a2efe2434b513753e938ba4579f5bf8413e8d77167d5b148bd79bd7c534e548b

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Size 10.2MB
Sample260730-vdpvcssemc
SHA256 a2efe2434b513753e938ba4579f5bf8413e8d77167d5b148bd79bd7c534e548b
MD5 dd4486bf8f0c949ff81f6d8e6a3b447a
SHA1 151fbe42e60b775cc8bd2289359e5f84d5d58248
SHA512 847ffa636a3e404cedadca4c3134ff93da7af05d393b5835ccb75dd03899eacfa9e94b8c99b2592234e25ce1f96c98469ebea672dff47639f43eb593b2cfee9e
SSDEEP 196608:Im4L3+yKlLWA4MhfmsxfMgkjvJZ/LSZ4UrbW8XeN:IzKhfmsx0gSvJZ/LbUfNe
TLSH
T11EB6BF22F900C032E4D100B2AABD6FFA993D99341B7954D3A7D459BD59305D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 4 IoCs

resource	yara_rule
behavioral2/memory/1948-0-0x0000000000400000-0x0000000001447000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1948-87-0x0000000000400000-0x0000000001447000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x000d00000001c51a-99.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1948-415-0x0000000000400000-0x0000000001447000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 13 IoCs

pid	Process
3884	elevation_service.exe
2936	elevation_service.exe
5704	maintenanceservice.exe
1608	OSE.EXE
4848	PerceptionSimulationService.exe
5976	perfhost.exe
5744	ReFsDedupSvc.exe
3596	SensorDataService.exe
5144	ssh-agent.exe
2540	AgentService.exe
3564	SearchIndexer.exe
5704	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
4924	RobloxPlayerBeta.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6b8d39c283806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe
4924	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\families\GrenzeGotisch.json	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\families\Sarpanch.json	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\PathEditor\Control_Point_Selected.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\PlatformContent\pc\textures\sky\sky512_bk.tex	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\PlayerList\NotificationOff.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio-14x14.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\sky\noisefb.dds	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\NotoSansThaiUI-Regular.ttf	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Emotes\Editor\Small\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\ErrorPrompt\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Help\AButtonDark.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\Misc\MuteAllSpeaker.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\AvatarExperience\broken-avatar-200px.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\models\Thumbnails\MakeupEnvironment.rbxl	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VR\hoverPopupRight.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_17.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_19.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\families\HighwayGothic.json	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\AvatarEditorImages\Catalog_LightTheme.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Radial\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerLight\Unmuted40.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_5.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\ic-notification.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\advClosed-hand-no-weld.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\scrollbuttonUp.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\InspectMenu\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Players\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_12.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DefaultController\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\PlatformContent\pc\textures\sky\indoor512_lf.tex	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\PlatformContent\pc\textures\ui\Shell\Icons\PlatformLogo.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Radial\EmptyTopLeft.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\ShareGame\icons.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\dropdown\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\Inconsolata-Regular.ttf	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\ShareGame\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-ingame-12x12.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\ic-resend.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\CloseButton.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\ErrorPrompt\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\MenuBarAssets\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Players\Muted.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\TopBar\iconBase.png	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6124	1948	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce9c5cf44320dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002600b7f44320dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000332158f54320dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b120e6f54320dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e1fd8f44320dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005d5a3294420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006d3a1ff54320dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aaea71294420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-ff6341faef444107"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-145f189a6a974303"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-145f189a6a974303"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
4924	RobloxPlayerBeta.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
3884	elevation_service.exe
3884	elevation_service.exe
3884	elevation_service.exe
3884	elevation_service.exe
3884	elevation_service.exe
3884	elevation_service.exe
3884	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2540	AgentService.exe
Token: 33	3564	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeDebugPrivilege	1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	3884	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5676	3564	SearchIndexer.exe	100
PID 1948 wrote to memory of 4924	1948	2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe	104
PID 3564 wrote to memory of 4292	3564	SearchIndexer.exe	108
PID 3564 wrote to memory of 2328	3564	SearchIndexer.exe	109
PID 3564 wrote to memory of 5328	3564	SearchIndexer.exe	110
PID 3564 wrote to memory of 3312	3564	SearchIndexer.exe	115
PID 3564 wrote to memory of 2420	3564	SearchIndexer.exe	116
PID 3564 wrote to memory of 5960	3564	SearchIndexer.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_dd4486bf8f0c949ff81f6d8e6a3b447a_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1948
  2⤵
  - Executes dropped EXE
  PID:5704
- C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1948
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 964
  2⤵
  - Program crash
  PID:6124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1608

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5976

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5676
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1948 -ip 1948
1⤵
PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f602d529f14c455928d5ba292737df2f960ec52ddcbbd597a71dee2e98735b5e
MD5 bbbce1b7ca9ae62e8335a5d4b4ca876f
SHA1 b9b0856ed003dee92996f38f20a3b11bb647972c
SHA512 b30d8c28654c4950373b1bfdca33bf36a4e9616df1e4c4bebd93b14d67d1f6af54510e2ebe63dbc6f800396dd9d091b24e58a8661c68fb416a7dda69cd3cc7d6
SSDEEP 49152:Ob+632BuPkFKRrdE6ohrstBhuXjfS4LWxnR6mGvKVO+n1:Q3q60jBWXeN+1
TLSH
T13FD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 59cee2a2d35033ed5d77b0dc4eba5bb5a487bf15ec316179f28197c1d01aca57
MD5 9b6c7ad1f0bad3b06feff4d62f34cd4e
SHA1 60d25719f13545a9f4911b6264415686571343fb
SHA512 33be8812c82eaf0fcc4a7ce71487ddf0dcabacde64219210d9ea6d126323657e8bf8fd25019d2110bdb8fc98a6b1bd6252afaf004293e25f918239b5e4d6cd22
SSDEEP 12288:Q1XLsswWkxy2lRq2czACtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:GXYfDtczAC6mctvE/BT76+1NCE
TLSH
T149850224779504F9ED6B4278C9A2C112EA337C9547A4E7CB03E4892A5F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 a33eeac3fde1d1f99de2df08d63faa818ffdfcf2ace6a37e11bec1fe59409c5f
MD5 ad0dfa05fcbf007b1e2e535139317ae1
SHA1 8bff45114123dad46374913eac070a7255ca57df
SHA512 98e470bec6520eff7ff701d3448dff3682c39a1a9f95211595cb6fd5fde63ba26aeb79ccd32fe7adc1ab3e27d551474e41d4e56c1e2d8f01d4cfe9715c7c234b
SSDEEP 196608:ivgkZi/+KxW/hvjyysmsxP66IM5e5QIfqZzcz9P:iv3KpysmsxC6d5e5QI8G
TLSH
T17FA6AF22B900C032E8D100B296BD5FFA997D9E340B7954D3A7D41DB95A705D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.dll
Size 21.2MB
SHA256 269af4ce0111e647c0a7ca5d7f1e29d769c880fd6394bf03f8a368e5c34761b8
MD5 42aa3722cc784eb50ec34b639665a129
SHA1 2cd51a6517fdd48dc01e322b7590c93712ae5fa9
SHA512 9570b27b9db7bd62f57d40f49c22fc536f58adc436cb7f818c943ab03b3839d4b9526b925d4bc0e9f9b4f440df6cfa045ecd8406f9df66048c041e328720eb3c
SSDEEP 196608:mTQLBStMScC8/lZZKPBJw5v8zOcPAhO+D9T:mT4BShEv87Eve4hOaT
TLSH
T1EF27C08EA4D20AA8C6A25071F05F46D3E662304C0D6C6DF7C6FA02603673B9D6659F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 c40501b2fa16479d61af36f0e92e1b9f89a6e2102bd9ec069445b30c91d29f14
MD5 882469dfc869b6238c4b3522f9213a26
SHA1 81b808d8ab2af0eb074b140ba792c4bfabaa7353
SHA512 fd29cda9370a81de8106ff6c4c3927976f3d106987e2ab8eb850922c156fa95451fc17d58e43004f1ec647d6008226de88012e5ddfab6327e80d8cd821da9661
SSDEEP 12288:EXZNYVLeyUji0h90ZD0wxpGZIVutrHsJtM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:E0Le5ji0hmxqrMJ6mctvE/BT76+1NCE
TLSH
T18A959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 332fa927fb33dc575f0e783b5846472c5b44d06bf73a843eca86f7c811a9802d
MD5 798bee7382d0ad1da346462e9ded9c5f
SHA1 02e524cbebbf9a2b9a6c8528d118aa8fcffe5f86
SHA512 9fc14aa826c9ad4a22c13eb0cdfeabe458586300d68669af52f2d296fe84d842df11a6eabfe570b804f4c9154a69852fbaeb00380feab5bd9a551b8bd356d12c
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWr6q8wyub6mctvE/BT76+1NCE:c/ezSC6vUzPviHjy86mGvKVO+n1
TLSH
T100755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f11022b29a270f7408b044b699c5bf20f3841bbff936b3c4cf7d2a5fa2205633
MD5 80450487ce126c254e8de05c0c3b8858
SHA1 f500d0eaec4302098a0d8fa8c107ca26b839583b
SHA512 3646390fced0654b034bcf84fe31c4f68775fd4df7f59f2820c4263902e73fe3ace950f451276448bae04a5f4bc95f69a35b9a7b6febb5c5e08633defff7d90a
SSDEEP 12288:lVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98mtM6hct28uP18WR/FW2Gb8JTCMx:lVbqPb88hv/l+bm6mctvE/BT76+1NCE
TLSH
T1E855AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB1246D72C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 b5d8d2636542484523ba217228ea97243b2a70bb9eb915ba30f8996c5d963639
MD5 db640c1c6b92f9f0cdc43e91857f5b98
SHA1 9d46d755ec082b4c5dd0351c6cac47bf16502c93
SHA512 73f500b941a5d9e0323f73b190d94d3ae2d4445a4973b44ddc500d27bcf266521703f4ceb0bfbee796a62e766ee9c25afc7c7879a3b62a5751e24dd438a07dc8
SSDEEP 12288:OM9tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:OM96mctvE/BT76+1NCE
TLSH
T150652382981B11D0EFFF07F06395E296E8516EF934DA1C81D322991F9D30162FD0BAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 d516e32305cbdf71e9ad1f06f91bf952e479be0664961f871eddfb1b2cb477b4
MD5 02f74d1b9954807a273324a0898df585
SHA1 05042e27f0b4970b867f5feaa1d636adb8469c0d
SHA512 d6a1ee682a6c16696bb0478bdd7ebfdab866de793ff1da82ec9e31f3884565a74c6d33bb53b7c3be92450ad0005b8716284084228a47e3e3aa0ad9e77f44f4f5
SSDEEP 12288:ZeBNUbTVO86UetM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ZJIUe6mctvE/BT76+1NCE
TLSH
T12885CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ba1068c98dd8307e40122d6e99cbab3253930666d2e8e05d9f2343d036103bc4
MD5 c848b44d6db0fc7a043cf761ae726422
SHA1 16a996beed1ddfec65d04481eedf0ebe57fc8127
SHA512 aaa46a71e2b2b11c27a1285a116bb041dc623bce6e493f285f72ddf44fb8381b34059b83a5a9076c92485dd38b223b43c67783ff8d48484ab5652e2a398069e3
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THw:JQvGAdlCEL8c/RRNw5CrXeN+1
TLSH
T11A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 15e5f88390950b01cd30414461a7bec184a61d58eb5a5621b7152ea6b1ad8aa1
MD5 2a7cb4549e9c9179ab5fb93ec1243a9d
SHA1 6d2f085e94981ae314af2cb734943b9046e172a2
SHA512 b280ca66d8a5ae66afb8fd8d0bfe3a202683b360599294b4bc7d1053f3772a01ee0872ae019090615cc67d19dc1231f41dcc20bcb48c14f156d1220ad486b169
SSDEEP 12288:fAwSfxL/2Dc3+DLLmt0LDQewsAjwtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:orewsAjw6mctvE/BT76+1NCE
TLSH
T19985E031FE75E036C6BF0DB21B26D316547C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 69ee30e8f655a78da2323f2072eccb7b91a248c66eb7d00f6e62c1eb9454e78c
MD5 19159feb05bad965e53ce1a4daaed0b6
SHA1 5fd55bbe7e1d43436898a84f064a23aefc09fbbd
SHA512 28ee1bfd30d871fe0b506fb56187a9006bffd9411b94e392aaac0cd1e4164624e062befd1f6a5283f56a01b34d31ef33667a6989e3304e99d65f0603475a1725
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHYXeN:IUEtQevvqc2W1cpV2RI32ue
TLSH
T12F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d312198670a5f343cbb8f5dc19060f7fc0fc956e45bc9a7a752eaa5956461570
MD5 8b12562be67790c242c280a6a08518c0
SHA1 39cdeb3f14461cafd148538b1f41f49ec045317a
SHA512 4efdc242ed09547044546264a3c3b0a46bb9f97b36e2884798d24df641db195a325d5c66000ff257279e3525ce07810a5423f87895c1b65389b252b7f8358ae3
SSDEEP 49152:bCbRquA/m2yL5zQfFiV+XenmE3/zQ6mGvKVO+n1:EoqtVjnmnXeN+1
TLSH
T12FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 26de48996c0e225770fd28606db21077eab365bee1e3ffccddf696519a27aad8
MD5 9f176c3b9f452d76d106b5a3eae3c8c5
SHA1 adecea080056fdf3256c582bb681930e7194a016
SHA512 2644a523c6df60e425e8363c08b4b699fe9003c33985552ed24eab7f83e8229fd679b518dfad2f612f2cba46d00e23459993269400e763be6d1caeff787094d8
SSDEEP 24576:7AhGL2IFoiwtA5l7S53H6mctvE/BT76+1NCE:7AM1Foiq536mGvKVO+n1
TLSH
T1CC359E81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 cf021b0056a6fc51967ada09a05333e0d5f2e3e440ce554a4a9fa8112b26ae61
MD5 e522a2f050d15a3b0f3feab2987b0e07
SHA1 f3527fc834af9a30d4b78ae3933e0a173696dcd7
SHA512 02f464a565fdc3ecd5f36c44a7ea26772971ccdb02b20abc7d301f09676037208fbc3a2e8bf179b78182748c05a058aad4f092da4c6ee2dea2fb046a375d9577
SSDEEP 12288:dmw5HEjsChNDBFgl0WDm+C7tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:Ywu2OWc6mctvE/BT76+1NCE
TLSH
T1DC75F14676A508F9E9A742788657C136F7F2BC513A25CB1F1360C61B6F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 63bcbc67edd38589b822d9ef90007bf769956d9ab468be69612d30d9cbb0f3ef
MD5 28a2cb8d43ef2e3627338addc30fc128
SHA1 3ea9e15e05eab3846bd4e551100f9dcc372464e6
SHA512 1caad09de5ce015c220cc5515406342faf4fe2b9a0338727f0084cb279adcb7be936f10edd1b726b2017b87740ac4540a77b191e5bfa2be454a1bc0780a7c306
SSDEEP 12288:JMZ1IyAtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:mZuh6mctvE/BT76+1NCE
TLSH
T108651286226520F4D5E702B8C9E19246E77178E6377603CF5221466F6F33AD26D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0a0b8ef32bcb2aafaeddb44a1156fc1b4038e0327a707aeccb0ad77d1b3a776e
MD5 f33c2f6fb7068a8a6c0141415bd7380d
SHA1 0320b13cc6e589c968f86fdfc3434e5740871e85
SHA512 03aa46fc08f73c16ecbf64d88e8046a9b378729c26ad31cb74b12ed4455068d1eaad59c68af24fc8035920e52528834a49314a8c2a32be3a8bf8e7f488f41a48
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uk:lQRQyi36YOcPhLvw2gAf+PN36XeN+1
TLSH
T15C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 809a8ebcef62c68f60f37ec7aa6df04f592e7cba824de305fd16653880f84ab6
MD5 21140bebd855810d658e16c38ac6167d
SHA1 e15a5c7fa4ecec7db6176b4211ad9babe401035c
SHA512 0e2caf5a59e9af69a3c6d9c5fb0ee6a35040ce69cc94a23f58d3c42abd0f8430f4c2d2944832beda4009191dc076e848237d5519d4a509c5301fba24c7f507d9
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uk:8QRQyi36YOcPhLvw2gAf+PN36XeN+1
TLSH
T131667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0515569085bce47df5b3d8ed10dd707e3a0fea7af074b598f26125f4604ec62f
MD5 59b36bbf15788d8fa3006a10c7e75a2b
SHA1 abbbab2b7be92ccbf674bb52aee883a5d5cc3b06
SHA512 5e80f7604dbe8b268d5910ecd80f3fa87429f89ac0a0c2289aea8ff092decb213fa4d9123b76f48180c9dfb1b7982998144812f81ede64809807e6aea4805eab
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0R6mctvE/BT76+13:w68Qg55nhceWu7PNU3/g6mGvKVO+n1
TLSH
T124B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bffea52e9c65e8f67611c8f0cabde0a1c05123f4589c418af486e1e6babfe13b
MD5 6e41bd1c42e882c8475fa6a810d4d396
SHA1 6b4551427e02d2d8708241133948ecece1111f45
SHA512 326eef95c5f861ab5dcb9ed3587d2004182f18edf96a4026b6a3adcfc58cc18978176d0dd1e50b14ef3f7d39906eaa8dc021ed4c009f96f43c80b6c84a4657dd
SSDEEP 49152:N3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99y:cy5112gYy5azzVva69nLKnhZ9XeN+1
TLSH
T19A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0e3073520b3d302a185052e0873442c88f93980354e7db85d954be6ece8afa5c
MD5 2b99af3072c38a4410bf532889102833
SHA1 25f357a29f8de1857087f0687d936ed44d0ef207
SHA512 91ab85f67c4b30f676756f2984bd885374676dbaee6349fc6019f3aa48c8d0e6d9ccaaef0d1dd07d2c209544e9bb13056eb52895d7211ba28f6e6d897cdc61a9
SSDEEP 49152:lB+taZ3usBWOBr4tEG20bqx0z+n217aau1gly6mGvKVO+n1:Lu6JmUxd2dyXeN+1
TLSH
T16AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb6ad6af848d985896aebae3e087a722af154c16ae9cde94e427aa652a292a6e
MD5 e109239f67063e1a21ce08b05df87f60
SHA1 a53ac936a113d67dcebe5122d0109c1c7d8c6840
SHA512 4f1f3710db13e87b5b66bc8cb80f285f6cc733834841944be08a00117c9daa3efe273c8e2c7455ee2b0069af5de0bc34eeb4fa2ea6b36074d43881def4b8868a
SSDEEP 49152:d1hpsNoJpF1A6BU44CwH7R4x+6mGvKVO+n1:dmifPkRnXeN+1
TLSH
T192B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8e58b9d43fcab3d648334fb8d1aac85ecc74082f12a335f6dd95c8f9e977a996
MD5 911bf2b6fe46bd5a98c384a649c8a443
SHA1 fb4b71df4fb9b06b58036ad95faa925c880c7f6c
SHA512 ad12363e6b83e33cc3743b14354f11e6d9fe4cbe1d12931f8bcb4f5eb981a7f8d5c478b3ccccc11b5b95b621ca57eba22ac46a38e9f6416cc4138553893b961c
SSDEEP 49152:zSuZQIY0Be2KNRVtOnks6NMHqh6mGvKVO+n1:x5dKvi61hXeN+1
TLSH
T1A8C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b5420ae22aed268f9be757f1050f551557c76d7cc8badd975bba8d3183e962af
MD5 2f0823b2fc00c9bee075ef8c08f0be33
SHA1 2e429b57afd0299a519ace56fff5bd3b5f046e3b
SHA512 2f0c83cb128af539aba2d75067ba02a3270bd47b9fb96898e5dd1f6af652fab9a1d45398273dbadbfbc2908985716e97d57f1279bdac60cbde49023029225daf
SSDEEP 49152:/htSn8EApI0figXgiDn0AP5wC6mGvKVO+n1:uX2iyphzXeN+1
TLSH
T11C95BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 be0b44a67823c857dcf4ebb148901608b4f60aaa6bab338c42c0c6b2254d8777
MD5 59ee91f117850f0633f8b0b98775430b
SHA1 94aae17c27486f13acd1f6fdec47a32ade04c568
SHA512 efee1abf2b9cfd6036ba7f26f08ba1db8b59bf1b5facf1b042ebb978d788df503357bf307cb92ed509ab1fd741df9b2f28ef32cbff4e628b7d561776a5995bf4
SSDEEP 12288:N1tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4X:N16mctvE/BT76+1NCE
TLSH
T1D1652381981B01D5D9DF07F19295E296E8502EFE74DB1881F326841FAE305A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 dc2f36e70c25a939f822035f406f7bc19fd09cc4c88481cd7fdf833ca70d4698
MD5 c1a58387a6a711fce4dfc48c384d922d
SHA1 ab69947e48ef258a1f477299ea4bbdb0ad3eb085
SHA512 1648fb5119bbabd164eb4a202a79c0cc4de0524ae978999f4e3b0fb80947be10c38a09756977ff3c29ac3dbe75ef3eb873b932735d4a4df95bf2881f7fed41d8
SSDEEP 12288:NEtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:NE6mctvE/BT76+1NCE
TLSH
T1A4652382981B01D5D9DF07F15395E29AE8502EFE74DB1881F326841FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 809d29bbd99c9d559ef80d6820443b66f2fbaedcce100c99ec41068a85d72601
MD5 e12d39ab129df78d7ca5328e239592fe
SHA1 afb020db372e8684d01d730dd2fd539e559e459e
SHA512 9161533f157d3fae8a1fc8af3fe99f098cb09172042e92b86e86eaf652690b677833860668bc0cefe8133b6360e12a3c6ea3d6158241a675f5e5df1ecce01407
SSDEEP 12288:tWtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:tW6mctvE/BT76+1NCE
TLSH
T15B652381981B01D5D9DF07F19295E29AE8502EFE74DB1881F326841FAE305A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 fd4811543f33bc4ab974cc9bb5d1401f46335a24ddad26adb0f86ea684bf7cdb
MD5 bef89b1c48ab028db4c54d10f74b052c
SHA1 356a47bf3d0ac419a43e8dfc0af8d7a5474b3da6
SHA512 4ce7633ac18f46c056fac2036d67c542f5898b35bbc84a2ee4b6fd95a1c56e4c433cb13852504978afa5e00b5ef17d03e9e2a7aae4d9292a3cbb52cf60469e53
SSDEEP 12288:+VntM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:A6mctvE/BT76+1NCE
TLSH
T1E4652382691B01C0D8EB43F0C2A6D296E5B07DF975A719CBE311491F5E303A17D2AFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 d0244f07813ac4cec2248230f25c1ea9a6038138532300ace222b94b6b13142d
MD5 6defec274f0566d9f3335dc2325681d3
SHA1 df380d3d37a7cb89ece648db3fad91880a052c7c
SHA512 81c147d8b891b4dc88505b254d26922e58d8ebd959190174bf5d4de2311b3ab3e665eb99aa763223c24f1446a539534b909cddada422627b02c74def30ae2f66
SSDEEP 12288:7PtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:7P6mctvE/BT76+1NCE
TLSH
T121652381981B01D5D9DF07F09295E29AE8502EFE74DB1881F366841FAE305A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 82033fbba5388680d4c974b2bffde2f3b582c74e08099bbd5982db0a2ad9e7ee
MD5 3953aee26eb69312fc19fa19abe90dc8
SHA1 b044f34e4964539440e32f294811145848b788c6
SHA512 9b7b15a78d93d4ed6622b3fedb83f00ffd1cd5ffc9b1815b64f9a24a469197660969f3e4c854d938b51d38c25910719a2543316d4650e90d56de6daa2039821d
SSDEEP 12288:votM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:vo6mctvE/BT76+1NCE
TLSH
T1CA652381981B01D5D9EF07F15295E29AE8502EFE74DB1881F326841FAE305A27D0FDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 076e4ee29232bdf22b41b77efe6173be71569b4220cb79aad8e9a262180da29c
MD5 f109ed8e5fa2bc975631ecc5d8d5fe0a
SHA1 5be9db1137bab8c9a37cfffe1e38b067509fa29c
SHA512 59421b6d01bf595acdd7b8df79a8375a18dd70f1cd7554044f5a31bc84b113e98955b0280b88843abbd65f509c73f4a0e81486f4f13b8c67dca892de287db0fd
SSDEEP 12288:2MtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:2M6mctvE/BT76+1NCE
TLSH
T16C652382981B01D5D9EF07F05395E29AE8502EFE74DB1881F326841FAE705627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 40ec9a82b11c00965b78512b72f48ad9657f309bc5fae43c1b9f040aef771ea5
MD5 08892e1e4cb2f3e4adabed3ffc337814
SHA1 421608ecf909f43a1548af10190b5cd8d24b1125
SHA512 103a31c679ac6b41c5754c3554e63fb066934ea691605ef0e89248520486bfe66b86e27175f5cd9dcbe85a61cb814ca0ec35f93ed744e68cf41d7795412d8547
SSDEEP 12288:viZwbrzzFEoS2cPvyktM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:KZM/zFVSOk6mctvE/BT76+1NCE
TLSH
T174850295B35118F4ECA7427EC9558506D6B27CAA16B0C60F13B4362B5F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 6607990701fd51892b7ccc9d4fd2c79c33003c2b71612a3e04ca9752b0360a2c
MD5 ce12adc11276dfeda5a6c9a6a4e05b24
SHA1 21344f43fc21f75a22cfe9d68e7ad5c297548b99
SHA512 eed8b84296c0acd60d74e447c3e1c3a3ca57af4201246516ae54c184f01ddaa428b27bbc212f0cb3ee06dc89468f523879c6f7709345599583c6c9bbbf712a42
SSDEEP 12288:LxtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Lx6mctvE/BT76+1NCE
TLSH
T150652382981B01D4E9DF07F05395E29AE8502EFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 4a38a1f68aba9aefe1d68edb8c72849dc1f34e24925fa2f06716c47da88eb494
MD5 5c9ab04ad8085f806bda62983b285330
SHA1 4fccdf83877f1fc44f4013236cf8b66b5ffff539
SHA512 afcffe25613f4f9773c4b6dd6e2af6d786a1b2a21ee3015cffb2f3d05cc8e1b15fc092c9c8b53e6b590a28877d5153f90bb6c83828f7cb8d367013b0db0a2b1c
SSDEEP 12288:tNtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:tN6mctvE/BT76+1NCE
TLSH
T179652382981B01D5D9EF07F05395E29AE8502EFE74DB1881E326851FAE305627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6c42b2fbed7059053a2d8cbc3ea1e1ae3d922f7a59b1253de99fe9af89af2b7d
MD5 f6dfd80e6569fcbf3e78c5c10bec2532
SHA1 8be0eec07ffe438585753ceb419066851b4264d7
SHA512 5c7029cbf199a85ac47877120516ca94b1a28d7d20c8bd77d2c27fb34758ada029ae6a8c6fa4b20ca55e955dc3d9d0577991cb94d364831a880c128ca7ae673f
SSDEEP 12288:UyPz5L8AtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:NzyA6mctvE/BT76+1NCE
TLSH
T127750143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 082e1ee8a32e2d73cc21985b87d5b4c47413e4912d5c6c6bac7a3cb0688f0c7b
MD5 290c84be3e268ab36e2ec85093275048
SHA1 ffbffd936b28e2b5b5bea98e387ca8912478a614
SHA512 bcc761aa5b9a9061fa2fe4e38d0f79f4851a7061811814f30f1810d7d7384455329b833f453862be3b5d7aeea84f481aa6ebf0ff3682b981d96611fc1474b10e
SSDEEP 12288:BxtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Bx6mctvE/BT76+1NCE
TLSH
T1CA652382981B01D4D9DF07F15395E29AE8502EFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 c58b2d344e1c96ed2a26d509fd6758d3f72c06e1400569ab69cc1687582f136f
MD5 df5f123dd36724779d0f0979a974c5b0
SHA1 d870e890a836732630578da7e086f469ceee7631
SHA512 ca3a8558c65bac68a3907bc85005d36b15c0f6b77b921e3c996bda2de134507838f738d8e9ff0bfbffa63a78f1611379d90cbc1eb394411e7e1aaa99cb710f83
SSDEEP 12288:1xtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:1x6mctvE/BT76+1NCE
TLSH
T120652382981B01D4E9EF07F15255E29AE8502EFE74DB1881E326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 fc48c6e108bab7680ecca5d365e298dca43508ccfba94bbc11598d56bb60b8b6
MD5 b5d05929a47e2a290a735342011e3bf8
SHA1 178c1389358ea8476d4e5e84ff40223b7f5b3fff
SHA512 4af0e3b92d528a4d533f521af7e4dc70dad16a5a6f3d26e6272fd71ef31ab8850db0854f6a24f96667d6c61d7cd76f415d702dcdb4e0be05c81ee5adc6ceb59a
SSDEEP 12288:DyPz5L8AtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:uzyA6mctvE/BT76+1NCE
TLSH
T139750143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 3b29274a7fd3b862cf34b56f7398985abc07824c9ef215d7eb4576e54b3af258
MD5 082be1fa723deb282a3b765381924a0b
SHA1 0e6c0213aca24b824e06451c854f13a7cb801711
SHA512 94987652310d7268cbac212ccbb7cac188699b248415797599c0ab75b59e11690dcff420c437e52c64966d1551ee95d8cb40ed591f1833113b564c19b275c2c3
SSDEEP 12288:6Cd9NWYoaLHF3z0z04PDvhGtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:LT0aLl3z0zDG6mctvE/BT76+1NCE
TLSH
T1EE850295B35118F8DCA7427EC9558506D6B27CAA17B0C64F03B4362B5F333A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 5edadeabaf3e1997332a3c45316708eca232593e68d857174a5fe7bc72c267e2
MD5 d3a0f634f26f6437ad24e925e5b37580
SHA1 cf96e55741101947ac56fa97e65343ded486f745
SHA512 5df86728498000baa72cd8c37304049b4c12d528117192cc36c4aa10a79311c07da81516997983b2fa211772c2a7cff6dc680029b19ba497a2573cc02af1d32a
SSDEEP 12288:ni4e7PRdTfgwCHKy7GLbbdIvDtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:n3Id9CHKy7GZa6mctvE/BT76+1NCE
TLSH
T1DD95CF90F3E410E8F0B78A7589769112DAB67C9A1B71CE8F03A4651A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7a2e3f31527f0c611507f26791fc970fb41acd8f789f49dc6e3fd5c0534804ea
MD5 fb096f31afb26a2afd235fd777b18ae5
SHA1 9740cfead775f42740eec8f533c2567cf1594747
SHA512 c2d52dd48b237792f4ff1931221af37143fae0c046179285681722abdb5d6ce74dad9e5792af78eecce281879f7390be5315540e315205c698e4bdc177985040
SSDEEP 12288:f2tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:f26mctvE/BT76+1NCE
TLSH
T17C652381981B01C5E9DF07F19255E29AE8502EFE74DB1881F326841FAE305A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e4fc368b6457613fc6fb0b0689ed87b5c7ad77474a5d92b790b781855fe908a5
MD5 36c2283e17747171176c7219786692e9
SHA1 7f9e673f81cbd42436beca966b032651a7bd6ba7
SHA512 84f6df03a9003fa33a92b345d11024ddd8e51901c7c3bb94aab1574f641c65f7850dd0c2d2c613e33e0e57ff455c7b63f67eee13bdd4fa0cfdb6e461d4710eaf
SSDEEP 12288:MgtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Mg6mctvE/BT76+1NCE
TLSH
T12E652381981B01D5E9EF07F15295E296E8502EFE74DB1881F326841FAE305A27D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 7c97bccd45f673f9913c3afde8b1608e06b7390c9c8a1051e54aab8ad8995874
MD5 7ab2029cb326d9fc5b481a67df932868
SHA1 49d69e4e4251bfb0d91dd658f8d295ac52a8f9cf
SHA512 6c900f5bb9fe68ed1c9a6d6acd2d3b8e2592e93b9972fd4845ea7afd99ac222428b7bed7cd2ed757697b0a8834eee3397e1702157c9554140d53f19c7fc4584d
SSDEEP 12288:CDtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:CD6mctvE/BT76+1NCE
TLSH
T1B6652382981B01D4D9DF07F05395E29AE8502EFE74DB1881F326851FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 92133c08183168208596e5d9526cd937d4afd57599564c5ecdf0dda3d3357988
MD5 cae97ab3657fbff7892c36bb286d213b
SHA1 624d0c0d23006f93732c97e6e8211d2793f8227b
SHA512 c42457a5a403c20021af634d0e8dbd008620710a2ad6a8940cbc4dfd6abbcf59f67a320915916232109dd9fdd9e0216d8f0e2620485183838c935d312cbbce0f
SSDEEP 24576:qfwvik9RX6wkyAId6mctvE/BT76+1NCE:0MnYId6mGvKVO+n1
TLSH
T1D495D129EBDC04E5E1B7927C89B3420AF6B178691B31C6CF125A536E0E33ED05D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 71fe42e3e8c6e11aa793e386cbc11acaf39e51c69110591ffa66a6d8f3c27467
MD5 95e8be0781481b4893a3611eb43a195e
SHA1 2ea0fe93763514b99f8c51c609f670d2c69094fc
SHA512 39eed5d1dc1e6a127e09a0cdba84baf3a3c24978a1f42b32f6f4ec07441957c694cb466150629d05e84fe02850fa7e11121201f74a0cc76969e4d6548aa0818b
SSDEEP 49152:iYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0i6mGvKVO+n1:eySzPaXeN+1
TLSH
T1C7067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c672701f6a158e6268f38add9ec2a9b8058a8d7f7c7a8047de4e8f847cd1db42
MD5 760a6bc7b26dad88831d3f460dd7279b
SHA1 3843397c6377f6a05831c9f3b7c7d1d5c2ebd27f
SHA512 93a821305b1814138b97b18abcf2fa4bcb3468a390f7701fcff0a4775510b139f6d3002624e6aa53a507a2a372edea655f6d8da88718e0ff2c6547a6f3bf511d
SSDEEP 24576:v47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY06mctvE/BT76+1NCE:v47JUQj4irIhCnDHUPfF/y6mGvKVO+n1
TLSH
T10A65AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 95e881b0f7145981d86589bbf91c161dee085ed2208e58e7ee43f64f7ef6ead4
MD5 c9cb4b6f50923c389c4451fe58e01d04
SHA1 efb561f00580cc851591ac9085bb078bdf95ed9a
SHA512 726394662c68d1230999b029b2c07a0ef88c009cac2edbb6519ec15f82102e48fb47553d60f1395fd9d17be92e13b00815ba739b5f33ec5bdaa596f78be4b2ce
SSDEEP 12288:W1sfhtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:7h6mctvE/BT76+1NCE
TLSH
T1C075F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB63D0F53E1F31690ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 21aee5d396f9c1cabe47b14b2fdf36cee82e0083ad2710bdf9f45f39e5de6113
MD5 9dc4f3e15272e21ffcf81ee47c7b0ab7
SHA1 6f16ab1c194cf753637b762bc8152d9906b096b8
SHA512 aeee04ba2326b3cec883c142eff00faddfb07e538aa7cdf808f8a020cf9bf5ecfe133f152839bc3435543e62ed2eeaccca863f28ecc33c8dade633ec9e86cb23
SSDEEP 12288:/u+q5U3ffI1MP+QCpSCcLci7ta+xloarvir0qr3Q4c:/u+SUPAOJYSCcLJhxloariYz4
TLSH
T196350750766AD75FC6AD40321E32D2CCA7707D01EE05AA0773C8973FC576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 6aae2c3b97bbd9b9fff6730a9020d3d5e7b8f89267037777f055a105e5352718
MD5 7e5ca994cd3258263d3ef1e99abaa77b
SHA1 6c15c5492bfd42e29d14804494a871a96ee79397
SHA512 78220ce435a8af522e9c77d8f8b8e518905342359fe9b955a2bbd14c80b45b63f5024a0034e95ddf47db02b622d3c72ba7838e26af232ff44cc65f300493c61b
SSDEEP 6144:0mqJcCSq80ivtYkpxPeqJNPw9G8wbfYb3DomoGOIw7F7AsznbTicbVtMxycbVtMD:0mLk4WxwLYb3DomoGOIw7F7fzqwSYT
TLSH
T17865C781A137E3CFD1FA6031072A6B4CB7A4EC47B7455F2677C8443AD82AB15A4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 e15ea6d343d497eeb010cd7e3fce37b76bd0bf8f1b14d69a7a89dc2772fd32d9
MD5 8b021940b41aa28dffa41d46d6effeaa
SHA1 db5406d40c73a4871dee05c1984dbc722e0abcf6
SHA512 bc90936bacf182f3bc2605804760213273350d8ac40ad4403c95d7177e9a68fbd4dd555772cbd371bee4e529927a56a9ae6f6392e6f463b5b8b328668bcbebf4
TLSH
T1B7219B508FE6132AE0B79B316DF55292EB337D01BA145F2E5184124C1E62006A8DCF6F
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 27097359e8dc16a945e3ce7068d285a6089747d2077886e3a68e433685a7e64f
MD5 9d04315bf54a1444f98f3fd77f643938
SHA1 c22ef69eb86432c6f6900284a4c448790af12a14
SHA512 9937bb1276845001faf3e8b091fff7693cd34b8fc647ca466b85ed20036dd9f9a7981a67e29a1388a48c7aa75b2b5baac1e08fe7138a78549dbfb74cb10fd7a1
SSDEEP 12288:9v7ptM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Bp6mctvE/BT76+1NCE
TLSH
T1B6652382991F1184E8FF07F0529AD265E8157EF93B8608C3F212851FA9305D1AD3BE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 30a15762eebc8843503467f58c61d7d8b786e961375f1864ff024d66fba9406c
MD5 2e638cd688e11ed8514ba92a12e3e909
SHA1 16e451fe271f893699c4fbec1353cdf6ee95f46c
SHA512 621824bcfc1205bb24f12ea71a92e6d85dc2e20a09665fe24b99223fbcd9c810659a835f9fa369561ec5ae443e1953ac83fee5b938c364bd99abfaad1700a197
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYb6mctvE/BT76+1NCE:cgb4mBIBhGF06mGvKVO+n1
TLSH
T1AF659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 34993f305763376394437a3d9a492359df3bbc33271ae3d715dcca1ae0a9f491
MD5 e7b30c2aa4e3890471205555eed5e5fe
SHA1 fd6c77d6eeceaf4532c97757c87aaef94dc56311
SHA512 5ebbcce26fd134cb1654ec803b7330cda58c8b3618dc8354a7d4c926e5cae85c4b2f449d8eb33476501cf4b8c0eb220f441da36ab69f228a41d3fbbdab32dcb2
SSDEEP 24576:mG88u8FpJqH1jzria7/mk6mctvE/BT76+1NCE:t7ZFPqV2a7/j6mGvKVO+n1
TLSH
T15995F16176E101F0D47BD1388A864263F6B1B8651364EFDF07A88A561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 1b0cf3d22c3f0f17edcc130a14866fbf6ee61d42f6a3e8cfcf309cd1235e0aa2
MD5 2841ecbdadccb76fa22f54107459388a
SHA1 54cf0729cbc2785fba761bf79fc81fbc0c644aac
SHA512 2d9d1bac302981a15a9663d0912cc92b56fe80ebd9857d58eb7ea0f4b25732706a6fb7f5b0ed9de8c71308d1bbc815039314462d80f52dea49d4e31bfd724059
SSDEEP 12288:OHvUrBFrEjwaQ4tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:OPUr+NQ46mctvE/BT76+1NCE
TLSH
T10575F21F61AD18E5E67AA17C85828319F77178A2175292CF02A1813F5F33DE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7f494e7ba57e7ebbd57f2b1d9230bf792abc8af5a5d5f7d62663c2503ae292b3
MD5 5c5cc97055b5f7bfeb4601505062053a
SHA1 7ce9b60f74483cbcb96fb339fa4a33d9d4b892ea
SHA512 d9c0ba0ea8d08507026e59e7a6c929a58b267f1b1d056a6693c502103261fa6eb636e53cf6da8413a6c3ad8505169100170136bfef8235c59c04495b0682222a
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjo6mGvKVO+n1:iG05lO43bFXeN+1
TLSH
T183D5C06A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f547b178202b78592480f60d701ebd91a73cd98b4f6e1e3cfe03dbbc54b05fa4
MD5 6a18afad78b8044628dc799456e637f5
SHA1 973c33dc5c3638c537eb0ca1dd559ff50a25947d
SHA512 ac23a772b593f8bfbc98cb1fd333e2ae14f8f19265bb55a30d9cd79ac70f59c0aa2d6c5a9759c395aa198c64018225e2b17a1432564e4f886256363dcca01c05
SSDEEP 24576:9fa5POZ3dpqWVM50JicR2hG0lasx2+47eidni6mctvE/BT76+1NCE:Na5POZ39Jt2pasx2+mg6mGvKVO+n1
TLSH
T18565BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 76b628e5c02ca708b5440e08c99a68cd2169955820f34cd6f1d93ca8d265407e
MD5 06a135541ed1163f2f127657a92b24b3
SHA1 2f2dabe22c340447b4851ba8f397bf6b979a0515
SHA512 3de208f5e79c1e670dd2dcca01245d3615b435121154e0f1475c448eb4cbeef2bfb354e06b994eae56252786a39402fd2221c92d80747a762cd20ba2dbe2327c
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7Fk86mctvE/BT76+1NCE:RNc/zEOVHFD6mGvKVO+n1
TLSH
T181858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bafc63a2031f1aafbfd9ae8c8babc6c6ecd63d7232eaa208d51ee56a78c493bf
MD5 464ad89da627b3869b8c24637a560efa
SHA1 86676f3d7b7bd5c7f4a4fde4b4cbc1532dee049e
SHA512 3983dc5ea70a7124d57aad53c5ede426d722031ffdfbd34db31c00aca7bc346185e6694dc3d70703d17c5ce0c8ceb01680d05b363a5e542399b542d7d2ec5731
SSDEEP 24576:xtkNvNnaFeYhJNtmZBmu6mctvE/BT76+1NCE:xtMwBtOmu6mGvKVO+n1
TLSH
T10C55AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 1be0dc26b9b5b18b90a99329a0616424dd4dfc568e91c5c855c5ef62cc5891e3
MD5 3f073b00ced40cd3ee2e61a59683bdf8
SHA1 3fa3bc7c071d87171dda5650120b0c3ae11c73d1
SHA512 dc9d66f7e4d34a321868b8d4f22c2ba63683af0fde8ee0eaeed301fe02f62e5beb9ef13f2744bfc1e21fb42650e954113b412a9e8fe572d2b956b4e9d4aa6ac2
SSDEEP 12288:MQcMxWDXN1Dp/fshBItT1IQgAVtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:2D3FHshBIYQgAV6mctvE/BT76+1NCE
TLSH
T19785E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB0294C1BA5F67EE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-59-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1608-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1608-66-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1608-298-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1948-87-0x0000000000400000-0x0000000001447000-memory.dmp

Download

memory/1948-1-0x0000000003480000-0x00000000034E7000-memory.dmp

Download

memory/1948-6-0x0000000003480000-0x00000000034E7000-memory.dmp

Download

memory/1948-7-0x0000000003480000-0x00000000034E7000-memory.dmp

Download

memory/1948-415-0x0000000000400000-0x0000000001447000-memory.dmp

Download

memory/1948-0-0x0000000000400000-0x0000000001447000-memory.dmp

Download

memory/2540-154-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2540-157-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2540-151-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2540-145-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2540-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2936-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2936-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2936-31-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2936-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3564-384-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3564-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3564-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3564-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3596-344-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3596-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3596-118-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3596-339-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3596-124-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3884-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3884-22-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3884-23-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3884-15-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3884-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4848-70-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4848-72-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4848-78-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4848-312-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5144-129-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5144-366-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5144-137-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/5144-131-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/5328-465-0x0000026C54510000-0x0000026C546DA000-memory.dmp

Download

memory/5328-393-0x0000026C54510000-0x0000026C546DA000-memory.dmp

Download

memory/5704-57-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5704-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5704-44-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5704-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5704-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5744-104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5744-111-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5744-105-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5744-389-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5744-348-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5744-388-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5976-95-0x00000000007C0000-0x0000000000827000-memory.dmp

Download

memory/5976-332-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5976-82-0x00000000007C0000-0x0000000000827000-memory.dmp

Download

memory/5976-88-0x0000000000400000-0x000000000056A000-memory.dmp

Download