Analysis
- max time kernel
148s - max time network
139s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 06:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Resource
win11-20260130-en
windows11-21h2-x64
24 signatures
150 seconds
General
- Target 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
- Size 10.0MB
- Sample260417-hex6xagy4n
- SHA256 9817989db478807b67e4455c5e3a9301883b669885e1e6e6751538e2bd5469d7
- MD5 847ced11b536dd7294adb21a51dec10c
- SHA1 4c35baf630187a86452df8a7e07dda5e2b315fb5
- SHA512 1f9de53d449871494c1de199091fb5bf78145f8069d8663473d446498d68f9074cd0be1e92bf8c77fb34310910436aa81076c0246e677f06df3c3cd990494c22
- SSDEEP 196608:odAiJX9lb9+RO4ERBGZNIbwAFUPz9RBDPmO7sT6p:oT9l+ZebwAFU5eis
- TLSH T128B6CF22F940C031E9C202B2A6BDAFB65D7C99340B7854C767C45DB959305E33B3AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 5 IoCs
resource yara_rule behavioral2/memory/4536-9-0x0000000000400000-0x0000000001017000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4536-66-0x0000000000400000-0x0000000001017000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/files/0x001900000002b436-662.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/files/0x000d00000002bc5f-698.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4536-810-0x0000000000400000-0x0000000001017000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Executes dropped EXE 23 IoCs
pid Process 1156 alg.exe 5028 DiagnosticsHub.StandardCollector.Service.exe 2348 fxssvc.exe 3576 elevation_service.exe 712 elevation_service.exe 1272 maintenanceservice.exe 2240 msdtc.exe 2220 OSE.EXE 6096 PerceptionSimulationService.exe 1616 perfhost.exe 5220 locator.exe 4884 SensorDataService.exe 1556 snmptrap.exe 5380 spectrum.exe 2900 ssh-agent.exe 4372 TieringEngineService.exe 5428 AgentService.exe 6048 vds.exe 6036 vssvc.exe 5600 wbengine.exe 2816 WmiApSrv.exe 2632 SearchIndexer.exe 3844 RobloxPlayerBeta.exe - Loads dropped DLL 1 IoCs
pid Process 3844 RobloxPlayerBeta.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe - Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\alg.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\1a868358da180f68.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 3844 RobloxPlayerBeta.exe 3844 RobloxPlayerBeta.exe 3844 RobloxPlayerBeta.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\javaw.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\MaterialCursor.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Settings\Players\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\TopBar\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\Controls\DesignSystem\DpadRight.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\PlayerList\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\chat_teamButton.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DefaultController\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\Balthazar-Regular.ttf 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Emotes\Editor\Large\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\TopBar\coloredlogo.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\NotoSansThaiUI-Regular.ttf 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\Controls\DesignSystem\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DefaultController\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\ic-arrow-right.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\graphic\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChatV2\common_search.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\avatar\defaultPants.rbxm 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\dpadLeft.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\PlayStationController\Thumbstick1.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\MenuBar\icon_emote.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\PlayerList\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\graphic\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ArrowFarCursor.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\particles\forcefield_alpha.dds 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\xboxA.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\PlayerList\FriendIcon.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Settings\Help\RotateCameraGesture.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Menu\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\SpeakerNew\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\families\PressStart2P.json 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-self2.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\ic-checkbox-on [email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AnchorCursor.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VR\Radial\Icons\Recenter.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\InGameMenu\TouchControls\controls_phone_portrait.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\graphic\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\avatar\compositing\CompositExtraSlot0.mesh 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Scroll\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_6.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\Controls\DesignSystem\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\transformTwentyTwoDegrees.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarEditorImages\Catalog_LightTheme.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\PlayStationController\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\PlayerList\[email protected] 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Settings\Help\BButtonLight.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\places\Maquettes.rbxl 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\RoundedRect8px.png 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008323950135cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ef85e0135cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e08adc0835cedc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1bbcf0135cedc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e59aa0135cedc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b04c00135cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe - Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-9d412f44a6fe4081" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-9d412f44a6fe4081" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-4e426689616b482d" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe" 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 3844 RobloxPlayerBeta.exe 5028 DiagnosticsHub.StandardCollector.Service.exe 5028 DiagnosticsHub.StandardCollector.Service.exe 5028 DiagnosticsHub.StandardCollector.Service.exe 5028 DiagnosticsHub.StandardCollector.Service.exe 5028 DiagnosticsHub.StandardCollector.Service.exe 5028 DiagnosticsHub.StandardCollector.Service.exe 5028 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 680 Process not Found 680 Process not Found - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeAuditPrivilege 2348 fxssvc.exe Token: SeRestorePrivilege 4372 TieringEngineService.exe Token: SeManageVolumePrivilege 4372 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5428 AgentService.exe Token: SeBackupPrivilege 6036 vssvc.exe Token: SeRestorePrivilege 6036 vssvc.exe Token: SeAuditPrivilege 6036 vssvc.exe Token: SeBackupPrivilege 5600 wbengine.exe Token: SeRestorePrivilege 5600 wbengine.exe Token: SeSecurityPrivilege 5600 wbengine.exe Token: 33 2632 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2632 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2632 SearchIndexer.exe Token: SeDebugPrivilege 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 5028 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2632 wrote to memory of 5320 2632 SearchIndexer.exe 103 PID 2632 wrote to memory of 3704 2632 SearchIndexer.exe 104 PID 2632 wrote to memory of 3652 2632 SearchIndexer.exe 105 PID 4536 wrote to memory of 3844 4536 2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 107 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_847ced11b536dd7294adb21a51dec10c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 45362⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3844
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:1156
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3260
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3576
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:712
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1272
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2240
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2220
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:6096
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1616
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:5220
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4884
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1556
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5380
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3688
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5428
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:6048
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6036
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5600
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2816
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5320
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2876 2852 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:3704
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2908 2904 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
PID:3652
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 cd644b383d04c0425977abd61bab4bc8eeb0c2047d7feea98d1c753b116661a0
- MD5 f8e69a9e57e3cf9e1c64db715a790709
- SHA1 8f0f078edfcfe340fe737ee9afcc4e3a3b4c2a1d
- SHA512 5f9a9a6ef1006f182579c54e139693c934fcef972fce9bcec3bb07fa40e1c950ce65e84930d297049739d968b5e80ca643691e84ba51545b9e26ea566d1a07ff
- SSDEEP 49152:Ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnpb5+Pl6bJTIZ5jdgp:O3q6mjBcslgJTIZ5Bgp
- TLSH T1B0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 4800a819902e754a3c3a2d6e2cb019467ef8b4a41c60d9a5b31715d35cd384aa
- MD5 1abea1bec166e49d245426f5c90ba9e7
- SHA1 5d8cd15beb2e7a311f8f9024ce7a0258c8fedd39
- SHA512 737cf7da8fed7e95cca679fe6921083f482fcd77c933c72eaab4fae670c8021c64e576ca5f713f5b7d7b7acb5155240b4bd73883f9cf8c546938d3db3784be4c
- SSDEEP 24576:0XYfDtczArmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ztcjb5+Pl6bJTIZ5jdgp
- TLSH T17285F11967E508F9EC67823DC8E1C601EA73B85587A0E79B03B499265F333D86D3E742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
- Size 9.5MB
- SHA256 bbf413a40c8aa3bfdf44167f12f40b12f7bf5428925ee5e628416601a4064ae4
- MD5 d15b05f13cc22e65dff4ed6c0ea6a4f4
- SHA1 7cb4025dbd9fa9dc229b1a327cde8a0c9ae27249
- SHA512 1e82163e1603d93e9e2409432923043c329f653b36a12b284b8e1b5d6f92edad4022ace52315d85431e8d522db6e2a446cac1a8cfcde72cf0a158035d5c9ffe1
- SSDEEP 196608:x4PQlojheOkR8jCp6VdGOEF6wIfE9nmRKa0BBsLQs:xwLkWGXF6VfE9nmRcBs
- TLSH T1F9A6CE12F940C031E9D202B2A6BDAFB65D7C99241B3944C767C45DBC4A705E33B3AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.dll
- Size 15.5MB
- SHA256 80e1c990de61dc21b61a9c3f978236bfe1266cd0cc09af4673f9d73d91b3d8c3
- MD5 1cbd430b2924d0686d6dbbd0e3faf168
- SHA1 08ea475fcdfc0463ddf3bf393c90d7081b6a1ec9
- SHA512 5b8d3d1c8d8b370619b4719aa03efd17891cd647e2d595828c8e0a0830897eb72d5478641c792877973e86c2fbdc7add46167222eaae3ead55f31c6bc4e5de95
- SSDEEP 98304:Kf/AG0tdGNAnLI7BPHfoR8pRLlXSyTN52m6iof2+5Q3NKGv4qyDDo7W7Pwi/qWND:Kw/WpnRLlJx+fL63Bz9i/qo
- TLSH T18CF6BE5EF4E249A8D0B24035E15F13D3EB12B0CC476C69F707AC51503AB369EAA19F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 2b6eb60c332e147a636fa3507f7340024fed4550db12f34925cf1e2ee0dbc9e0
- MD5 5f0e53fe0679f621c8a13a185b6135b7
- SHA1 55110f27ba87cbf6b50c811af3cc07cc276d2977
- SHA512 24fbd6efa3f072729498d3f1f53b6492cf0a33fd713d89c7f0c22f98997016886f9a30bf15951d7edd6a68768ea361e9c9376e3d8637f3e69dba165a36fc3d8b
- SSDEEP 24576:T0Le5ji0hmxyrMemb57GBiOl6a8JTth/RWZvR6wQQ92pN3:TPji0AIgb5+Pl6bJTIZ5jdgp
- TLSH T14995AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 6062704554b99ab30f483e20a9e733bbc21847860e3eede7b7375dddd40cbd41
- MD5 45dddf228be5c6fe33c25e4409b75b87
- SHA1 df7d2f07511b5dd8983d0aa195582f58577c5948
- SHA512 c8dd5c76cb5f1c40ee9200000579eb8cde08f0ba2da4b0ff60547e79a5b14a2d1b3425c8274739315bc5b1b9392107281417bec7b3b6b8572c15abd025e26d7b
- SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWj6q8wyuEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:B/ezSC6vUzPv+Hjycb5+Pl6bJTIZ5jdw
- TLSH T1DD756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 41d3a226ac0c74016e26ebde16e8c660738d97999dd98eb2f6164916626957b9
- MD5 ff667a91d0e08f5b84843345ffdcedd4
- SHA1 eecd5e2bdf0fe53c5625278dc5df06790998a291
- SHA512 d7aa110d58eaffa36e9f7a9dfadf66b7b7f0a0854aff76e77251d88555fe06ad230b453920a4e246089cc573b4489f26698af90579d2e89aed4f81fbce682f80
- SSDEEP 24576:TVbqPb88hv/l+BXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:TVO88hXl+Ab5+Pl6bJTIZ5jdgp
- TLSH T13A559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 440e7fb91bdea6e95e87582e9b789ca1fcd040dbe06ee0e174487b74091199f2
- MD5 f99979f6a8be2a83827fea98f0cbbed9
- SHA1 23ede542d25f05dd85e87c787cbe569a45b68263
- SHA512 00235c54c66dfa34003d274cc5a61f5db7e9b2a5a97da9e2e74fb97d02af767775b447c54b0f045183ac5c5c5cd2fd80dc2e7ebac2d554b61977f059654fdc0b
- SSDEEP 24576:GFamb57GBiOl6a8JTth/RWZvR6wQQ92pN3:0b5+Pl6bJTIZ5jdgp
- TLSH T16C6523838B6930C5E5AB1739D9CDDF00B87ADF55CD862B76C5752C2BE134389B85220B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 e5a0ed188957c8fa8731baf911591f524782649f31a449e396f7ba843c9217bb
- MD5 f5c7831417c4b4d09a4c9674e7d490c8
- SHA1 e708caa9249e991301c91c5bed676fa037122fd1
- SHA512 1be30cffba4fe1b3a32a931c7a58227b9142a9039bc411a8625ebcb5d6fe95257c278175cb8380fd4dbec1e379bcb0987e23336d7c2886402159616e5babd96c
- SSDEEP 24576:ZJIUvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ZJIUub5+Pl6bJTIZ5jdgp
- TLSH T1A985CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55E76815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 e881d0c962e887ae73d3149cd8e102aa6a862125d2291586937fbc66c729729b
- MD5 875d019f7dd08cb256a5c15ed7881057
- SHA1 c499be160925856cab019ecbd08bc3b5cfacc867
- SHA512 838eb9be0467c1be7c75a4022770aa027aa1d99ab52e01f305df9974afb9b8d07b27fd099f9e93984344d2e07d47f2a4d1bd14ec3ca91e1d9c4fd4e2b59162ca
- SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THG:dQvGAdlCEL8c/WRNw5CnslgJTIZ5Bgp
- TLSH T11A266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 d824fd57cfcc8d970a48e077e2faa7c488a1f3e0bbd3c0e28b13e76b20d8e11d
- MD5 d9cc47ec64df6b5a6732271afe0489bb
- SHA1 c459aff7c912c16cc9782538ddd3e6c9652f16c6
- SHA512 249147d4f9b248dc88bab3362b3dc4474fd0297c17f94b58091aa3d3a2c0f8aaf1fc0520061e8f63790316fc305637c9c23766279b2cbdb60570f65ea1fbd407
- SSDEEP 24576:cOewsAjNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:PljQb5+Pl6bJTIZ5jdgp
- TLSH T1FD85E031FE75E036C2BB0DB65B65C706643DBA208F511AC3E3B84D9E99302D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 c9cce7eb9d7db8d23e9077f7aa00b44803ba4f441155b024d0a91ca9dd26e013
- MD5 c8776ecc5b0ae0e6c596942514bcd122
- SHA1 a9dc309dfd888b8a57100b1616b074fcbc120f2f
- SHA512 f7e475e05eb4e11014fdf94c6a2a4dadbc850a23a385b848c666695bb8f053330004ed05ea31e529b245278a96cdc0431e2f7114ec17740cb6d59efb55cf4b0b
- SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHWsT6p:DUEtQevvqc2W1cpV20I32Ws
- TLSH T147474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 1eada48aff92a52c6530d315fcd84c61ce00ff392a44cdaa8ac8f32024a8fcbe
- MD5 4d677b20d6cd0d54a52f053ca24a07f5
- SHA1 a6395502862ba0663f70ec06957e3634d40c8c1f
- SHA512 9f18d63928dd55017240aa33a487526408a3acefe5e0c7ca7874e729daf80e9e3ea83f10e13c4822a19308eb8e1b2400476c4d6b4cc4b7cbf60441f57a2a7719
- SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zwb5+Pl6bJTIZ5jdgp:LoqtVjnmzslgJTIZ5Bgp
- TLSH T19CD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 53e2da29e1b397218ee3851b28bab65634b2dbb10b2dca5a9fd199715bdd4960
- MD5 5084071105e8da0f5598c0477442a4c2
- SHA1 12c3af3e52dfc9185c74ae58468ee3ff3cb97436
- SHA512 61af884c649e9fbee6244a7184ff627856b563714a65c2580ffb7668e2dd1d11ea756e9fd811e78ce2cba2869462a49c6ae8e8a7b1033322b60a91288591b879
- SSDEEP 24576:OAhGL6IFoiwtA5l7S534mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:OAM5Foiq5/b5+Pl6bJTIZ5jdgp
- TLSH T149359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 53ec0a782cbb59f0a02b62f1a7dd25b22e4c53c6cc99fe1b6ac9a142733fe0f7
- MD5 a3c23b6efecaca852c993532b7120053
- SHA1 6894e13f6e357c44273954c1216638b4362fb9d7
- SHA512 76a5d9c8fd18a26cfb365debd03dd5476c7eab6dde7c5ea60d77a94e867121a834a5f998dae0aba7df4f101487873a3473e7e4e36831449e2183fa6bf8d9272b
- SSDEEP 24576:CwuGOWhmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:CwNOrb5+Pl6bJTIZ5jdgp
- TLSH T1C675F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 5dfac6eff12bc2ccf081b4fb99ca8f319e5c0925a125989dc36ed9c397e64eeb
- MD5 b04c9925d00ab71ae5541431d78b51c8
- SHA1 7d251a87b8027494ce6814b4de2796c7839f8787
- SHA512 0e038550a9812d34e5dca4f6e6b85e725bf6964b764b59e0c9ae5a79030646383b3662c239665f70c3b3481c28a316a2944782f3cadf625ca6c552a323b44987
- SSDEEP 24576:+ZuWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:db5+Pl6bJTIZ5jdgp
- TLSH T11265128A17A830F9E1A7523DCCE58B00E772B8529B7653DF4674056AAF33BC52D36312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 9373ebb37d83db8b699f923625e93cd9d2289421929295b17116800d2872b4de
- MD5 1d2b61fbf412528360908a4d89685b09
- SHA1 416d612f0025c02e52c699d7bb68ee83375df817
- SHA512 2950a6498ab3a7508f0046e2c87f7a0279a1a215d75a6ae362aaf45615dc519bd80fda72daf4ee784f72fdf81cd1307dd557007c8e6f3aa3ab3443d73a81b502
- SSDEEP 98304:mQRQyi36YOcPDLvw2gAf+PN3wslgJTIZ5Bgp:NQyiKanX+PNgsT6p
- TLSH T1A3666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 8f95188ac3bf6a96ba9bc680bcaaa801e6fe82980b0effae51534c253d69e20d
- MD5 34a399ab6f78d7ea908654d059b6d7af
- SHA1 18177020a77bc14dbd68a06c4cccc47f0ce8eb09
- SHA512 60cb640c557bd3f112a5a8116e0f55f2d788fac4b6f5a2e647dd7847f7a83414c7092d7b83bfdd1b072cef916863d13b65a9cd85a97574df7bd7d53d7ab26733
- SSDEEP 98304:rQRQyi36YOcPDLvw2gAf+PN3wslgJTIZ5Bgp:aQyiKanX+PNgsT6p
- TLSH T152666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 56d7486b703e5fef64a676bb15c90ce24a39aa83a42520b587d6ddabcbf35089
- MD5 f06094f26f2708e7bef33d40ec9270e4
- SHA1 4f89e1211cbfe4812f4f14c674245f8a6846c944
- SHA512 adab360ca5b884f49e630d4e3f09eac1772d8113fd7a2a59f34468d34748e21eebeffa65b66189cb758ac43fad9bf9ea28a6358ba7c992c6dace47c025ab6397
- SSDEEP 49152:668Qg55nhkeWu7PNU3/gb5+Pl6bJTIZ5jdgp:othTRc/OslgJTIZ5Bgp
- TLSH T135B55A33B2F60099C44DE1769F4A872196E27C71CFE0E3DB851172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 36da2edad22eb03d94ae3688476c18a7317efd4279a542f4c711a3a54247087d
- MD5 542a8cb8d148195bcf46497a3396ee68
- SHA1 ce9a77ae7f06c9ffe10cc1d06bbfa74f797fd0c0
- SHA512 5515de347463f52917aa81a26763229aaf12f4a054e18720cc94e774dec7d74a89408227afb4cd4a847a3ea76d17690eeb6de23baa0c7d005562eb388d3e46df
- SSDEEP 98304:+y5112gYy5azzVvU69nLKnhZBslgJTIZ5Bgp:vLIHRWhLsT6p
- TLSH T150167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 e119f37c26a5d653f16164f25ae3790a208b937bd7d1d8fbc04aabd62a8f0d71
- MD5 b4a8e55e42d1aa427d0bd1622bf3fa49
- SHA1 7bcfdf6ccab5053f1173bbf058c3efc41023bd2b
- SHA512 edaec92da2b6870a26f08c0b974c267c86bb9488d2c039095a75cd4c5c3998f8e55baa87401a84811400e0ef16cf0a62163edbcf887ec0ba6b2ad4302a45aff2
- SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glyb5+Pl6bJTIZ5jdgp:mu6JmIxd2dYslgJTIZ5Bgp
- TLSH T1E2D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 2f80132c3ce7aadcd84186fc475673d3faf8a777f5c9231dc94a5da956a64a50
- MD5 935930ee6c5ede94e71bfc2e794f9f82
- SHA1 9c882acd11c818934b3b6360f5065b406eaba5cd
- SHA512 0c30d6c68a9fcdfbca12f147ba58bcf790b90f9c5f0a527f4d4aaa32c9a1e43e02a8b39b38380470aafe77327a27450dc00f33e9d52133da2df53fd93235a521
- SSDEEP 49152:Q1hpsNoJpF1A67U44CwH7R4xOb5+Pl6bJTIZ5jdgp:QmifPqRzslgJTIZ5Bgp
- TLSH T183B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 3edd9e96d8a4efc632010a94e89b1681b2818f9d59a865aa3357fe2fd3c78a48
- MD5 5f94b3854a95caa1743c5547fe355253
- SHA1 0104e7c8500772e1d723fa8e99435792323e4e65
- SHA512 2a129cb440f38bc884e8930ccd6098bfa7735e0134018af855c5ed7f04b3ead9f6d89b47f8f4b73ac2ceb32364d69fb650f5988a884d19b1064452a3de3b09a3
- SSDEEP 49152:iSuZQIY0Be2KkRVtOnks6NMHqZb5+Pl6bJTIZ5jdgp:85dKqi61FslgJTIZ5Bgp
- TLSH T169C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF065072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 1fbfdac912f9c049cd297cd45ee0b6e9ce66c6e42c18939e026f43e70497ad88
- MD5 7f5158906e2db0511f8b4698e0d22793
- SHA1 b0ac33110ec2e3bb7a7b1190d962eaa26ad99045
- SHA512 76d1023663516552f20e17f6129bf90c076c131c80aed63ab03d9cead543d54fec78bf050dcee94e1481515ea7f6e0c6af8453193b9783e7a0c193a3270897bd
- SSDEEP 49152:hhtSn8EApI0figjgiDn0AP5wib5+Pl6bJTIZ5jdgp:wX2iWph/slgJTIZ5Bgp
- TLSH T19595BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 c3e3306cb1ae8eafde2c46875f905840c9a3548012265a09d1015d98b84e2143
- MD5 5b552a00d64253f2dcf5f6f8a9e8d84f
- SHA1 ca4515de4c37b5f4d8fed6fd88cc6b957f6a175c
- SHA512 4b4ae81a9dd541b56ab25bc8e0f9e9d24a73d5ed512a7116d73957f9562a26f2b60006292082fd5ca41b1364172d3a3bb009774985f28a240a8f6a544886d932
- SSDEEP 24576:PSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Vb5+Pl6bJTIZ5jdgp
- TLSH T1386523438A6B30C6E45B5739D9C8DB00F87AAF57DD8627B6C67D1827F231389385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 f4fbd504381975233b9e389b277bfdfaff8d4d09f3d3d55e5759965e9f8d8b7c
- MD5 ae74049393ef2789f7b2ace7e649aac7
- SHA1 17b561508141478edade68c9dd15d559c81fe8df
- SHA512 5b6e0458c0a6a00294485b415ed6abf7f3b991426a13d4e01d2a90c13f19d1596e510950174ac9cdd6bdb7b3107db3adbfd1a826cd31d0cc4e0970224cf08d1b
- SSDEEP 24576:Bpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:qb5+Pl6bJTIZ5jdgp
- TLSH T1096523478E6B20C6E05B5739D9C8DB00F87AAF57DD8627B6C67D1827F231389385224E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 5d225a3bb06cd0cd62dfb04178262e758f06400ebece567840627c21ff4789e5
- MD5 792ecf361bfc4e16ae9c2156aa399b88
- SHA1 d5cca8329fb47eb08ec213359044576708e6772e
- SHA512 ed22eacad2ee00c1d9e66b959e085d8cacee3a5d85afec071720accc308ebbca766aabc4a39426b8608fe95572d03fb3554bc05906ee8cdfdd19a609a82ec214
- SSDEEP 24576:Rnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:8b5+Pl6bJTIZ5jdgp
- TLSH T1796523468E6B30CAE05B5739D9C8DB00F879AF57DD8727B6C57D1827F231389385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 5dcdf30d130405b9ff7549417fb53100e57ea7168f70a32e1fcc91f8202eb2ac
- MD5 c418d6ff53f16153f1097c3484482cc8
- SHA1 791886fa4b5fcdbb974ec61e8dc9e97c5dde4c50
- SHA512 bcc7aca0b25875ffb7c0b79bfaf896b49d5b96f16bf15bfed34907f4a32de5fa548214e0426a73ef20f7d093a92f47ac236b026f724e54b0e4faf8edffa25280
- SSDEEP 24576:Wmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Zb5+Pl6bJTIZ5jdgp
- TLSH T1686523434B6A20C5D4A79339C9D5D700F4BABE96DF5267FFC675082BAA31388383134A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 c27583c0fe95c6aa68b1dcd1e4995815629965d9211bb470216d38c84e4bf04c
- MD5 600e4f6181493afd862f44a182d4be3c
- SHA1 d60c2ec079062dfaa113e404f4a4f9ee0b051da0
- SHA512 f0477be4d1d79522d8732234c66a7b8f8b0775173cafd32393f8cee7bf6746166af3c6b3117d2e9ae564a4a9b76a67f86243877b57b2ec5911b064ec65e30392
- SSDEEP 24576:Kgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:mb5+Pl6bJTIZ5jdgp
- TLSH T1706523438E6B20C6E05B5739D9C8DB00F87EAF97DD8627B6C57D1827F231389385224A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 225821fcc5f45306b0aa8c9820c8e8f37965d6fb6844793da81692da1c3de103
- MD5 b71d2fc67f889b3794003845825bf932
- SHA1 82e5fe6d632be3c9ee6ce650b1403aca1827c4db
- SHA512 c4224a5178d396ad78fed0d2c1bb0b577faaa209f17afef4d96b39c1abb0499ab2f35989e2d735c5dc8c625c91f78bbd5c709cbcc97a049917c42a5f4c450e70
- SSDEEP 24576:tlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:+b5+Pl6bJTIZ5jdgp
- TLSH T14C6523478E6B20C6E45B5739D9C8DB00F879AF57DD8627B6C67D0827F231389385224E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 5d56110b5b3eca01f6a7c3dbd1746320923dfbc55e413145b81d7bdccb70495c
- MD5 5209dd3e8aeadf09f81e9ef59f93d8a3
- SHA1 5abb8183170a4586b71d6c98fc032f36ea337397
- SHA512 06a6962ae6fa504fb4ffaec9e5b2c21492bdd96a14e283d12d2190e8a2859b9adc72be4511371be80827fee9489409ebc961c1f59e93dfdd57f219fc722aa986
- SSDEEP 24576:Wxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:zb5+Pl6bJTIZ5jdgp
- TLSH T1536523478E6B20C6E45B5739D9C8DB00F87AAF97DD8627B6C67D0827F231349385224E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 c47f768b069c1a4a91facb2adffeef522d7ead267d3eb543a1b48c36db2de3da
- MD5 a24c1b608c1dbb5ee1d5a820d2478433
- SHA1 09a245c2672783ea9743ca91876ca77e74e856c8
- SHA512 8caef32e14b3e98d3dee8aaa25cbfe9a2d9c82abbffccfe928b11394f080568fd88df88eb8503ec65a82ca5d685a6e80c8b82958f039e6e2809cb58bb5d5b438
- SSDEEP 24576:YCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvATmb57GBiOl6a8JTth/RWZvRq:YCUAPTY+8Wg2lIL8lrIUJLWwXb5+Pl6P
- TLSH T11D65AE1EA3EC0896D4BB81358991CA06FB72782E1B2296CF1170C73D6F27AD55E35F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 9b5a3ae2c7ae7cb5891b16aeeba3ce68faf1b85188181b90db58819a2fc2ff2f
- MD5 9168d8a8edb815c2fd401323c7c55047
- SHA1 3eaaa6f63c590736e661af9ba0b7edd655265c8c
- SHA512 688cf008e88390a455747d24fff80b14e48b29436b0436569f4b5608b865150101c2976f607273bb699b39251956b2d79232a530229b948b03d212c04d0a0ef5
- SSDEEP 24576:RWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:rb5+Pl6bJTIZ5jdgp
- TLSH T15075F14AC29811D9D06E6239CB858A00F7377D65CBE293DB86E0F43E1F366846DE6703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
- Size 1KB
- SHA256 c145938e5b8e053bd03faa4aa22fd3ee5db65805be0f43cadc619fc50e7b1537
- MD5 2fc4601e77a5d2b9b281a5ceaac81065
- SHA1 ae0dae2e5fda1f1f40c09469275a9c3ca5ce17c3
- SHA512 7e2104d5dad456a7e03bde32694f3ccb6925fd4cc143856bfbfbece64811e98b59148ba7d7cd7fdb9fe9ad788719798c8b6a58f6c680544d5ce311f9ae9c79bb
- TLSH T1BE21CE924FE69B2BF2A386315AF50562FB37BE01A76C5F0F4044139909652016468F3E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Studio.lnk
- Size 1KB
- SHA256 da633586e632a05fdd5ee003ff3b57c1e77dac7ae58853a0dcc429a9110f08f6
- MD5 d2da8d86679f86dc235e763db316c135
- SHA1 0320ca8e051f0d30d2b1de53888f56720062c327
- SHA512 2b74662049ab4d6e8b436c11f2b6d1e24ed6022d6024ea8ef94a33a46cb30d479de17a327406fa6818f8c82fa171509a0d973474008455bc4f27a0d9c797eea4
- TLSH T191217F550FE70B2AF3E1DB316AB21562DA777D02F7685F5F0051139905B5201A4A8F3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\f76b3613ebb7b9e0224e2d37c8519214
- Size 9.5MB
- SHA256 2979db026346f0652c943e169ab0b944829a3cf2311b97456f3a15a2d6b7e402
- MD5 f76b3613ebb7b9e0224e2d37c8519214
- SHA1 d6a1e838221862e5d1156db53d95b8d2c5103de6
- SHA512 3ff2c9f26ef85e4122c3a09d8cb99e5bd7fc6d9e6c8afc7624a8d6413090741e7319f5df2e63d6bd45cc78961eef47f75f5454c54795fc040ef4f8d9d0ec8540
- SSDEEP 196608:aYEq/UhCY/Kp567NdzDvIDrfyrgcErNYBElBcEFdCK:avVU+Dvarfy0cErNYyr1
- TLSH T154A6CF22F941C031E9D202B2A6BD6FB65D7C9A341B3948C767C45DB845305E33B3AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Roblox Player.lnk
- Size 1KB
- SHA256 f8ca4538aba214f8d9ad1c4dd96444318803f8d8975cb03f0960fbbb47cc13f7
- MD5 5012b0842d53ae4f636a93039f18f97c
- SHA1 bb9fff5bc4bab959d127433ac92d29b74b12812b
- SHA512 98218859ee14c9ae8b37915850bbb0d01c74dc97e8c697f727634a5c68f85e08136887659fe8cd2aebc6b0a3893fc95bfbcff76d653a8b9b59e34650f29bc227
- TLSH T17321CB824FA78B2BF1A3863199F50562FB77BA01671C6E1F4044139909A1201B168F3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Roblox Studio.lnk
- Size 1KB
- SHA256 0d861108ac346784c1df22d336e7733366f1c286d4a950354b874d2f99cd6c67
- MD5 f01809fdc68ce2b516cf2f491982fe7c
- SHA1 89e59385ceec0a95c382a5273844d60c06064630
- SHA512 d613cd69130d523b4b25298a1ddabf40b07fffa25710c508b5bf366cf4adc2965db70c19ab08543d7cf18fdede7d3494544a12fdb6c43dcbd5e49fe6b3a6dd94
- TLSH T1C4217F510FE70726F3E2DA316AB21652DA777D02A7195E5F0051135905B120164A8F3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 bfa1cf0b8715ab5b04b6c982836a8a31cd4db98e89742b41c7f8dab5ff75da9e
- MD5 f1dff7ebafe8ac6687306dd5586de524
- SHA1 570f077afa2189a638b6bd7e4bfa9eb0bcb42058
- SHA512 84ffd882f23f1c973ef4cd88821a180e76380b583be03609c3baffa494e79cb9f0a148fc958f336b5f11338e5353dcf15eea65dca73cb99a841a0104ce9d1958
- SSDEEP 24576:rHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:rGb5+Pl6bJTIZ5jdgp
- TLSH T1DA6523428B6E6086E4BB5738D8CDDB10B43EBF65DF4666E7C569142AF1306C97C3220B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 067784c8e9ff49c0784525c3a7288094522bcb9a2704de10eb7043be05dd312e
- MD5 116d89b68002d97952fac6e9d2ed64c2
- SHA1 eb78e4a215cdb42ba5206e84d4339d4edeabce48
- SHA512 17830e1e5fba77fdcb2adb9309113302b78670276336918b4523a6c837323a35a8bbcb7f2f4973f7ea82d0a6e6ee3098cc20e9d29a4a3b71845045b5eb96b31d
- SSDEEP 49152:pRZwQCyiHiQEaaPnMhb5+Pl6bJTIZ5jdgp:j9xvPislgJTIZ5Bgp
- TLSH T1F285B01E63DC46A5E0BAD278CDA74407E6B278165731A7CF0190C27D1F27EE49E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 bfef5a6fb2c611f3319b64674b269d274dc4084c3ad71836f740af534d847131
- MD5 af772fc764aafbd7761da42f0e586dd4
- SHA1 ac3e4d65cd739ffe3a5bcc5801e1b0e06b519961
- SHA512 597fc6333f1d6794518b1e8dbc9430b5852eea0b7477effffa86fe00b24c914d892e69c02547cb46af375d8f3c79bd7d73547bd9740e0cecc1fb1c86e19ebbff
- SSDEEP 24576:hbxA1UG3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:hbxA1Udb5+Pl6bJTIZ5jdgp
- TLSH T1BE75125E56AD20D5E0B7A23DC9C5C205E732BD169B2163EF40A5813E5F37BE86C32B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 9abb17634e391d6782015cecc40f5e1f25d158772b46c76d7aad58f97ba77636
- MD5 c765f60dc5fc5fcb74d6099b4e951146
- SHA1 efdd26fa03f91c099eba3f72a77cd32bc6c64325
- SHA512 dc7f97fbec56221ea7551626ba906ee1ab76c617ea40ad10c4a9b9277538a8bdd1bbbbd8600051b788231751580fdf22752c352ff5b121080ea9eb2286c938db
- SSDEEP 24576:9jsmP0yHaqrVqHra44KDzMsrnImb57GBiOl6a8JTth/RWZvR6wQQ92pN3:9jRP0yHfVqzlAsrn/b5+Pl6bJTIZ5jdw
- TLSH T14A45AF2EF2B910E9D4AAD236454107B5FB71B82D1F219AC70170C635AF0AEE85E35F4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.4MB
- SHA256 f59515691455b8e7c62c3316ea515249719399ddccf12532fa53611df0343af3
- MD5 35e1d622fc0fa9485e17a4fae3dd8dcb
- SHA1 ba4ac76bf2bfa0f6fd629139dbf3cea3e23a5511
- SHA512 0502b5652f3702b799856ffa0886f3394af9fe93d3d55124d5d3ef09769cb7e2d60bde3a9903c910554e826f4c4ee3ad91e7394a97310b97094b600a87def0cb
- SSDEEP 24576:JFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:JIb5+Pl6bJTIZ5jdgp
- TLSH T1856523864A6A70C5E46B5739D9C8DB00B879AF56DF8727F3C4791827E2357CD383220A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 d2d2199301de479c257a8761e5b915a8b46e771f54acf3b152f935a0b12c7551
- MD5 7c0a28146fd89262bb9db23ecb764b8f
- SHA1 f7a7e5df5a4b24f6a77fc654cf84a6cde60efaad
- SHA512 9e57825e10a6d0b708daf1c8a68041fe3cc2dba65fe3e4745d633ab4d32f1809413b6246231eef87c65b3af601a8c6a6731021c8bd423eea991934c6c40dcc69
- SSDEEP 24576:cBLBUTrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:cBLBUub5+Pl6bJTIZ5jdgp
- TLSH T1F2850245E7A500F9E87B823CC9A6CA12E672B85D0754E7DF03B84A661F233E15E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 46494b3427b998be3ef10434a7261fab7810c96abc3088f6e5963ed7a62aea6f
- MD5 2d470e2e7c6538dce6e6b0adad5baeb8
- SHA1 0e48ce7843585a7412f02a66e762a596372edfd3
- SHA512 ac8992660a10d8793baf2eff93e5019f3eb9bb26ec9d23393469d4cb92fe41540b6dbd04f8bc98eab0660474d15f30e7da197338d3bedebb26f75f178bf44ee2
- SSDEEP 24576:gOYNHsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:gOYt7b5+Pl6bJTIZ5jdgp
- TLSH T16275F11F52AD18E4E57BA27DCAC2C609F173B866571193DF05B0827A1E23EE87C3A741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 c7a98b422381556c121e9fe6261e9651e81216cdeee46f55939466e822f38287
- MD5 69ab17e42fed48bf34accc29f597571c
- SHA1 0d8383b669f8f0a3493b8d736d1b7d0f9e06592f
- SHA512 7a78960673d3e652e0a1239e36705d06c4148404e7559f0528aa66d11c137be8f9d17722cb158e3b5760c46ecac2fcef579f16e68bf0f34974a1565421c27d24
- SSDEEP 24576:8nXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKk:8nXoJJYH84VVS6AmETJas+cHBjSSKHPs
- TLSH T12D65CF9EA2BC04D8D5BBD13DC5C28506F5B278625331C6CF026182BA7F27AF56E35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 8ca7fb6f119634e339f81cacb4f994036f4e5c462a322c8bdf0502fbc9f042f9
- MD5 1f7b37a3177a26b76a2d703f3df91972
- SHA1 64750de74ed1964a4ea49582583572e7b88d11e6
- SHA512 b679de746dd2bd8de010bf4b80b5b92eb6d46bf57ea55afd080e2b6a877b9e43d2eb7b5cd3bdc8eaa0724a59d722b45d250521e033ef3ad1b8845fe3a6e92631
- SSDEEP 49152:NDLL9TuJ0M/TYW2Pob5+Pl6bJTIZ5jdgp:eHslgJTIZ5Bgp
- TLSH T17C858D5EA3EC42D8E0BBD6BD85A79146FAB2B855173081CF0291856E1F23BF05D3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 4c4892f8e3a3296e33dc4ea4ae6e9306e62eb3e77ec827b63dab5425199d74b6
- MD5 ad8374ff78ba84b9f2c60c6bdedcb420
- SHA1 3504ebf4fdcf5e660da8afb447888e59c30032a2
- SHA512 c4aa67c3e0ba6f03242eb8e29b9fb4b0fbe10dc00f997c3aa184bca996951f11d5131296940de8574377c6b9540b7a2d0c68a4aec1050f0b8fa9c2701b7df3f0
- SSDEEP 24576:legJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wrmb57GBiOl6a8JTth/RWZvR6wQQ9+:lngOJOmPOHkib5+Pl6bJTIZ5jdgp
- TLSH T1EF55CF2FA7BC15D5E03FC17DCA968916F6B1782603255ACF0560827E5F1BEE42E3AB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.7MB
- SHA256 e85c81a8f2b654c3200645746082b3e2ada2f88d4a0551bb0bc895fb928cfafc
- MD5 ef42682c5bd198a67f5d5b95de78a8d9
- SHA1 e90bdbb9b534634ba1324c2d77eac256466b536f
- SHA512 cedac9098842d2dfa42f25e3b238aa4b52342d0b31e2c3d31fdc1bf2369d07c393ae95adaf95c576bd8bf462e0f10bfba2c84a4e20c835178934cf992d07a75b
- SSDEEP 24576:fLJnJiTk3R3waE4JrOlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:fLJnJK8R304lPb5+Pl6bJTIZ5jdgp
- TLSH T19E85D02DC2A810E8D4B7C2B4819A5B56FF31346D2F226ACB59B4D4353F12FD0A979F09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 d1e3d2020ae8ff54b2cfa755d4da86f312486fb16e776a543ca607b5835b8c32
- MD5 b7a22165d3496f818b78c5273c3a5798
- SHA1 3cee454e932a6a708a023bc0fe40a4f230e47530
- SHA512 917811f5d5a3d6e9cab70894f79744936fec7637c4f10c7ba9c094b97b17d5e330132d336bf453ac8a48dd559f7ebb35c71b7f967751de9d90f7456431bb149f
- SSDEEP 49152:D9GqCzDScAZmlvTcFg8Ph6Mb5+Pl6bJTIZ5jdgp:nvslgJTIZ5Bgp
- TLSH T161955C05F7EB5288E8B3CAF1C96694159B327C409B34F7EF4A80C96A1E32BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 d9fac4256769e0493fa2f844adba25ec59c95ae93cb8df3f4058ab24892ba77a
- MD5 87551274f42aad94964d9073cba609c9
- SHA1 5267139839c9ceb89c471bff6b6d21c7278628df
- SHA512 d132514cdc8c136f0cfdc2874e03f99d1e946159207a82ccdeee3e6d911aebcec5f3156bacbf401244597112f1ba1a170ee7b0f168aa2707755fd6d79c3998bb
- SSDEEP 24576:FlYJeXm5jUuEbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:FlYJeXmRUuESb5+Pl6bJTIZ5jdgp
- TLSH T13D75124E6AAD30D5E06F923DC9D58A00E372F5629B4227FF81F0C07A9E26AD53D35B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.5MB
- SHA256 b76cf0ffc87aeb9a627faf33491e9e9cf6c110252169552e4cfc6ef1ae530b7a
- MD5 0200520e150cd51cde4e9019e0e8df36
- SHA1 c9807b11257f191ac36d92db8cc5d9728a3a0a8a
- SHA512 acc4bca54523c42f764dea21aa044e722fbcaad8e4da80ba36c7fa11b5690dac189a68f2b9e9dcec8950d2c7859db2a6a245b010d8c6d1e27acbc719329bc14d
- SSDEEP 24576:16tyomb57GBiOl6a8JTth/RWZvR6wQQ92pN3:16t0b5+Pl6bJTIZ5jdgp
- TLSH T1C175124557A960C8E5BB0738DAE68350EE39BD21DF1157EF81A0E63FAA327C47831706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.4MB
- SHA256 c5a32c2a420ade6de541b970512d058193d5fb5bf5add881c58983a5cf8838dc
- MD5 f45c458c96eefee01d8d87915dba3ae8
- SHA1 389f757b3cd9a10adcea1fe27a0fbff6a6b48b9c
- SHA512 f7156a9eeee6b24c447779d15bd88bfdb86dc8d396b8632f3f0f8b39d9422e411fe69bd110ea6f74b166b71546d0a4da31d7849da5fb46d0a456d5b2b340e1df
- SSDEEP 24576:rrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:rib5+Pl6bJTIZ5jdgp
- TLSH T19465234A4A6A30C9E4575739C8D9DB00F47ABF65DF4636FB84F89837E6352C5383220A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 fc7da0cccd1df48c9d864dedf2153c5ec48bd6742ab202620302f20355a6148b
- MD5 e168b60de234d6656bd5ff11860d7c65
- SHA1 f6900fe3afcd40af7ac28736548801438b2d1fe0
- SHA512 6d16dad8c42a8a95e2720caebb2dffe3141db76233278f4a548afd11ee23c1a1edf6fcc7c8fd576b3225f2ac31af1ebd5ad789e0d9306c90c22fc7bd9602dd29
- SSDEEP 24576:bC+TyQIu93VAumZr7jm2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:b/TfIq+Y5b5+Pl6bJTIZ5jdgp
- TLSH T11D558C1DA7F919CAE2B6C675C8A34493E933B872176186CF2044C07D499EEE8AE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 b9d216144af3bece7e43355ab59cbda7c329334d91a092a52798de7fa23b731c
- MD5 ead8fec72769c8e789dea75f89fd003b
- SHA1 7e1adaafb4909c69c17404ee42f10c6f451987af
- SHA512 c055119f873c86539297f158a57d8a2489bd282fa1d69753d58c6012e35df038a048e4a2440a4a1e2acf6a6ae3c8c742b637398099d72aae63db2372a9920dbd
- SSDEEP 24576:ILQikZ/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:+QikQb5+Pl6bJTIZ5jdgp
- TLSH T1F675F10FB7AE1095E0A7C23CC8858201F6B3B4759B1267EF42A0C77A5B676E97D34B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 c14becc00ec4758da35358988cbb35ca7fcff1fb414c5e51cec967465a8c73fe
- MD5 27aac188664d10d33437a299f7b63e26
- SHA1 711c7288be739cbbfd65af5003e1d9f66b665621
- SHA512 9b02890443244e8dda38fe70d84c8434b824d6b3b5ea23e385d84b1ba0b802a0e3eac706396a7df1214b7ecbed8d70d4c6469d748b0da6ed026475216272b210
- SSDEEP 49152:QpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPfb5+Pl6bJZ:BpC7b4+80GTkCslgJTIZ5Bgp
- TLSH T1BDA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A39F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 4b8068b4a258ad14be570b499be1a1b89a9b9ce766086771defc0acf56d14bcf
- MD5 59a9cf53825b4d4a07d7628af50bfdd4
- SHA1 28171b5bf722677bfe38088cfe08709e8550f307
- SHA512 b51701122914c05adf5acdb699b4e657e90e4928372cf4bf4ea3d9413ecf9eeee909e9e204d7fddea2e689d7ae3beb9bd5333da695b64eca4422e4ee3f3a4647
- SSDEEP 24576:xSAwJPE1IDAo+4Kt+l4413lUQAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:xqPCIo4Kol4jQ3b5+Pl6bJTIZ5jdgp
- TLSH T1A255B01AA7F956E5E17AC7B4D663C601FB727823533163CF8290813E0E16AE85E36F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.8MB
- SHA256 6d3ad3fc241c011e9da4d93cb832cbd566753ebbe611306b2ce56cfaa8c098b6
- MD5 3b0a0f4907cb9fe2eac75571bc0499eb
- SHA1 bf738bbd086753dd0652e321443b04a436f53a72
- SHA512 5329673b0c8bdabb9b86d81420a929e0a5da71c321367b728f27c52dca8890994be0da68501f3dd394396a3c375b41e61119fa32a82b3a9de29675b94c2941e4
- SSDEEP 24576:nyLXPLcp94twmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ny7Po0tnb5+Pl6bJTIZ5jdgp
- TLSH T10E85E12ED76D04E5E47AC27CD6A38A06F6723CAD437166CB05A4907A1F27FE47939B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.6MB
- SHA256 b1ee19a2d86faecdefe3c4f5b54ee09f148515e33713215393e23d4be0f9089c
- MD5 aab00d0cb2c47d54892f98cfe527a0f5
- SHA1 1064fa44f6708d29f733ac0d78b07c771f646ec9
- SHA512 aac3bd956bfaf3687c02a05b3f9b58e51de68ced73fc86dd52e1630efb033a0246187f2ee401f08be91f6e56ae4b9a0e1e5f5d0249b0a78dfee7dcea71179185
- SSDEEP 24576:5Wv8qjpPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:5Wv8vb5+Pl6bJTIZ5jdgp
- TLSH T1C575124E46A430C8F07A4334D9A6C315D476BD769B556AFFA0E8D87B87317C4A83BB02
- MD5 SHA1 SHA512 SSDEEP TLSH