Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 16:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
General
- Target 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
- Size 10.2MB
- Sample260730-vdpvcssemc
- SHA256 a2efe2434b513753e938ba4579f5bf8413e8d77167d5b148bd79bd7c534e548b
- MD5 dd4486bf8f0c949ff81f6d8e6a3b447a
- SHA1 151fbe42e60b775cc8bd2289359e5f84d5d58248
- SHA512 847ffa636a3e404cedadca4c3134ff93da7af05d393b5835ccb75dd03899eacfa9e94b8c99b2592234e25ce1f96c98469ebea672dff47639f43eb593b2cfee9e
- SSDEEP 196608:Im4L3+yKlLWA4MhfmsxfMgkjvJZ/LSZ4UrbW8XeN:IzKhfmsx0gSvJZ/LbUfNe
- TLSH T11EB6BF22F900C032E4D100B2AABD6FFA993D99341B7954D3A7D459BD59305D33B3AB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 5 IoCs
resource yara_rule behavioral1/memory/4164-9-0x0000000000400000-0x0000000001447000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/4164-69-0x0000000000400000-0x0000000001447000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/files/0x0007000000024596-347.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/files/0x00070000000250a8-429.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/4164-572-0x0000000000400000-0x0000000001447000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Executes dropped EXE 23 IoCs
pid Process 4440 alg.exe 2500 DiagnosticsHub.StandardCollector.Service.exe 1652 fxssvc.exe 3272 elevation_service.exe 2912 elevation_service.exe 1608 maintenanceservice.exe 3768 msdtc.exe 2408 OSE.EXE 1616 PerceptionSimulationService.exe 4896 perfhost.exe 3056 locator.exe 2980 SensorDataService.exe 4860 snmptrap.exe 3092 spectrum.exe 2896 ssh-agent.exe 4392 TieringEngineService.exe 3100 AgentService.exe 2404 vds.exe 368 vssvc.exe 2544 wbengine.exe 1652 WmiApSrv.exe 4752 SearchIndexer.exe 2992 RobloxPlayerBeta.exe - Loads dropped DLL 1 IoCs
pid Process 2992 RobloxPlayerBeta.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e30540a579c0b0e8.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2992 RobloxPlayerBeta.exe 2992 RobloxPlayerBeta.exe 2992 RobloxPlayerBeta.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\Discord_large.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble2.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\heart-medium.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\MicDark\Unmuted80.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_1x_1.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\gr-send.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Emotes\Large\SegmentedCircle.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\crying-xsmall.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\WindControl\ArrowUp.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChatV2\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\PlayStationController\DPadRight.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\MenuBar\icon_leave_highlighted.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Controls\DesignSystem\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\SelfView\SelfView_icon_camera_enabled.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Emotes\Small\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\InspectMenu\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\MicLight\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\HWYGOTH.ttf 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\vr_idle.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Players\ReportFlagIcon.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Vehicle\SpeedBarEmpty.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\configs\DateTimeLocaleConfigs\ja-jp.json 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Scroll\scroll-top.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Radial\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\MicLight\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\ic-arrow-right.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\LegacyRbxGui\Granite .png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerDark\Unmuted80.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_6.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar mask-90x90.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\loading\loadingCircle.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\RadialFill.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\families\AccanthisADFStd.json 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\HingeCursor.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\scrollbuttonDown_ovr.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Input\[email protected] 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\MenuBar\icon_minimize.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\MenuBarIcons\PlayersTabIcon.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerDark\Unmuted40.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File created C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Radial\Menu.png 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 1520 4164 WerFault.exe 86 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000520eb2014420dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000623aff004420dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f5dbaff4320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f360d5ff4320dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007aebddff4320dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fe696014420dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4f584ff4320dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cdfe3ff4320dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f9fefff4320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060c252ff4320dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe - Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-145f189a6a974303" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-145f189a6a974303" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-ff6341faef444107" 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe - Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2992 RobloxPlayerBeta.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 2500 DiagnosticsHub.StandardCollector.Service.exe 2500 DiagnosticsHub.StandardCollector.Service.exe 2500 DiagnosticsHub.StandardCollector.Service.exe 2500 DiagnosticsHub.StandardCollector.Service.exe 2500 DiagnosticsHub.StandardCollector.Service.exe 2500 DiagnosticsHub.StandardCollector.Service.exe 2500 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeAuditPrivilege 1652 fxssvc.exe Token: SeRestorePrivilege 4392 TieringEngineService.exe Token: SeManageVolumePrivilege 4392 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3100 AgentService.exe Token: SeBackupPrivilege 368 vssvc.exe Token: SeRestorePrivilege 368 vssvc.exe Token: SeAuditPrivilege 368 vssvc.exe Token: SeBackupPrivilege 2544 wbengine.exe Token: SeRestorePrivilege 2544 wbengine.exe Token: SeSecurityPrivilege 2544 wbengine.exe Token: 33 4752 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4752 SearchIndexer.exe Token: SeDebugPrivilege 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe Token: SeDebugPrivilege 2500 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4752 wrote to memory of 4560 4752 SearchIndexer.exe 119 PID 4752 wrote to memory of 3444 4752 SearchIndexer.exe 120 PID 4164 wrote to memory of 2992 4164 2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe 123 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 41642⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 9242⤵
- Program crash
PID:1520
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4440
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1944
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3272
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2912
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1608
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3768
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2408
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1616
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3056
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2980
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4860
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3092
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1928
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2404
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:368
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1652
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4560
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:3444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4164 -ip 41641⤵PID:3240
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 90287f424939628a6909dc578829deef5ba9da17072e4a57b484b608a86f86a3
- MD5 08ae186ca5eec7f656ae86e147fbd56d
- SHA1 8f5a10767033f7dec1902dc39a1308c2b5da984a
- SHA512 1e21f8c1da63244d7d4d0f58234df14da7ae67a2644dcc0a4d42a0f0e5847fceda52281d50df821db1a92c8e75ace3454cd73dca911c1d3bb0cadca6f2e832ba
- SSDEEP 49152:Zb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnc6mGvKVO+n1:v3q60jBLXeN+1
- TLSH T1EFD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 00594d7c12bc7c07604498c40b52823d197f1678291f78da40bc7833d91c2e21
- MD5 f366f4bd26bc1721387ea1b5cadd98ee
- SHA1 64a9f19ec1c164201c871c6cc9663345eb6c490a
- SHA512 231ff3d159ab6de9c25cba5333aec5b72471bc7bf5c36c5a8d4f9bf526b6c52da0baa56d2b7f6f7f0932ec5fb80f96acaa899f1e82bc3f7c3c6c91bcec272486
- SSDEEP 12288:V1XLsswWkxy2lRq2czA/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:7XYfDtczA/6mctvE/BT76+1NCE
- TLSH T17C850224779504F9ED6B4278C9A2C112EA737C9547A4E7CB03E4892A1F333D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
- Size 10.2MB
- SHA256 1122e11296cd9c7985dafdc86741bf53d0ea2cabaffc04168942007744b338b0
- MD5 b3910d46f87f05b8fa901aae7712ea42
- SHA1 b5b07576ba8ed2fa27bb9f6d1658362d7874fc34
- SHA512 bae97d1e51fb38123bf795b6b0cca166a2adcf186c78d7ede0350ce1a728e8a1123d15954cbd0aec1adbe80b4c9b866af02344c3a4c26f957785419e1649028b
- SSDEEP 196608:ivgkZi/+KxW/hvjyysmsxP66IM5e5QIHqZzcz9JXeN:iv3KpysmsxC6d5e5QIkye
- TLSH T180B6BF22B900C032E8D100B296BD5FFA997D9E340B7954D3A7D41DB95A705D33B3AB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.dll
- Size 21.2MB
- SHA256 269af4ce0111e647c0a7ca5d7f1e29d769c880fd6394bf03f8a368e5c34761b8
- MD5 42aa3722cc784eb50ec34b639665a129
- SHA1 2cd51a6517fdd48dc01e322b7590c93712ae5fa9
- SHA512 9570b27b9db7bd62f57d40f49c22fc536f58adc436cb7f818c943ab03b3839d4b9526b925d4bc0e9f9b4f440df6cfa045ecd8406f9df66048c041e328720eb3c
- SSDEEP 196608:mTQLBStMScC8/lZZKPBJw5v8zOcPAhO+D9T:mT4BShEv87Eve4hOaT
- TLSH T1EF27C08EA4D20AA8C6A25071F05F46D3E662304C0D6C6DF7C6FA02603673B9D6659F7F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 9d33a0610f843fa5a07e5f9ff4fe42c1aa2377a831576e452574cab086d45e33
- MD5 4bb5fa7f6e90b376cc7e47cba56a6063
- SHA1 a7eb54b1d1fd42d6c2c2fe5866891e65ded1dbbb
- SHA512 6a580bbeb700a62c97901cad6b13aa6fe10aa76ec9f6b16ef74291d50430c346fa8e9f5c2661768baaec8d600316cd71aa38df207fe9723a410ca78c001f64b8
- SSDEEP 12288:5XZNYVLeyUji0h90ZD0wxpGZIVutrHsktM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:P0Le5ji0hmxqrMk6mctvE/BT76+1NCE
- TLSH T164959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 1ee7330b4dbbff89dd9b51f782c9798cf1dd6ade7e4111c1dc445b73a7b5e583
- MD5 33acbae1dbb0d9445360fe26fbf60e5f
- SHA1 d74a78305951a86ed94d3c50b95cef143d02a2f5
- SHA512 092509abf489f3565c8618b47223783e61403c352bef930a86a0d1ac44e1a05bfcb075e39a4d48ad160c4a3aee8ba17f0599c9fe75e6fbcce7b109526c3ed5ca
- SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWr6q8wyuy6mctvE/BT76+1NCE:y/ezSC6vUzPviHjyt6mGvKVO+n1
- TLSH T131755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 dbcb00c5c7dd53de00f6ce33a4176aaf94a497b5b8f82272296a5ae4fe5564c1
- MD5 c24d31a3dee9dda177a1eee87bc8d369
- SHA1 00a48ffbd658eed08ba2e18fad53c90372e1e599
- SHA512 74c55ceb76270265dc9e4c4ea66be400a2cc12849b40c09d5ab18835de304e34b1ff6c3c97a3a4a56acf07f796df6170208d0c04fda87081ea35284bba3843f6
- SSDEEP 12288:WVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im987tM6hct28uP18WR/FW2Gb8JTCMx:WVbqPb88hv/l+b76mctvE/BT76+1NCE
- TLSH T14655AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB1246D72C3E677E6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 d47a0e7bc6986ceba7a214980019434ac022ae8c02ee19bbac66eabb196f5bfa
- MD5 4ef9cecdaa5b1dc907e3898dae2640b5
- SHA1 6cbcd28e2b589858d1113f49cac807faaa1b798d
- SHA512 1936b6f5a260a7ac19a7cb151ac457d5bf37971049c5023c934dcf8c2d998489240f7c4a8ba75e18ec7653ab0348209b85b4aaaa92f78dc56a7be9d6b7cfcefa
- SSDEEP 12288:uMQtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:uMQ6mctvE/BT76+1NCE
- TLSH T1AD652382881B11D0EFFF07F06395E296E8516EF974DA1C81D322991F9D30162FD4B9A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 2b90819a4426309560eeb0bd2a5fcb1e180714018ff9b9b03d0f4cc2763ec1cb
- MD5 3b3f53e919887361b33a81edf385eaaa
- SHA1 bb3547c533086aab7ce026ad834c908ec1225c72
- SHA512 170bafef539629aed30bce55edfda7d87c805ce0d0885798d60c6b2b7613bd905fe35fe71d06e96551f28a6119d81e4fa65fee0ccaf8f71855d969451b0e2fcb
- SSDEEP 12288:2eBNUbTVO86UjtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:2JIUj6mctvE/BT76+1NCE
- TLSH T12F85CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 8aa41b1b4841551aaaeb2a293961f67d99624beb958a6ec824b979313f32f5f9
- MD5 357c30f143f5a8d71aee45ee6bf64f7d
- SHA1 7c0c669ea41306e7ab29304fd2beee59c46b5e90
- SHA512 7ab4b5affe60f743cfd8b249e8216bc63e7d2c23ea98df1d8ed33e98b992b3793337f6f94e8f21667a42dd8d39e7436745790cc1ac56a741c7fc5114b0538b99
- SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THd:GQvGAdlCEL8c/RRNw5CiXeN+1
- TLSH T1A8267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 13356e6fe285c03b96c0c9c7c4b03c2e0fa3164653cd8f06bff1fe2a2f4049ce
- MD5 96fedc316a6e9ee0a2e376396ca7010c
- SHA1 ed52156e71d835f008c2de1f7ddafe139067264f
- SHA512 4d03093f8abf7f50fffd2d605ff8e21af7996462530fd66efded9b66af4a8cfc84c4fcb1bdac9c287e9578026e8d1cee6785a0fb3f468af34173a89211eecd7d
- SSDEEP 12288:iAwSfxL/2Dc3+DLLmt0LDQewsAj5tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:nrewsAj56mctvE/BT76+1NCE
- TLSH T1A185E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 da42b66f33777392096c3c771433c7700f13a659beb9ec7763b6ad8974b02637
- MD5 bf18e2cc84aa83ea7eb97de21813f8b7
- SHA1 559574e81fe3337968712cd157c142ede04178ff
- SHA512 c3f3db5fda855cf4307842ae60b1ccd58f9c78e94537fed9199f6e40c69c95f6bb60c6d88b5cb4e24b21bf31bfa55b0920d5773453655ed1548ec59ad93bc3e4
- SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHRXeN:wUEtQevvqc2W1cpV2RI32Re
- TLSH T173474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 a431b6dadd45c09887549246576aaf4b8f06aec1dcadb9fe997b0a8d24aeac03
- MD5 aff5ee45d7ac74a71cbb592ac965850e
- SHA1 36f0e303d444dbfa8eceb032a8f6cb1ca5657d7f
- SHA512 4432e322e184c2a43463570909ea70d86e35b9c446e2e5a2cebb76d3dd81d2869a63109d0e1533cdb04660bfbf876bed5ada798613b969aa24956451b0f5d1a1
- SSDEEP 49152:ECbRquA/m2yL5zQfFiV+XenmE3/zZ6mGvKVO+n1:NoqtVjnmWXeN+1
- TLSH T19AD58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 f83e5d01f784c626c6728108fdb1c288e6e237c5979a9cdac512fe77fc6b2ab7
- MD5 2cb73c4e170f349176e14daa4ff5f660
- SHA1 31f51515e48d434e09ca0f72231940f5588e0a6c
- SHA512 ab1d93162e969791926b5667cb0cba6a9b419dd6a72fdfb073f2c9a6e4179bf472cf92c4784aed2253b0613f98d71548ba0e3dc5cc189cd03c4a15ea702c6e3c
- SSDEEP 24576:YAhGL2IFoiwtA5l7S5326mctvE/BT76+1NCE:YAM1Foiq5G6mGvKVO+n1
- TLSH T15D359D81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 df517d78449dbbb0b239376b88caa56c229f9b6b65d829eacf29e59650558672
- MD5 e41cdec46998fb6e277fc2bd37ee6424
- SHA1 2b7ddb6656c3aee6aa464b9c3c24b520c52b4055
- SHA512 b06bd1c51aafdd76a7459e5de475bcb3fba78701f9a2d8bd2f8cc74032ddbfe8a60c6f9203916f3bb101910806ca3c4b74e4b29ae36634e59e2a4c639f9ee439
- SSDEEP 12288:imw5HEjsChNDBFgl0WDm+CStM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:7wu2OWN6mctvE/BT76+1NCE
- TLSH T13F75F14676A508F8E9A742788657C136F7F2BC513A25DB1F1360C61B6F33261BD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 0970e569299104b929d3d4de0718012cebdbe3bb2ef40763762ef622ee667737
- MD5 412bb450fd6e497273e9272d5e7dd043
- SHA1 5f49058afcce5c8617c2e40c223069884cdd0b3c
- SHA512 48460ee51918ca275065a4f317333f61cab77429344f1d91e7e1fdf7ea4b9f080ddac9e887cf016b00133b12746cdbcd86a84ed7755c8954495cd12463e1e3e7
- SSDEEP 12288:NMZ1IyptM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:iZuM6mctvE/BT76+1NCE
- TLSH T146651286226520F4E5E702B8C9E19245E77178E6377603CF5221466F6F33AD26D3AB33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 d130a876cf728752bff73405d37a16b0bfd29b1e3950b37bb10463d2a86fc255
- MD5 ddfaf96bd37986ea05bb3b24408e550b
- SHA1 9c3ee960324e034d487cdba4c4696c86d716fd3c
- SHA512 b4e65136798af13da15901bf53feac6ef4428a5e5a36405600db32b772e9e91d3e91d870ba014b956ffbb41afd669756afa325a2fed50c665f79693c447dd45a
- SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UZ:CQRQyi36YOcPhLvw2gAf+PN3nXeN+1
- TLSH T1C9667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 e63988d59e8e8a09aa502a51bfdcbdc522998a1c21cddfc3f1ff04f1ed7a56ac
- MD5 48cb1aa96729800a6ad4840710d571c6
- SHA1 cf4aec97336fcaa5e7840b957cc8b3d8661f1ed3
- SHA512 c3ed4d33b3d45766c0c1ed03de982e41dbaebd6de4eba374130c424881ef32ded6d72d69f9a6a23054a44aaae8c7c5f0e7db64e02cf7011e5410f9483047c315
- SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UZ:CQRQyi36YOcPhLvw2gAf+PN3nXeN+1
- TLSH T199667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 2f8b1afd2d238a791498dea55c382ff8813514bb00b75e917ed35d801c29e511
- MD5 0c8fb1c3c9ea5c9d550e28ee76531706
- SHA1 43fc1b69333720c6fc44b3cec930fd93a4afcbf3
- SHA512 7d92a112e7b13bee430eecb337d5f565c810da905f27fe954713796dbe7ca1d98efcc91167b528f9467f27e45ef48d2447b5f9c2a12717847ff6e77196e17ad1
- SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0c6mctvE/BT76+13:Y68Qg55nhceWu7PNU3/J6mGvKVO+n1
- TLSH T12CB54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 4d022b1e1c275fb82d22462c80403704e92c833dac135aa0f45abf9e64bb82ab
- MD5 c67449cb9a7ef1be67c8495e07a79846
- SHA1 7e27e66b329097becd699eb607ecf63a2096d7db
- SHA512 a269d8f20be4f1528d8f1ba7a4c8cb63f31eeae386b6a1c42647b69070d53e2a58dd862c965269213500f16965d913a725d92ad00b011d5f3c43d58a19e405d0
- SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99b:+y5112gYy5azzVva69nLKnhZQXeN+1
- TLSH T165167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 6a5d5d655e87de964cb66fc5bbde97f0f554d3977e2e2b4b0bae03fd90b6cbac
- MD5 e43b4e9f536dd9c595c8fbbef9571ebc
- SHA1 39be14cf710bcefacaa56ba6069e74e53ee0313e
- SHA512 f07224c26b75b3ea1a6fbe7ba247a71aad31d7428a3bc3e776d14a9317b91b9463dd45d551a35c228e6e2dd187ab427464963acba42d76aea7904a71de588621
- SSDEEP 49152:oB+taZ3usBWOBr4tEG20bqx0z+n217aau1glP6mGvKVO+n1:iu6JmUxd2dPXeN+1
- TLSH T11AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 f5ad3e26e8f0a716b7ae6e3da631f2aad904ac2675b3d4b9f7406ddf267e14be
- MD5 03156e39859bbbf0c2557c1c49b900d8
- SHA1 db9007a7b3f037b5ea2545748e90bd4e671bdd84
- SHA512 824b76a41ba27011df60bbf4e613517b470493dc489683f003d1832a7099b99ab826dce10c61c382523668a5107598b1918c6185a57215acdd251e9d5d498754
- SSDEEP 49152:e1hpsNoJpF1A6BU44CwH7R4xD6mGvKVO+n1:emifPkRWXeN+1
- TLSH T131B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 61b8ec274df12ed52e34a4d6c6629c209a4b0c5023d805dd07f6f72d5f34b2ad
- MD5 3d0dcdf473464c0fa53d9e23b7cb16b3
- SHA1 38750d8e81a05ee519f7bf52043457cd4cc6d63c
- SHA512 40ecd4aa951d9c960273b3031c58e1bdc2bdd81d30f8945e572d8b2ce4188390719a35747817bca4a48809826eabe9a42b9365db6782e7662bddc5bc6c7b3d79
- SSDEEP 49152:qSuZQIY0Be2KNRVtOnks6NMHqM6mGvKVO+n1:05dKvi61MXeN+1
- TLSH T160C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 c9251d06aaa4af908f6d9f475acc7688d3306613da2af65bd0ed206da16bba99
- MD5 b467398f2e7fb5c19314f5fff490ddd2
- SHA1 2223d9525c8fc7db015fd191a74d35fd36b1fd0e
- SHA512 7695350729f172e4a4c2e3f70f50848dcc1431b7d6ce7a48a66226d233bb7bac7d9762c5df58ab7b2871d17836742b9d6f3e5b568b0c4d7bb8c61caecf713d16
- SSDEEP 49152:EhtSn8EApI0figXgiDn0AP5w/6mGvKVO+n1:FX2iyphaXeN+1
- TLSH T14195BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 c24c04155f4278c53ba0a9aa2a0a532df11600bb41a4612dc7a63d5c52339fc0
- MD5 723da84a48de7873c1701b8ddb58a30f
- SHA1 65bff07a16ca4e06db685641b2b6064300c421b6
- SHA512 47be161ecfac0e032363e477b806ad089a8e5ca5e2a8723f76edd3880e60f48bcfd03372817b536dba972a619b85d43e2e587edc5d28e3888f00eb2be96cb38c
- SSDEEP 12288:vYtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:vY6mctvE/BT76+1NCE
- TLSH T117652381981B01D5E9DF07F09395E296E8502EFE74DB1881F326851FAE305A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 68b3e38e73bab32bc3dc3699ae6943588d50d25e62456d4008a896e2e5ace2c5
- MD5 c557926496dd1fcfe8ed0511f6fc1975
- SHA1 f76a79f80c86cec33cc905f798d405730e2bce5e
- SHA512 015080c93bfe95adf213c9e7119ffc8c1c3fc39a41c5138c73faeca1afc50447cfaddb14d0424bf48c790c1676c7eb7b9441ac7ed82ec3150fed3873c8fd0b82
- SSDEEP 12288:qltM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ql6mctvE/BT76+1NCE
- TLSH T129652381981B01C5D9DF06F19355E29AE8502EFE74DB1881F326841FAE305A27D0FDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 7f6afe57c4e9b3a9a442123a2bbefd8dc41df74141623c81337603bb859e891b
- MD5 bd3292ea91340edd87585fd5819d807d
- SHA1 55e20de6ca30b86dfacaea6b2c93d8a658c7d542
- SHA512 2d891a654a83e94d3b7cecd3eea25953907a76b9e81587abb3aff111dfe7ec7d637c106ca4cc0691293d291e25a4e02b6cb9aa43341fe3a272a13f55f660e712
- SSDEEP 12288:HLtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:HL6mctvE/BT76+1NCE
- TLSH T17F652381981B01C5E9EF06F19355E2D6E8502EFE74DB1881F326841FAE705A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 06afd2bb6e2250946fa428158cdd678afb558edc23d5e6b2b4730c1918877cb9
- MD5 b31254b63792a8054a2bf10333f71f7a
- SHA1 909ec4dc80801049db1a06b0cf61bc62f399de1f
- SHA512 2068f16e4f99037faf7fd579a1502a942f3a190fb8b28ebf0648073aa636d3893fed112ba86cf4508e75e769391f1ea4a4a06914c413c8b52e5e1023bfeb6656
- SSDEEP 12288:8VWtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:/6mctvE/BT76+1NCE
- TLSH T1E3652382691B01C0D8EB43F0C2A2D296E5B07DF975A719CBE311491F5E313917D2AFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 9f2516cd3332283570d14b26ee7935748bdb5c59a2c3c01b38eea2ac4695d384
- MD5 251558103dc6457eb0ccb4f2811e2a9a
- SHA1 73651f343a6227cbb5158c5afc0dccc39953290b
- SHA512 b5d7a1515ceaa1eb1ec6788e516bcc0ebc391d36f9c17049f74d7bc326270393e5d04b991fdd9ed370cb1cfbdc9d18fe4d7c4f1b49c003532295788e9fcbc14c
- SSDEEP 12288:6utM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:6u6mctvE/BT76+1NCE
- TLSH T1B2652381981B01C5D9EF06F19355E2DAE8502EFE74DB1881F326851FAE305A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 5b171e655e12620ac490939b89f9ecd329af619e2fbf6d0d89fe46fa6c801a15
- MD5 4aee3ba54eee3e0193402406d7cc7c38
- SHA1 04ec0af7b732011c20ae62f84352177c2929ebbf
- SHA512 9622a969b23889519fa9f8730fe31de1e2b78429d5ad86cc65f630787a833dc7c2e47e153b134edad1a480463954cd2ad52decc24c487a6cc467c694e1e0a4a4
- SSDEEP 12288:bBtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:bB6mctvE/BT76+1NCE
- TLSH T1BD652381981B01D5D9EF06F09355E29AE8502EFE74DB1881F326851FAE305627D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 7a33b0669402f238ad379185467c3d665f90f953c81a63ff0f1a58f01ef7b8ae
- MD5 61f21652ce54d9280d47206a09c8c68b
- SHA1 7014b06ca776f2e90c94d38429f89e790f1c8fa6
- SHA512 c2e86d4e3560e1ae973e731d8e98ecceb289c47e2d42b5ee38630b329748bf3f59d1ea87a7334b9a73d21441b74c62033c5bbed0ad46c391e9f6ce908d9c9ab3
- SSDEEP 12288:/dtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:/d6mctvE/BT76+1NCE
- TLSH T1D7652382981B01C5D9EF06F09355E29AE8502EFE74DB1881F326851FAE705627D0BDFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 f21e327f91bfb5a6c8f55a0d099558b42ce5e9d6f3c9a8b5fd364c404e41213b
- MD5 91b94a769a407f4621d4b7aec52e9a4e
- SHA1 d59dcb04568ea1534dfd8f6e212902c23e157764
- SHA512 c394508e4fa7dfbdaccd188067089ec5422e18f0560a4be2b8f944fd4fea53f9d4d381422efeaf01b7e51e5528b85902ac141f29c1384b5ece98fa950d1bc8f5
- SSDEEP 24576:hcP4mcvIjkGOxhKP2l71nNKbrh/8KB06mctvE/BT76+1NCE:2P4m4IpOO67W8Ki6mGvKVO+n1
- TLSH T12965AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933D7F77EE14F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 cab30f8327873595f89d529d1b32aab6c9ef3d85010fa6a1cf546edad7c9de29
- MD5 616474066ceaac8973536867371c551a
- SHA1 f922f60c934122a5896ae76b18223befa2b97f3e
- SHA512 584563a34ba3743b2098e12b635aee74d77ee096608acaf0f429ce14bce73a489bcba27da5594147bea0d19c63c02abfcd5dbc46ecdc4d1d1e46f6da13eb09a1
- SSDEEP 12288:q1sfMtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:vM6mctvE/BT76+1NCE
- TLSH T1B975F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB63D0F53E1F326906DEAB53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
- Size 1KB
- SHA256 b3c636a0bc136d2ea895f33022440d9fbf34c14720791ef5457300179edc0758
- MD5 ee50146e8a12358f6f2e6767fa90a64f
- SHA1 b795576ef194caf26ebe73f7089a813298009856
- SHA512 c4692a1e23c359c42b999f5bc897f845b13f5277a20924a3d61cdbed254fc230db999efad33c4fda4c90051ea00006547afcd6c82cc240855716e5b28aefde79
- TLSH T14821EE540EDA1729F1F3973168F85252FB36BD01FF692E1E40C626482666102D8A8FBF
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Studio.lnk
- Size 1KB
- SHA256 8dfc9cab6f4aa814e4e8459dfdfdadf077817ecdb5e6a8099d5cd94d244f7e85
- MD5 1765c55bcf759fc1da2b4a6248a52f9d
- SHA1 274b93938a72548363eda452b6dc4cf7682e31c4
- SHA512 dea5a3abf5831995a3957914a20b0353cb2566c36d94da47d1034a790b61ec1518c16350c7213f092dc2f13a420da87e481a82a0b75e339002344ea84b4f583a
- TLSH T1E921EF480FEA0328F3E1D73178BA4251EB727C01FB595F5A00C1164926A5102E8A8FBF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b37da17b4c0f17be88c1a4d8ed38f779
- Size 9.7MB
- SHA256 6fe4e34d4140fd0dcf70dd5d489a56c3ca6b6de28fc19a6745a3d7eb030c6f90
- MD5 b37da17b4c0f17be88c1a4d8ed38f779
- SHA1 65f6b893ece9c5f0038ba2f3bfc08d8cd1133d38
- SHA512 5659c01c11e750083d29b206ba1abc477e638920beef28f9180f7c8f148ff3c8f1d715b3e052e5afd43a776bbaaf99a69618a94a18aaf474150f3aa3ae6c8021
- SSDEEP 196608:lm4L3+yKlLWA4MhfmsxfMgkjvJZ/L8Z4UrbW0:lzKhfmsx0gSvJZ/L5UfJ
- TLSH T130A6AE22F900C032E4D100B2AABD6FFA993D99341B7954D3A7D459BD59305D33B3AB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Roblox Player.lnk
- Size 1KB
- SHA256 d5da82d4ec2ecd3aac9fcc14d485190f8901d433ba6d27a6ce583d36c0f398e0
- MD5 2be5d6bbba956285eab5a6b8d2bda376
- SHA1 83eb809200db5188da1b1fb0748130dc61e207b4
- SHA512 8cb7855cf03cef28c38e5b04c531efe61f3881c05a6c02dd1ef7c39816f3bbc733e79d33d355e2a09cf435b7f11924c6e198f9986115eaa9dc34d1fb57a06064
- TLSH T1AF21EE500EDA4329F0F3973268F85252FB36B901BB586E1E40C526482A66102D9A9FFF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Roblox Studio.lnk
- Size 1KB
- SHA256 cc7db8af08e027667cc7447970355783986bac4fabecdfe4c2c1c6375f1a72bb
- MD5 606118e35024c04baa6499eb8c98c2bb
- SHA1 e58bb0d37749f9a1198b10296118d35c9af0f5ac
- SHA512 3bea6c7827228d346006d91356a87d32703bc59deade44df45585fabbed2d08ec0873892c64e1bdbc98a823838669f7a8f473cd82ae60dcd5cb348719df53f28
- TLSH T1DF210E840FEB0328F2E2D73078BA9241EB727C01FB495E5B00C5174C26A5106D8A9FBF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 a15a80462b720d3302d8fc281c6583ef7485549c57dd1536572c2590d998e70e
- MD5 516168b54c9499f3813fa3eccc631c84
- SHA1 5d5e0b23293074b776b38c3d0a2234ef5643fa7c
- SHA512 3e7c410fd666cbeab10f6710deaf7ccfac38b413d1b852716300302c9c4868ee6c7ebfa1b51ac0cf4c2f52d4f38ff976a616d728a473809c357881dad0e74aee
- SSDEEP 12288:HstM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Hs6mctvE/BT76+1NCE
- TLSH T1FD652382D91F0185E9FF07F05255D265E8153EF97C9A0883F212852FA9305A2BD2BE6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 3ac4b10eb0656dd0b57664d5fc96954b69cb95c393d69244357555c5ea6c2025
- MD5 bf43c8fa4309a3f0918bd5d89abc730e
- SHA1 4b09b6717597f76ac1b2f3195eae008b11fe967b
- SHA512 43adbb450e6893b941c9e60bd04304f9d9c37270a0887f6a14c42acba66c27f74be528b529b7981774661b8d2b45157cc59da4eed3e58881e0b3ccf7e3b0164d
- SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQu6mGvKVO+n1:Ka0hNYG4JwRXeN+1
- TLSH T13485AF1E67EC82B4D0BAD278C9A6814BE6B2B4261B3156CF1151853E3F37DE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 74eb26bdc32d18e4032a4887e6e274494f57ae7d6e4ed0972702a690b411a300
- MD5 7a73b24c8bffa220e8487965974a7dac
- SHA1 b228554c4af546519f780e901836590b2f6f6274
- SHA512 d8d8d970ba168b78320ab3d4fe4ace5479cce47d60c425c73b09fac83bfd73856669ffc95c5987354fb765b7dc251fca9b0f42f08374a5d95783d2a352960054
- SSDEEP 12288:RhbHjfX1tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:RhbHjP16mctvE/BT76+1NCE
- TLSH T13565127E166E10D4E5B692BC82918246D730BCB5271257DF6392823F4F33AE45C3AF92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 e7b541044f130a66e24986039311ddfbfd3f8111bed8accd134bc859d8ded179
- MD5 180c8ef7f0fbdb1f74d877f9d87ea253
- SHA1 036a1aff0dd5a35fcbe46b958a2350609591d59c
- SHA512 ffcf070d53c9abfc9e8c02d29bfba95de4d304b0054d3127d9b808b54b189baa1f4cba1f2322449312469bb9a7a8b8ab1aebec9010415efdc3335e573d6ef3bc
- SSDEEP 24576:K3YgnJcRTk4yti+R5dBR/N6mctvE/BT76+1NCE:KIgnaTk46pBR/N6mGvKVO+n1
- TLSH T1D545BF2DF2B910B9D8AAD236450143B5FB71782D1F209ACB0170C539AF16EE85E39F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.4MB
- SHA256 564a387ef6430bc7054b34f431992b97153190e7d684bfef5fc5a478d48c1b12
- MD5 5e076dec62c7e8959797efacfd8701c3
- SHA1 fcb439a27ddaacf43b681c43118bb9a6a42ebc67
- SHA512 e724f10b8ad9697c5dc064837ed9daa51a8f79518b622fb3da99bb4098cca62b492d0b4869f9ed109686936281153130dd043c971ff952cbde1c8044f0010b99
- SSDEEP 12288:0wtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:0w6mctvE/BT76+1NCE
- TLSH T1A6652381941B11C4D9EF07F05256D2AAE4502FF936DB18C3E226851FAE305E27D3BEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 c56f4a902b035c31731493a2d32ae07abf74d047eaa48430544952365a5ac93a
- MD5 1aae601f6c5ff032eefe3af41188d4d7
- SHA1 b072109821a17afd1850a0a13262b56851b0b4b9
- SHA512 ae618f8b1fcff949f11b70d896ed6ad277b0a4403f27d5ccf231e1872f39fdee7b81b0b27b32daac797f414e94d4e2ded2ad398b4fca493d07544f99b0d99403
- SSDEEP 12288:6ObQA4LWOsvAYFT/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:rIL3UT/6mctvE/BT76+1NCE
- TLSH T161850145F79500F8ED7B817CC9A28616E272789D1364E7DF03684A6A1F237E24E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 4729db469dcb77feeb2ee2d835d03f12337a449e5e86453e26fbe211d6d7ecf2
- MD5 698cc9ad939994af1bf059620dc98dcc
- SHA1 efe00b8e76280c1b82e251f28d026adccd3183a1
- SHA512 647f909a073aa8b94da32b743ce824454e14c85723c5cc2f8bba0aa76fa350a37c06402bb09da0c14687c78ea0b07226cf316c16cfaffea12e800ec37fbba263
- SSDEEP 12288:ApFtVODtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:aOD6mctvE/BT76+1NCE
- TLSH T1EC75121A36AE10E4E47A52788682834DD37178F6176217DF4290817F5F73BF86C3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 908176bc01e2af46e171f91b66a627b4a2e0b4722958f10a27d5bf5c60d68938
- MD5 b1719419eb7d90f6bb537797882283e2
- SHA1 7958f9c6bc97ff828c237d8bf1c352a9ded97346
- SHA512 39c4eb5ecc731ce8133799300acf37490a74f4e306c11e08713cf64ce4aaaf80181ccb16f4b0b4d88ff4b86e90192b1a30bc44bdc291206dc4f9697a27b3751c
- SSDEEP 24576:V7NM9YqZqmWMUkPjZM48Mv6bEhs86mctvE/BT76+1NCE:V7cBWMpPjN8DbEhV6mGvKVO+n1
- TLSH T1F665AE2E6BAC81D5D477D13DC9A28206F6F1B4611B318ACB5162833E7F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 1f0c6730faad4efefc17c5e8e4fac0a1de76bdf38cac1140f7a549a243e09718
- MD5 411841b57bebf571857a1c6e279885df
- SHA1 e67bcda271a81a965878b63d7e3b79bf32bc44d8
- SHA512 ca6eed9fc4b7c1ef7b4c056a0285a5291a5f2e6e160e01fc0fde91f46c6c697ccd880d3ae1b4114f40a859abd36aa39cd0284dfdff35289b70c4687956d8d4bf
- SSDEEP 24576:kW6BApg2YuyuNDYTabvcdvNYf8km1q6mctvE/BT76+1NCE:kF2YuHNETovAvNYf8kmc6mGvKVO+n1
- TLSH T1E7858E2927ED80A4E0BBD2BD45B6D246FAB2B8511B3055CF4255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 609d9900bf292f3d90f83b0bf15a194d6e642f6d8d59a7e4027b5fa87850a6c6
- MD5 051dcc3e16de655d79ea7280dec2a14e
- SHA1 42a2df3c0caa6d4b4d5d9bf20295f86e17b2c7c5
- SHA512 7b912df7e748c780f5588e5efe802606e563cc13bb963ec715967a4cb4a283662942c26bee665f4264f4104a1a90f97da9cf7591568f08090cdf5cbb9cf1062d
- SSDEEP 24576:qAFs06+OmlfQNXEbToH6mctvE/BT76+1NCE:zFs060lcXuO6mGvKVO+n1
- TLSH T1ED65BF2F62AC00D5D07ED17D8A97C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.7MB
- SHA256 b123359eb0adc9962905002e845613998ce3756f7d64bb110789c38713e032a2
- MD5 5e7da14bc899f1f5881b5ee6e5d7fef9
- SHA1 e877f144fd28fdafa712e30a9641d703b4a17563
- SHA512 4880d06a82421bd59ec71a7dd2ba938b5908aaa6dc1852665be5e4c2163ec5fa824cba4585df5234f384c6ae71e2d7c7bdec89203fef8c093bf697c26023b768
- SSDEEP 12288:QCJnJ5D3VkrRzxctM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:lJnJ5D3WxO6mctvE/BT76+1NCE
- TLSH T1A485E02DD2A810E8D4B7C3B4825A1786FE72387D2F2269C72474D5363F12EE0A979F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 03d0c8082dd97c1237de7fb9740522a293c8200eee16e382c9e87cb175e1f226
- MD5 6017082d965579976c4f907786eaac5b
- SHA1 f9de6c37eb5dd0cbdec47bbc7bb9867801292517
- SHA512 f2a092d658055f228c29bc22700c0efac3efb7c9bd476271c1033a93658188f370c915029ef72d1b6ab27c3ea95d9adfecda00eb5848d590e716ba31b6dc0b7a
- SSDEEP 24576:IEPghm6/7IIXdwcXrif7qQncjlP65i3VuN6mctvE/BT76+1NCE:ng06DIKdwc+eQnSt65aVY6mGvKVO+n1
- TLSH T19F955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 4c14bd54996aa2c35961b605d7212ac7749ca71a36c44930281b5664103e80ef
- MD5 d3f85d875cdfdc85e14fe91225270a55
- SHA1 8ad74083158b38873e7fdeb83384d2c74b10db98
- SHA512 f97bde50b5e1addd2a71a95bfb06bcf0c5c773f3a227d6a9eab408835df794d7e3c696c6b5c7eddcc35ea87c56bb68f4ed985a4d7b9b3744430155a02e859a89
- SSDEEP 12288:IEP3R8StM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:j8S6mctvE/BT76+1NCE
- TLSH T15A65129D261E20E4D56B51B88291C245D372F4F42B9227DF52A1C23F4E33AE52D3EF52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.5MB
- SHA256 3a4612049cf5cf1bf4c75ffa4dd36850e733b9ebcc7dd8728992c4b9c87c8491
- MD5 93731ef42175240d2c681eec7b294e74
- SHA1 b8a755246d99b82f0015ecc3565d02af194b058b
- SHA512 031f279ae23af6dc4f4a954cbdb0509e9c07eb006805158398578fe78712a0071b211ea2ebf0be81af2512ce47fd224dad01ac0c703924dc5d97abaa032bc28a
- SSDEEP 12288:FjkyltM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:FIyl6mctvE/BT76+1NCE
- TLSH T1A8751241635910C4E9BA06B49663C295DA70BCB06F2616CFA190E63F6F327E0BC36F57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.4MB
- SHA256 c9ae701e21fe422141c8f1fde714fa7f830098e5cd5b88a55fa3684bb11fbc26
- MD5 75e36dc799eaf60fd78a6aa247250fe4
- SHA1 e39806b7c1dcf84acd5000e9a8666542728b6d99
- SHA512 0721fd3e9861adc3aa8e24afe3f5f5407760a16720dc02e69985c1056d15c35a19d8f582192863e0fb1e5997e0f9c86e29036337e4f8cb91d4749c0463be16cc
- SSDEEP 12288:5RztM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:bz6mctvE/BT76+1NCE
- TLSH T1ED652385542B20C4EDAB07F04355D296E4603EF93A9A28DBA2A1C53FDF301D2793BD97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 e4a14a7df4aec1efc4b1ba4b371da1a0b495db159700cc55fc8fc585ef3128dc
- MD5 3e02b45aed63e0984a56c03dd68ac255
- SHA1 5ede0df7b18ed87e319564eff6e6f355c8479125
- SHA512 b488282e0a08255aa2edc794ee9c38188a9702640b37971e316d8f9d0c3c664c29146c5288a5a864e727ba5b0b146f69021e27a51d84f72090c1cf9408b7afa7
- SSDEEP 12288:SLQZb3C97GYnZMv5zBcKY9dMD3EtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WrC:EQ9MxZKdcz9dw3E6mctvE/BT76+1NCE
- TLSH T1C6558C2DABE905CAE177D27595A250C3A633B4311B31D6CF2448D03D4D7AEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 ac09ab4593b48072c3cdc19aa1173c7d4a270c32bcd3f6e007853e164986fa31
- MD5 4b852d8230f0211afd49f0f89af2d262
- SHA1 897cc833c1448c8e81189ea963bcc84fb233312d
- SHA512 d564041a71705e606be68cc076941834d30e1a55da5df91159eee74ed061c4a56f481776fc4272ae5570c44d26bc187aec78af00496ba5e14c07b1472809d49f
- SSDEEP 12288:fyoKo2CRple9p5tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:fyocwAp56mctvE/BT76+1NCE
- TLSH T14675E05FBB6E00E1E176813C89858345E773B4742B6217CB6291C33E8E239E9BD35B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 0a569c873fc22c09061bb86919686787812948a147251ad4f055516d000f43c5
- MD5 14236b9c4f4ab05621de80ba67899272
- SHA1 8614cccb68b169b07497c4cc7818d994a93abea2
- SHA512 591f7ca1b6f28c587f4f2329615c21bee49a548f47f54470dd0cac97b18db2659c548d0ed4f45129d1df664461fe7d7cd58933dcb5536038aa1e445159d84cb1
- SSDEEP 49152:cWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK56mGvKVO+n1:W0zuNI/XeN+1
- TLSH T1D1A57B3DA2BC00A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 fb2ac5450e284cc047af271fd24b15ab3eb23f18096d0ff7714507c7ffce36aa
- MD5 37df030f7b13fb0efb1fd4373fd404ff
- SHA1 c33dd915da254827a72945b95a18ef88f1930d09
- SHA512 4db75cd4c947dead5bf9d6de40d9bf07d6102064f7cab22e5e07affde1ccc92ba8ed563f8c7135af86e47bad6cea542a36174051ff4c66cf0f1c7756c2f5b05f
- SSDEEP 24576:/1QT7EcpfxR+N5AWAz3ooiYsjMqbS6mctvE/BT76+1NCE:CTDxR+N5YzTujMj6mGvKVO+n1
- TLSH T17955B02EA7F905E9D1BE85788B23C512FA727861033193CB42A0C17E1E779D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.7MB
- SHA256 1bfba1c924bc76e07a50a670fc5e826eb27c87fe93c64f9417dd918accc60702
- MD5 1d29980f5022aa005fe5fac50ef4d782
- SHA1 7a7dbcdaadef790c05c079ef09d7e3b6b755583e
- SHA512 1ba1601ecdea67e279cc748ddf423a4812d31786e4f1ef7244ec98d83e44a3d35dfd556c32ddf139cddf02d4d7a642216adcd0159f04e46f5011f8ba0e534a62
- SSDEEP 24576:UTMdOz0FFS+AmSLW6mctvE/BT76+1NCE:c0K+AmSLW6mGvKVO+n1
- TLSH T14185E17EA36E14E5E47BC2BC9643C506E67234A5032266DB0690C17E2F67EE4393EF41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 e873dc928ef8b34b17cbe2aad4287017887af8e7d8e9d44ab551e98b04c3958f
- MD5 803e231ff9bb66b2be9746028b553f88
- SHA1 c6613a5991e438da64c025ba8399c428caabf0d6
- SHA512 484032bf4f92594e78445b0c5d327549ba0a9e334539460925ad75efe01e1a80950397c51b3972060419d02e226fe0baba90ae7a066a046f07030a347b39c987
- SSDEEP 12288:S4Z/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:b/6mctvE/BT76+1NCE
- TLSH T1D465124962AE30D4E8B752B086668256D530BCF6336619EF31E0C53F5F326D1A93AF13
- MD5 SHA1 SHA512 SSDEEP TLSH