SHA1 dac7093f32200c517b9e0b3b5d703aa43ec8e8bc
- SHA512 6003f7b1e7d3eb64a06a53ad1c623cab6da8a7b7a97f78df868ecfbb000e5d18ec3b96fabc17f3cceefc1069c028d19dc6c7fefc8905a430c1f1538171292ffd
- TLSH T1C921CB544EEA1B17F273873654F90522FA32BD01FB681E1E20D91788096220AE06DF3F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Studio.lnk
- Size 1KB
- SHA256 46314cf064796572af81ff2ba13dd79f8919fe69264a34f97dcbeba48543ef45
- MD5 e4ced541bbe4b90442622e1bbd252f25
- SHA1 351aa7f33708e12ca966bd69ab07e231d63ae2ee
- SHA512 4d6bbb4f24f402b19a7088589329b4a1264a854edd0fcc5aace67997817e5463d590c280540658a0382644aa9773c82698a242815069a5e46ccc40fbd208d484
- TLSH T14C21AB544EEB1B27F3A1C736B8A34653E6327D02FB541B2F10C617090966202A4A9F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\f76b3613ebb7b9e0224e2d37c8519214
- Size 9.5MB
- SHA256 2979db026346f0652c943e169ab0b944829a3cf2311b97456f3a15a2d6b7e402
- MD5 f76b3613ebb7b9e0224e2d37c8519214
- SHA1 d6a1e838221862e5d1156db53d95b8d2c5103de6
- SHA512 3ff2c9f26ef85e4122c3a09d8cb99e5bd7fc6d9e6c8afc7624a8d6413090741e7319f5df2e63d6bd45cc78961eef47f75f5454c54795fc040ef4f8d9d0ec8540
- SSDEEP 196608:aYEq/UhCY/Kp567NdzDvIDrfyrgcErNYBElBcEFdCK:avVU+Dvarfy0cErNYyr1
- TLSH T154A6CF22F941C031E9D202B2A6BD6FB65D7C9A341B3948C767C45DB845305E33B3AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Roblox Player.lnk
- Size 1KB
- SHA256 3ead4a2c1fa2eb15ed0d13bc0d5bd49a6f54b8852a76129326c7fdcb0312c92d
- MD5 d76e340c86ec28b92e92d24f9d246289
- SHA1 1dd85e1ce09978ad9986cfcc032261f185f0440e
- SHA512 736faa1ba133c6f933749059c402e8c34bed1c5cb10ef214dc4e2f7ee9b7f396f3cd46aae30ecb530bd61748bf7f1d917e023d3c434fe4b50e71bb209691c4c0
- TLSH T13C219B514FEA0717F273977558F90552F632BD01FB581A1E209967890962206E06DF3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Roblox Studio.lnk
- Size 1KB
- SHA256 2a9945ae35eea8c12aaf01b7da4a3438f2bdcee786b81b995fe680ac9870bca7
- MD5 7968bfc0cdf26b62cb1f4f344afb6726
- SHA1 f0f5ee9742c9ba3169d8d37614b527b8aa938d26
- SHA512 be607f53d37b8d14b89f98676cf40144267ecfa7b443da9ba304826a227a206714ca0e97b72d2578a34663137bb47ba28a66f5abb95fd4c7b9c626d660b736bd
- TLSH T123217B544EEB0727F2A2DB36B8A34653E6327D02FB141A6F10C617090962206A4A9F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 8061e4af573e540684501cd49b4b989b9e6f978c3e39e4065bc7ce1f8dab8f0d
- MD5 f061c74b2a2a52f4817fe14082d1630e
- SHA1 01c69bbdde7a010bdeb76f7ae36e3f4c491f3061
- SHA512 902d5ebe906f4a7a5666fd7ec1d87c190a2f581b9e8f74668be4e6eff54eaf07a60db3d8934ea19c1fd15e0a44e33ae9a1dad33d715cb25bf7d8f857fd3c9751
- SSDEEP 24576:mrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:mib5+Pl6bJTIZ5jdgp
- TLSH T1B96523438B6E7086E4BB5735D8C9CB10B83EBF65DE8666A7C579142AE1306857C2230F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 8f262f004469aff5057a2650baa3879d12af57569880f9a5bccf28524f95af94
- MD5 567480689ff844c5dc097e4734add93e
- SHA1 616cfaff4afab3e79df432e7a2fafbd295564e26
- SHA512 0d5acb0d8ad0e878f62fc31c765c314a125bc25f9174d203dab76c4118c65eca1c6f4347ebf4cb6944f48de1b33e0e82f3dd5a52674a9cca9708d5565047397c
- SSDEEP 49152:Qa0h2GEkuAe73q3pp46zwwQ0b5+Pl6bJTIZ5jdgp:Qa0hNYG4JwvslgJTIZ5Bgp
- TLSH T16D85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 2a6056c63e2872d9b4ed113644f15bc181870c97b87348774629a38c9da73fbb
- MD5 c5c0668c9279b98bdcfa96f87affc26a
- SHA1 16b365846efeed5a537b628cc3af40b2cacefd60
- SHA512 5ba194d1c804bc5a34ef9cc3be5b2fc3044aa856b34e1e0217b3bea385e65fd4e93e789cde1e8bf78ea28c06733d843f533fa87134de854bd2e31bdb21ddd12e
- SSDEEP 24576:1hbHjP4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:1hbHj3b5+Pl6bJTIZ5jdgp
- TLSH T1B765126E06AD20C9F076A27DC5C5C606E731BD265B1263EF42E5813E9F37AD82C35B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 a29fe608cf76d352b2cd2914246972c2b27fd59f0192743c44115839aa00f070
- MD5 e82b68f890249b63c84ef2a9cb2dbbb4
- SHA1 a15dd1d302e5978892201339c70061b461ff7220
- SHA512 bf746909b967a1ef9a9df384372a071e84f67a629e55659f6ce864aac0c4d7fc63f9398bd86112715b00e208bb0e87ad816158e18b6795d64755676b1fe6bf44
- SSDEEP 24576:F3YgnJcRTk4yti+R5dBR/Qmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:FIgnaTk46pBR/Hb5+Pl6bJTIZ5jdgp
- TLSH T1F345B02EF2B910B9C8AAD236854147B5FB71782D1F209ACB0170C538AF16ED85E35F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.4MB
- SHA256 91c22e635311943af70806baecbe83a122236957d569089000670b2d97fb64e8
- MD5 faad214b9e1b066811389529fa2b350f
- SHA1 6ee0f3b53281d1da583d038ebdad49b6b4ca90fd
- SHA512 c4bd1c7a78b8dfb6a83c21de55918d147a30939eb9751e05fd69f53cb777fec7c21fcb449651a0c904ecc84c0dd31720780bd48b921432582a423c3533ba6adc
- SSDEEP 24576:ynmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ymb5+Pl6bJTIZ5jdgp
- TLSH T19B6523864A6A70C6D46B5779D9C9CB00B879AF51DF8727F7C479182BF1317C9383220A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 c24f21f2db0b11a269115149812464aadbe45a6959849b4b47feea8959e18488
- MD5 227aead4b61f24bc2feb9407acf00979
- SHA1 8f2e73f3e770f48ad7520125864e20a3132340ca
- SHA512 c4f56d591a2fca950e233eba6a1bfa6270a3e09bea348d9803e60c16300dd5282d15b3b3e4c3031cc91a2ce6cef12007aee763c65576e4d212a63c1486584816
- SSDEEP 24576:hBL3UT+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:hBL3UFb5+Pl6bJTIZ5jdgp
- TLSH T120850245E7A500F9E87B823CC9A6CA12E672B85D0754E7DF03B84A661F233E15E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 0cc5b76d38497e2f577f6dc5bbc50cd878aece006a5f0547dc07930187999a5f
- MD5 a780f32339f51946a496810eeb986e63
- SHA1 9bc25ca84d861acd88648ed75a2fde47b72de85c
- SHA512 74c1940cab2fd7becd8074e98690adbc00579b3ff31f22fafb64515d31e63de76172249efcf5bd479ef040f72e070211fdac66c2bce2766ca6382170ab9daedd
- SSDEEP 24576:MO6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:MOlb5+Pl6bJTIZ5jdgp
- TLSH T11475020A27ED20D5E076A23DC9C68709E771B8664B1257EF46A0807E5F63BE87C36742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 ed7448b30f185fffb209bf1f53f96eaf6bfca9e4fd58de8b78cdb6c3d9042492
- MD5 7d50a376c23d179b5afe784cc35a33f8
- SHA1 c0683c357bfb987dfe9680a3bd276796671a6321
- SHA512 47f8eeb4b6dce66a1f2bd1a24d5d695cb07ad4621938b45cf60c3966a04fe2f02a994f379fbb4c9e3856fad6aedbcd0900842986f3c7a4d3f451d14c2e76c9b1
- SSDEEP 24576:t7NM9YqZqmWMUkPjZM48Mv6bEhsbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:t7cBWMpPjN8DbEhPb5+Pl6bJTIZ5jdgp
- TLSH T1CC65AE2E6BAC81D5D477D13DC9E28205F6B2B4611B318ACB1162833E7F37AE45E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 b5040b04817af015f9afcf6300fbe9c0cc25e29985b224a1511ae8ec3a247a0e
- MD5 b20823857e4a3cc6825790e4f9d10ae2
- SHA1 c32862c0dcf0ec626a765244e0af49805b1d0ff9
- SHA512 e29b7433df781a80d5a437d3f61469b0bb999bbcff599d10a225e386c2b639239489d873ac849dd1696f8813043a1cb31df70831928e014a0f3797e5f00a8d41
- SSDEEP 49152:kF2YuHNETovAvNYf8kmyb5+Pl6bJTIZ5jdgp:x6BCf8khslgJTIZ5Bgp
- TLSH T120858E2A27ED80A4E0BBD27D85F6D246F9B2B8511B3056CF4255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 5006dccbe6bf73796932d3ad31dc0bf22c5e190b55039be87124d43f4d31c0d5
- MD5 d0169bcdd226c2a8c6904bd710f099f9
- SHA1 ebe8642d323101b933d4132843211680909aca36
- SHA512 9dcadcf65804dbd8d253ff0968e013fa62fc6fc7776a302648aad148030a957d3d43c4ae482f55f4ca7e0976b487bdd0f125d468dc3b71a14acb91b74e68da4f
- SSDEEP 24576:4AFs06+Omlf8NXEbTommb57GBiOl6a8JTth/RWZvR6wQQ92pN3:9Fs060loXuUb5+Pl6bJTIZ5jdgp
- TLSH T14265AF2F66EC00D5D07ED17D8997C91AF6B1746307256ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.7MB
- SHA256 9aecc6f07dc0d4c18c452defe1e62b78342d95fd5e50fd152baacbe99b0d12a9
- MD5 3f6a261ef89fe19cdd2782ce0aceee61
- SHA1 d44f77921947694125514015713c2d5363422c29
- SHA512 3373e5a3e5cc9ec082ef4801ae5ee61fc1cb9cad80172a0af5ee97b0618d32201cd213ab9edc10ef79b5d668c3e73002c0f811377c5eabb34637da16cbc9c964
- SSDEEP 24576:9JnJ5D3WxZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:9JnJ5DGxUb5+Pl6bJTIZ5jdgp
- TLSH T17785DF2DD2A810E8D4B7C274819A5B45FE72386D2F226AC758B4D4357F12FE0A979F08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 bad16899a0813bc1f7f9fd7b2e3da57a770db580f53ce2df62985c485f376719
- MD5 7c9401a85647842b9cac7c519dbd766b
- SHA1 6a5bd679878a58aa6f888eae6ff426e73fda87cd
- SHA512 f904a771d266eccb90228c1d816fdca269e994a29c65ae33d8c3af225b81d81591c7f72d11fb35c64751bf26eaacb5707adf59aa89f05af070ec33e953dfbfcc
- SSDEEP 49152:+g06DIKdwc+eQnSt65aVub5+Pl6bJTIZ5jdgp:3eslgJTIZ5Bgp
- TLSH T1D5956C06BBEA5294E8B3CAB1C96295159B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 9bfafceba515aa6980067fd1fe32a6b3010f46a2277d5bcb2ebf6f9a3dfb872e
- MD5 97f481b3660ac5620cb2f55b0b4b8afc
- SHA1 4845886c947b4b14518cb6013fcb1ab8aec64133
- SHA512 4de832ed9915f0261ba476ea5047083e0e63aca9414e0005b400260360c40c2c4b9ce8af7e983fe43f0e29264d6caafd8f79f39b35d91d35c7cd065706cc4bf2
- SSDEEP 24576:G8Vmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:G8Yb5+Pl6bJTIZ5jdgp
- TLSH T1C865025E1BAD70D9D06BA23DC5D1C704E372F461AB4227EF46A5813E8E33AE92D39701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.5MB
- SHA256 d58d645ef36d6e5b177cf9f2532f0dc04983be7bc494024709c803d28d22b097
- MD5 ed0221c5008d611d36aecc01b80abd4a
- SHA1 7d7141de7dab2dae89d98b43feb7eb943682df68
- SHA512 9be4b6fbd462f9cd2dbb650aac266be77d72288ed65005688ebeaab0a7ec4636099f4b36718a1e6d5fba5ac5bafbfcfbe71bd75972801667977de61bb151da6f
- SSDEEP 24576:wIyImb57GBiOl6a8JTth/RWZvR6wQQ92pN3:wIEb5+Pl6bJTIZ5jdgp
- TLSH T18F75124553A860C5E5BB4738D9E6C350A979BD21DF1263EF80A0A93FAE32BD47C31706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.4MB
- SHA256 eac25fe7d472333c8ed6bb5c446d546caedd2111f070bd100b77dcd800032cda
- MD5 211dce935d8f56c3cad32d6f1f8c6793
- SHA1 d986d8b7ca115481e898e0ebabba28cdb5d05db0
- SHA512 771a17038147105fcb9b3362fc840f4f68215f89cccc0686f3ecbd75906f805d4696f20886b2063a40401017218691f0b6716f6c60b1bdb55e329bba29943d32
- SSDEEP 24576:fKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:f1b5+Pl6bJTIZ5jdgp
- TLSH T1E865234A4A6A3089E4675739C9C9CB00B479BF65DF4637FB84F99837E6317C9343220A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 59e5096e04ed45825f2e05b6f0628e6d1e230bad34b627fdde3218d7e642c746
- MD5 301fd3bb0ee1df1b4dc0abf3db7ce1dc
- SHA1 e0f4e66ceddcf1c5aa3017ff59cb3513811991b4
- SHA512 5905767532de069f5e7acb37b5ea38137665ace2a1e20afbb0d9b834992efa01f94e4d87df21cc255f6a00e95bf6b5806f372c70dabc15e5349494ec5d4b5900
- SSDEEP 24576:+Q9MxZKdcz9dw3Dmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:+VKZab5+Pl6bJTIZ5jdgp
- TLSH T110558C2DABE9058AE177D239D5A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 38e7432f812189409f7b06ac53cc0572a4216629399889427d1da43602fa3d46
- MD5 0c95701022b9cf82c63e9b26c8655de8
- SHA1 69672bb54865ee84d7d359c2fe1be35b6bf55a11
- SHA512 667bbef3732974bf7917081641d0ce7c7d2fb270fa138a3d49968020d09ada1e51fa34ce13ef475136ab609cfa26cf607ff4fea128ced08cd89227d415415225
- SSDEEP 24576:5yocwApUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:UocwApjb5+Pl6bJTIZ5jdgp
- TLSH T13975E00FBB6E40D2E066823CC9858745E773B4309B5267DB9591C73E8E23AE97D35B02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 9859fc3452a034dc9a0a56727261a702c9064cedba1b37d2d6ba1f9a54d86f78
- MD5 1c8b211b3b9f9427986f670f36e8fa8c
- SHA1 4bcf9f1cd8ca6a9a86bc88f3dd730bdbadaa7876
- SHA512 8ecc5f207dd0b9403d322e77fe68641133af2164312cace886e447bdab126d6037b4049f82a4c30ed6eaf06819e1d2cbe44ed7c69f1d85d5c50176cd47394209
- SSDEEP 49152:VWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKjb5+Pl6bJTIZ5jdgp:F0zuNI9slgJTIZ5Bgp
- TLSH T179A57B3DA2BC00A8D8AAC379C5451365EA71742E3F2065DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 92d037c7a1afbec5dfdd9e33a133d284d84ebf908da0af977b1fe4564e864d35
- MD5 b94082cbf28b484d18f79432752c5927
- SHA1 41b86470df214c9ee509b82b9b71f5c590e5b0a9
- SHA512 672648ad239a0536769d853188d11e029a993628defdf569c9ba7f8938fcd09825b60f48ca18e0ecf017b2c68732dd3b083d9526da887bc2d4c0a0099ab69e79
- SSDEEP 24576:E1QT7EcpfxR+N5AWAz3ooiYzjMqbVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:5TDxR+N5YzTBjMFb5+Pl6bJTIZ5jdgp
- TLSH T18155B02EA7F915E9D1BEC6798A23C502FA727821073193CB42A0C17E1E775D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.7MB
- SHA256 59ce40cddeb342c19e7084d744e7d017965b98d7507f4227b44fdd638638fbe0
- MD5 6b55193a43f0116bdbdc397d3595e3aa
- SHA1 58692a8c2a6b789f6e00d068e78c57f88e5096bd
- SHA512 2b2e8ade9f9ac9c6e95e2f7f9eb4fd1372b82d210c529a695525d43c16e44474e92ef2354bdbff1820a589138bd7e4994235385248fd8b74d339877cfca9891c
- SSDEEP 24576:WTMdOz0FFS+jmSLhmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:y0K+jmSL8b5+Pl6bJTIZ5jdgp
- TLSH T1B885E17EA36D14E5E47BC27DDA838A06F5727462032266DB06A0C07A7F57FD4393AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 b6a584d54ae13e2656481f38d1b0caff113f1bdb7691fca527d0f9c0ced779bb
- MD5 1408458fdc58cb0d0358f1c5c94f0368
- SHA1 811b64724ac6bf923273bca115ee778f3bee220c
- SHA512 2cadea7e2b660655b4bc47a455ce13f527aefdccca49bde6212b2218c9b7bc46a310cf3ad138df97f45c512f55a6b24270e4760a12e4bcf972f26d5f929368cc
- SSDEEP 24576:b+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:bhb5+Pl6bJTIZ5jdgp
- TLSH T1E065124A07E930C4E4779339CAEA8700E571BD669B5627FF55F4C83B9B326C8A835702
- MD5 SHA1 SHA512 SSDEEP TLSH