e3bb5beb03d630fb98ba4b1fae85ced7bd4c20762b4e721045af5b0c7722f4fc

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Size 10.2MB
Sample260730-vx9c4staqe
SHA256 e3bb5beb03d630fb98ba4b1fae85ced7bd4c20762b4e721045af5b0c7722f4fc
MD5 868ac302f11d0d40e50df53e4e8e543b
SHA1 3ada9b309f4245dd4b6c457f4045277a490ff41f
SHA512 0bce184d5a55a7c0041799f882e8f06c0c6636e543e0e771f5cf3e59bfe69a92326a55a82a203512c4d7f5f7e38f8669001e0e287d2eec6aff768ebf203026f6
SSDEEP 196608:qm4L3+yKlLWA4MhfmsxfMgkjvJZ/LSZ4UrbW8XeN:qzKhfmsx0gSvJZ/LbUfNe
TLSH
T150B6BF22F900C032E4D100B2AABD6FFA993D99341B7954D3A7D459BD59305D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 4 IoCs

resource	yara_rule
behavioral2/memory/5696-7-0x0000000000400000-0x0000000001447000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/5696-86-0x0000000000400000-0x0000000001447000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x000c00000001c602-109.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/5696-410-0x0000000000400000-0x0000000001447000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 13 IoCs

pid	Process
5176	elevation_service.exe
5660	elevation_service.exe
4620	maintenanceservice.exe
296	OSE.EXE
5196	PerceptionSimulationService.exe
1672	perfhost.exe
4820	ReFsDedupSvc.exe
5548	SensorDataService.exe
2092	ssh-agent.exe
544	AgentService.exe
3520	SearchIndexer.exe
4620	RobloxPlayerBeta.exe
1928	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
1928	RobloxPlayerBeta.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a3b43e9c83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1928	RobloxPlayerBeta.exe
1928	RobloxPlayerBeta.exe
1928	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\advClosed-hand-weld.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Menu\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\skull-xsmall.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\New\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\New\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerDark\Muted.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\models\Photobooth\AbyssBlue.rbxm	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\Arimo-Regular.ttf	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DefaultController\ButtonR1.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Emotes\TenFoot\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Input\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerLight\Unmuted60.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\ImageSet\AE\img_set_2x_1.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\MicDark\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\New\Unmuted0.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-online-12x12.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\families\LegacyArial.json	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\triangle.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\MenuBarIcons\HomeTab.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\MicLight\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\RedSpeakerDark\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\GameDetails\contentRating\igrs-pending.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\configs\DateTimeLocaleConfigs\zh-cn.json	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\Creepster-Regular.ttf	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\SelfView\SelfView_icon_indicator_on.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\pending_withbg.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\AvatarContextMenu_Arrow.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\PlayStationController\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\ErrorPrompt\PrimaryButton.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\characterR15DynamicHead.rbxm	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\PermanentMarker-Regular.ttf	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\AvatarEditorImages\LightPixel.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\clear.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\PurchasePrompt\LeftButton.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\models\MaterialManager\material_model.rbxm	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\fire-small.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\PlayerList\AddFriend.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\PlayerList\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\[email protected]	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\configs\DateTimeLocaleConfigs\en-nz.json	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\families\RobotoCondensed.json	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\families\SourceSansPro.json	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\arrowSpritesheet.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\xboxRB.png	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
792	5696	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000044b3743e4820dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000209b33e4820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce2a453d4820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098ab6f3e4820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087bb003e4820dd01	SearchProtocolHost.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-145f189a6a974303"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-ff6341faef444107"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-145f189a6a974303"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1928	RobloxPlayerBeta.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5176	elevation_service.exe
5176	elevation_service.exe
5176	elevation_service.exe
5176	elevation_service.exe
5176	elevation_service.exe
5176	elevation_service.exe
5176	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeBackupPrivilege	4820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4820	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	544	AgentService.exe
Token: 33	3520	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3520	SearchIndexer.exe
Token: SeDebugPrivilege	5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	5176	elevation_service.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 1928	5696	2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe	105
PID 3520 wrote to memory of 3940	3520	SearchIndexer.exe	109
PID 3520 wrote to memory of 2120	3520	SearchIndexer.exe	110
PID 3520 wrote to memory of 4512	3520	SearchIndexer.exe	111
PID 3520 wrote to memory of 5424	3520	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_868ac302f11d0d40e50df53e4e8e543b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5696
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5696
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 952
  2⤵
  - Program crash
  PID:792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5660

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:296

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5196

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1672

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5548

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2092

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5164

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2496 2584 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1776 1764 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5696 -ip 5696
1⤵
PID:1084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ba66a60a6a41c8cab885c20967c768923c715978a14ec3d101dd09b4acb9e0b1
MD5 4582f0ad6c175a16377d8e182adef062
SHA1 56f0ca4bf7817fd617faab2fec05d4df98bc47ce
SHA512 3ea859150b53ab756097efe3c0565395af6b0712ce7f8d8070886da35ec44971baf519821fa25ffa646ff3c462e2f54b3c01cb5e593325f3a13d45f6b94550b7
SSDEEP 49152:Ob+632BuPkFKRrdE6ohrstBhuXjfS4LWxnM6mGvKVO+n1:Q3q60jBHXeN+1
TLSH
T164D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 162695da5d7d79115f0af3ad87bfee6c8425b152f29c6e493aff7f56fb76a70d
MD5 c6990e8000c48cd3c1fc59f8da556af0
SHA1 68c5320e8ca440bd3cdc400a296388c04a276b1f
SHA512 dfd16a50efb3aaa91277fb3fbde5b76ab05f3153cd250c8422dbb555c8890f6762d705893809ba96d53ad671ebf1060dbd306d3ffe647d00f717cda856ec56e7
SSDEEP 12288:M1XLsswWkxy2lRq2czA7tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:6XYfDtczA76mctvE/BT76+1NCE
TLSH
T11A850224779504F9ED6B4278C9A2C111EA337C9547A4E7CB03E4892A5F333D86E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 a33eeac3fde1d1f99de2df08d63faa818ffdfcf2ace6a37e11bec1fe59409c5f
MD5 ad0dfa05fcbf007b1e2e535139317ae1
SHA1 8bff45114123dad46374913eac070a7255ca57df
SHA512 98e470bec6520eff7ff701d3448dff3682c39a1a9f95211595cb6fd5fde63ba26aeb79ccd32fe7adc1ab3e27d551474e41d4e56c1e2d8f01d4cfe9715c7c234b
SSDEEP 196608:ivgkZi/+KxW/hvjyysmsxP66IM5e5QIfqZzcz9P:iv3KpysmsxC6d5e5QI8G
TLSH
T17FA6AF22B900C032E8D100B296BD5FFA997D9E340B7954D3A7D41DB95A705D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.dll
Size 21.2MB
SHA256 269af4ce0111e647c0a7ca5d7f1e29d769c880fd6394bf03f8a368e5c34761b8
MD5 42aa3722cc784eb50ec34b639665a129
SHA1 2cd51a6517fdd48dc01e322b7590c93712ae5fa9
SHA512 9570b27b9db7bd62f57d40f49c22fc536f58adc436cb7f818c943ab03b3839d4b9526b925d4bc0e9f9b4f440df6cfa045ecd8406f9df66048c041e328720eb3c
SSDEEP 196608:mTQLBStMScC8/lZZKPBJw5v8zOcPAhO+D9T:mT4BShEv87Eve4hOaT
TLSH
T1EF27C08EA4D20AA8C6A25071F05F46D3E662304C0D6C6DF7C6FA02603673B9D6659F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 cee6d9c072b6117f31781776737f430dfd0c1a6f976f641551fdb63911afdcfc
MD5 365deb9302e6ae380253efca9af18c85
SHA1 f0a388e098927f009b7999f4da4c23b24dd0ae84
SHA512 07e37da9b44fbb512025a246ddbcfe40df8ecc2182185a1057fa333790c23be6bee592067f0c8433571f09cbebf7fd66cb9b006f67febfa0ab66eea1c4e93cfc
SSDEEP 12288:7XZNYVLeyUji0h90ZD0wxpGZIVutrHs0tM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:90Le5ji0hmxqrM06mctvE/BT76+1NCE
TLSH
T12A959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 faf366f0ce96341b02eaeb28bd17fde3be548c1e3f4ca91b35be42af1dc21466
MD5 a93394af86b171fbf00d055c01a48439
SHA1 4e793e203986774a1efb862bfd7b2aaf75826a51
SHA512 d7e90aff3616a923b26d445463939ed28b7c0358e731c17847e92b979e3e86690f329f8fc1c87b8a8e8444545f3c6c0d5096e47af479e3589ced97c152cee9ee
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWr6q8wyu66mctvE/BT76+1NCE:I/ezSC6vUzPviHjyJ6mGvKVO+n1
TLSH
T1F2755D15F5788323D0B2D0BAC5D6BA99FE7230865B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 10631857554add6927b759f795de64ed218d15d748a178b0fb6acd8cc6dd2700
MD5 775823bf3891dde633124479601e027f
SHA1 dc87767e34c46e2e9967b3787e3128c856c53ab9
SHA512 78574ad5ff9b782907c546e0ca8ef992c6b9e974ddb93eaa04487de80be83d22f00957359ecb6b0705324a042063a586fb37a0373401ca8dd315c8ec2992d111
SSDEEP 12288:EVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im983tM6hct28uP18WR/FW2Gb8JTCMx:EVbqPb88hv/l+b36mctvE/BT76+1NCE
TLSH
T18055AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB1246D72C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 435d7e264563b301329c592518b4502a4635ee94cd871c002588ec1ed55050bf
MD5 401a6e6e6d9f531f40c7a4003b96427c
SHA1 fceb872901b05c4e7c6a378f0f9ed3ad4e97fc12
SHA512 531fbd9ed21885f80f690327f9ce19fbbd0f96cbcf705a5b20138982b013f1705f54ed7b127230f79585ebd316d7b477aba336c8c133ece4d3c5c925574f9767
SSDEEP 12288:VMgtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:VMg6mctvE/BT76+1NCE
TLSH
T10A652382881B11D0EFFF07F06395E296E8516EF974DA1C81D322991F9D30162FD4BAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 4b4bb0dde37518b8d1da63555e8bf81a4e69aad4dba205df1b77cd1573822fe1
MD5 ae6fd0ddb25b0d20c50ce8c48ca26c11
SHA1 a2f2975ae86683218272de97387d65d42b7bed06
SHA512 ea57ba72ce8fcbff67c40f4087d348f850e539f1358fb652c574b0ec4f5d4eec07bb27af67bd5b8e13a7e5df727b05a92d63b985a356ff45e81d382781ba325a
SSDEEP 12288:7eBNUbTVO86U/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:7JIU/6mctvE/BT76+1NCE
TLSH
T1CC85CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 396e8a8ac823e6f21b0b98d19d9e30d8a6c663db378b561146b91884a0bdf593
MD5 f64377da00c1b6d5455aae2334f1a03b
SHA1 b484700d1451ec530d6a410320400da9924cc100
SHA512 48efdaec21817932255122476d5b8cb2022f77aefe380193d3df5dd32a67524980b306ce934ca20276c501ae482f009eb1dd874b13e381ce33f52537a0c224b2
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THh:sQvGAdlCEL8c/RRNw5CqXeN+1
TLSH
T140267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 d8cc757f0312ab89b906e82a9f05e894235839d375caf92ade136aa16dd8bf80
MD5 0315872239d9e03e81c93d2f9af0e9fb
SHA1 b45215dfa242e2f82ae0e6d597539c92990c6a00
SHA512 ff2c849bb128ad1224a10661dfd49bd2d6bb15a4973ea09dda0361b0c6e80c2862867c76203df43a46e5414a55f008859b3e73513145580ef4817376537cc417
SSDEEP 12288:DAwSfxL/2Dc3+DLLmt0LDQewsAjVtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:8rewsAjV6mctvE/BT76+1NCE
TLSH
T19485E031FE75E036C6BF0DB21B26D316547C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 25739187c6ac4007ab99afa549628b3928b9b89b426dbad63fd51de2355a3fb9
MD5 09b798ddca0bfca8abae89ad53db3e7b
SHA1 a99b67987643733e818af459c06ed64e62462c08
SHA512 d8cfc02b78a77dd0bf0c6ba921a34f0c9677c900bc5b865c0a90dfe9f2e012937401e0345319e9933d9a736a9b0310c2d271ec7dfc94f36ccb98242a0266fa2c
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHtXeN:qUEtQevvqc2W1cpV2RI32te
TLSH
T1E9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aeab8f2058eb25355c083115c93147addb3b801309e2a6b228a5ede3234473b7
MD5 1efa2d9bd155851f806ef27b7d67d422
SHA1 cb071573bd4fe26a209e810c8cb10dd7d7bec05e
SHA512 513f3c237e152fc47d0d9faea652b19d58fb053c5fa31fe94e781cf0ca9abada7fea3d3e3a1da908f0c4c72cb6fec2e8d8edb2b350ad66601b29d50a472f1363
SSDEEP 49152:oCbRquA/m2yL5zQfFiV+XenmE3/z16mGvKVO+n1:BoqtVjnmuXeN+1
TLSH
T1F6D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bea2d99e0bdfa0815bbfd055c31a01bc454e58291e53b10480d339739bd72fe9
MD5 a8e83e17266b083106c5613fd78073db
SHA1 1e7873b1546709bfabf6129c16f8fb56d6284ea5
SHA512 f1f9c7652666f26dfb2cddda0c3083c8a21a4db0c5786d9b9c9d138d5f38d52ad0d9b9ec433dbf6ba237a4d00fa0afac2dce6ad63e6b56ba2d0b74c9998d4a2a
SSDEEP 24576:NAhGL2IFoiwtA5l7S53O6mctvE/BT76+1NCE:NAM1Foiq5e6mGvKVO+n1
TLSH
T104359D81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 5a50bcb6b6d7f8904abe606b709038ad3227346055f5a83f0b058d5b847f4481
MD5 5679df28d164efc00c7f1ee34675430a
SHA1 a2dd562af73e6aa907d43061939717608a086870
SHA512 fb6bef318bb01879a50b5c4259f0f395ca107709d588bb42f6e8955cd1badf4d5fba6ac3e7cdd7ef29e548f74b9459eced8bc09a5629cdc232eb35b3316de5b4
SSDEEP 12288:pmw5HEjsChNDBFgl0WDm+CatM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:kwu2OWp6mctvE/BT76+1NCE
TLSH
T1BA75F14676A508F9E9A742788657C136F7F2BC513A25CB1F1360C61B6F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 6364f8a1d64e729c6204ecf41687bd292636c134116ea7ce378546156cd362e4
MD5 ee2760d71117a808c6c8cb2fdde74e95
SHA1 be5824b71dc9fc7e5dfab8eedd2e59791d746073
SHA512 b11e29cf2d10397fc760420d7bb837eeb609458b0e9a60820e1e2c4d2d0640163a5bab54aafab0e51452d85ba9900b8c350cf1fc59bcfca85ad4d4c896e6230a
SSDEEP 12288:QMZ1IyFtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:XZu86mctvE/BT76+1NCE
TLSH
T1B1651286226520F5E5E702B8C9E19245E77138E6377603CF5221466F6F33AD26D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b2545b6b00f70baae2911a6010ce38f218552ac43bd186152d1c75875859a301
MD5 a4dc5175829c21d941eca7faeb28f269
SHA1 60faf2594f6cd3514143916f68ac049e758f08ee
SHA512 78efba3c1ca9ac13eb152eac6f32fcd15819262230dab88a05363c406e6e08aa8a13d1703135ece1896d01675cb0c2a03d5e0a253bb818333c6cbd89a97b25e9
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U9:uQRQyi36YOcPhLvw2gAf+PN3DXeN+1
TLSH
T170667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 aec5d6b3453347febed77e5143146b7cb570cfab8d798d15e375971d54cc8c8d
MD5 1c627659d146463c238a23fa043d2bed
SHA1 0260174fa8d4ac7aa090f975f6b936001f41dfbf
SHA512 955679662fb0ac9dccd8102fca510b2a69eb99e7d309ef03f7ae44e3bdde26085a59ca2401f9abaa68441519926b6ed39e42af03ef5c88fd3024b21a28f74d67
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U9:6QRQyi36YOcPhLvw2gAf+PN3DXeN+1
TLSH
T1B9667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 53d7758f9eb655e6e15ea2cc13b41d1c31cc0d9fe7d6dff78dbca33e1a471106
MD5 2c4ec523421ee1769f0229e1b5fad619
SHA1 ac6e3bc009b65ecc756f7a2fb91429f1f6049440
SHA512 789981d32c3f53a6ef3f79a7fe3dda2c756bce6dd6b5a43cb456d41e716a57776e9f729f6615258532bbf4720dafed9b82b5f22edb32caf266db7ed94fd38a54
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0M6mctvE/BT76+13:l68Qg55nhceWu7PNU3/l6mGvKVO+n1
TLSH
T12BB54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b82571798256c6bcfb3936dec79471863941256fc99333068505170178151f93
MD5 305194e48f4b0909cc2b5116c87f5cf2
SHA1 eb5b87b0d24ae58f15e0722fea65f0a9b3d2fe9e
SHA512 17d99031198fda808ff2a440adcc25725332352eb3aa112875462d5a916ddc21bab10f259fcd4ad5716b84181307f10ed025dfa7bdee3523b118d4ccde26fb94
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99v:Ry5112gYy5azzVva69nLKnhZgXeN+1
TLSH
T150167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 100138e292aa9b42dcf202f1f5ff5b366f5d281eef89dd81c1a6752a8160f91b
MD5 5b7475878fe9c8fc869a2c527495d73c
SHA1 05659af69f10a6040ae0b45831e113d95a381f04
SHA512 17ccbb49392df16e4a72e24e157ac7afc1645189749f3ff3f3525b3514e9ce7447b8e3f59cbdb7787e6353c7b6d5c4dea811b7d6c5b53ad3a203714f05be151d
SSDEEP 49152:FB+taZ3usBWOBr4tEG20bqx0z+n217aau1glL6mGvKVO+n1:ru6JmUxd2dLXeN+1
TLSH
T16AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5c07c0dab9bbf5b40d0f5ccef2496ca3cfc927f8bbabee4ff66f515914838a77
MD5 71ccbcd19dcbb2a23d703a225ea637eb
SHA1 d69d6a43daa5b2a5261341b056214a56da37952e
SHA512 f9f1b741d2b18c1c7a13d57a3258f68d8dc88cb36a0527b03a7504ded03303ea2300be3c7666e5c8a707bf53a68890cb26776dd96eb5ce8c00af4b9ee5f85e12
SSDEEP 49152:51hpsNoJpF1A6BU44CwH7R4xf6mGvKVO+n1:5mifPkRuXeN+1
TLSH
T131B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d0606a8cab5b7e4b124cb7b4bb5e13fe8e523d04df5525f07aed5c2ab7de1af2
MD5 5f3ca1ef415bc239a56d14139ad40797
SHA1 be74adfb9739dff99d01fe9bc56039b1084daf9d
SHA512 8680769ec6c60a963d6328a018d60386509b89ac9abf8d2e21553a1d5b491acdd837b030d496c2ce7984a19c8ca119eca8f89f66fe8b4f379e5535f9c5a39ab5
SSDEEP 49152:DSuZQIY0Be2KNRVtOnks6NMHq86mGvKVO+n1:h5dKvi618XeN+1
TLSH
T160C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a55051cc7d284dd522e0d0ad62531b44e4550689db65b654a7fc6f7fa5470e85
MD5 843548f53cdf622bf1621521788fb8f6
SHA1 dec851a64494033d1878bfb2cc3177f3d0babbde
SHA512 dd84edfe7bee4b4d2712bd2d60daaa0aebf0a03cacf0c7c30ebc6bc55a45ecfbd0372ced0481b5414b82e248e772d8a759b378a14588712903cdfa060307cbe1
SSDEEP 49152:8htSn8EApI0figXgiDn0AP5w76mGvKVO+n1:9X2iyphiXeN+1
TLSH
T16295BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 fcba52e28309549c70ba992723845866e2d6352bc09b429b98c1ad9922b84219
MD5 5c613ddf09714dd7ae976f90fde84370
SHA1 4debe4a766c499e0d5cdec00b6e002c8cc2369fc
SHA512 aa5ccbf40dc7bb366fa32a46e60d38e2a80669c32ebb877b88f8417590613abd72de720c18933db2471085a142a35027ce83016018450ee8147fdec1d649e49c
SSDEEP 12288:3otM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:3o6mctvE/BT76+1NCE
TLSH
T180652381981B01D5D9DF07F09395E29AE8502EFE74DB1881F326841FAE705627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 46fe0f58fb58297834260f31e9598cb832fa0e097d550fa7295113b1ede16bb4
MD5 f9561465470820d00699ef391acbbae0
SHA1 5ca484bf7d94b85c369366b6db168845002246ec
SHA512 c2ecac7a3ee2498f5a687597554b2aa2abb97db27b2869ce0e7678866f1527772f3444c3a02e80ef1a4f06e5ac1b1223c2ab7948cd99de0dbe5d5ccea8f64ffc
SSDEEP 12288:4BtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:4B6mctvE/BT76+1NCE
TLSH
T12C652382981B01D5D9DF07F05355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 21886642d1b9dbd5a638891706f8f23140688b0b955b7e5ad5fc9f88a5ff7fcf
MD5 0bba17474c3f79382cbe5b01a302b7ce
SHA1 b3b1125559a04fb3b1136ed3deaa14f67fab11eb
SHA512 e294809342b6626114e6732440da84f2ad8cde133702e70f54708af78c4bfd7c6f3ca8119f4299acd746e4128401aee769d2318a7b1c869a9e1495eafe5364d0
SSDEEP 12288:WHtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:WH6mctvE/BT76+1NCE
TLSH
T11F652381981B01C5D9EF07F15355E29AE8502EFE74DB1881F326841FAE705627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 b6bbe849b6ed27c387e5291da95e444c9bc5ab73cf5261b47c12afda6cd9daa6
MD5 a3051aeacc1e6e28ca9f0d6e782804c4
SHA1 bd406173973c1bf36420d347ea5dc5223856c334
SHA512 a5452f6425611c05dd0dfe57506f13cabc5c27ed83278fef3818ac33e8b7453c331036b1cc969b1995a02a850505b97edceb9665c88a442e07803edcda8df4ba
SSDEEP 12288:vVutM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Q6mctvE/BT76+1NCE
TLSH
T106652382691B01C0D8EB43F0C2A2D296E5B07DE975A719CBE311491F5E703A17D2BFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ffa37b8eb482fdf0588865f9b8df961ad387ebd9a43c6bc9d9800e670297fea2
MD5 65fe0ad1b8cf582c99e49c5f19eb0258
SHA1 f3ce6725d0c27bffaaefa90d6b9d8b6b0459c328
SHA512 fe9dda808ed90046a39a385adbf5d54fdfa7f2af560d7b2c444aa4b7bd423011af4b0cb0cd38e2b65ed6ff66e4990e5380fb89be2262b593f58f6100660fb270
SSDEEP 12288:2mtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:2m6mctvE/BT76+1NCE
TLSH
T181652382981B01D5D9EF07F09355E29AE8502EFE74DB1881F326841FAE705627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 3461a4ed8e50234be25813b46af742191bc248e28d83f763560ec4ce7002c13b
MD5 9d088e27b9d31ec9e03075d02e9b2eb2
SHA1 ff1f80b9c75168f4befaaaa5cff66140d69d0bbd
SHA512 5b6b0b2ec9dd9d508e14fce7a02eeb06524fb605e50c167fda7e531128c0b73b72cb6b699d706e4c2629b731b67f3b10186fcd49ddb67abcf2c8791004276db1
SSDEEP 12288:UdtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ud6mctvE/BT76+1NCE
TLSH
T188652381981B01D5D9EF07F05395E29AE8502EFE74DB1881F326841FAE705627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0231efdc864d8ed89e6bd1e804edf19e6c75fcb007863b2e2ea7c7249cc06981
MD5 b49c7fc93841254e0d768159f0190f6b
SHA1 84af6314b227ec2c5bd403d9419d880a1ece70c0
SHA512 0dae75e587a9eb2316c570295a550a1f11d4072d523fc81dad2fa691310ff689763f190adfd679b4415d096f4f320f53d3f633b25edb8a1b6224f8e79375e262
SSDEEP 12288:n5tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:n56mctvE/BT76+1NCE
TLSH
T1EB652382981B01D5D9EF07F09355E29AE8502EFE74DB1881F326841FAE705627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 7fdc292fddfcc8330a384f973a94edad044cfd8479ce910c51642e7d1172b1f8
MD5 654e95e886033b6fa708bd3452da3b14
SHA1 91396226623608e1f5f0ae603195b73094ffada9
SHA512 fa71a3596c9520670341d12e0021ce7252b4947246452a3fd24f672d59fb8fee4de185ef1e85ade1e3501084eb4f064dd313c43261efce4c25ea15a1e43ecb78
SSDEEP 12288:+iZwbrzzFEoS2cPvyhtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:hZM/zFVSOh6mctvE/BT76+1NCE
TLSH
T154850295B35118F4ECA7427EC9558506D6B27CAA16B0C60F13B4362B5F333A11C3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a1f2bf6d50a76021e285b78fca19ae191a9a0004a3ea55a2427cc7030cfc4212
MD5 5ffc114edb1850480f7595f28db7f3c9
SHA1 1cdca3979fa5ac529474bccd704bf3a322dd048c
SHA512 92dcc5cf770d4e01d128781608c4d7b6a5e03fe4cba348de353ab8e89fb42d0ed82cbbd500e71b1ff0a92dafc33ee26dc9f68ee9b0ec1bb1ed60996e68c7416e
SSDEEP 12288:VstM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Vs6mctvE/BT76+1NCE
TLSH
T1D2652382981B01D4E9EF07F05355E29AE8502EFE74DB1881E326851FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 22f6b69eaeb435aa04c5cad241c4d38d890863e93f86fa6c43edfb9c0377f463
MD5 18a6bd18089e915b61f41fd88d4745eb
SHA1 a023dd25e1ad5aa735208bdc33c8af15b99d44b3
SHA512 a40bcda3e20f398be191993f013dfec753268a0d2c0738634da0d7ed6a9fcab4f0d9e8f238620f8c4f79918b58a76f2e70e7ad3bcf31102de958142d5eb57145
SSDEEP 12288:HQtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:HQ6mctvE/BT76+1NCE
TLSH
T115652382981B01D4D9EF07F05395E29AE8502FFE74DB1881E326851FAE705627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 798e252cf745ffd291f91c0e7f580d93a4c2b2779b2da5d79e3fec7ae80a28f4
MD5 c8180d4eeb52141aa53f58e8c899189a
SHA1 7ae43c71c614f68d9c24daee9f1cb184f16c3da3
SHA512 d0e6d43e3b599b0439e27bfd05a5e2091c5d4ecc3ccda2afe7825af64d5c7116ad1033e19f5e2572d3610af35dea6cdef7ea57eec20fb9721d7360a95e7d7656
SSDEEP 12288:xyPz5L8FtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:gzyF6mctvE/BT76+1NCE
TLSH
T1B6751143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 8d676068e4254e0b8533e7ee1dcd330ac6e6d81b3475c64ae67d61fb15988c15
MD5 55168d53807b72c8fcc374bf2eb8a15f
SHA1 cafb443bdfa71c22e181fe042e40936a2f8ea8f7
SHA512 24d3dd071fb7dfc540609e8db4a48892c376babd14d688c7632cdcc5c238bd206f927b7308f95fad1b7493ce305de1d5cabed4b0855380b34738197229745c80
SSDEEP 12288:JstM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Js6mctvE/BT76+1NCE
TLSH
T11A652382981B01D4E9EF07F05355E29AE8502EFE74DB1881E326851FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 9c4d8137eb91eb0305880d8aded1ee619a327f94989a880aab3a59c08ae20262
MD5 755643a47b2419badb7af2c1268aecdc
SHA1 1c29326f03a7311647f0daf8148d379a915e48a6
SHA512 8a5d6cce3897e850a10b6f5f274ece880f53db186adf4a1d4c4807c90d3fbcaf3e90d7e005d64571d270e6879229ff041a259d3891706db2a81909a6804dc658
SSDEEP 12288:PstM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ps6mctvE/BT76+1NCE
TLSH
T105652382981B01D4E9EF07F05355E29AE8502EFE74DB1881E326841FAE705627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 73482be7d03e1c0e9994e880e4cd7adf47db6e14d639c80c695942b439921fb5
MD5 225b79295f3e7ad2fea24912d61bebb5
SHA1 683f2daef28d48a2029c2b8b2229d7eb72c0d172
SHA512 7f8a5b8a229f58af50c10af4d93a4f379a86176477f4ee93d8524f20c2b39324bf1a1680bfc0b7659d60bd9ce976742690286576ae2385d2095e8744b1014ef8
SSDEEP 12288:MyPz5L8FtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:VzyF6mctvE/BT76+1NCE
TLSH
T12E751143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 c9ab951bff28edca894851960129839007983c264bb8fc41ce299d3bf32543f1
MD5 6019cb00492a1e58792b4c2b0528d1fc
SHA1 ecabd90d68a99ec38e2676f7057259a2d5c6128b
SHA512 96bd2351fa503223d2956e663f2fe17c8c60ab0b316aff71d0be9915664569babca85eb6c628655d605fe18cb5cc62d4a3fe82806ede001000686f7e0102e186
SSDEEP 12288:XCd9NWYoaLHF3z0z04PDvhXtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:ST0aLl3z0zDX6mctvE/BT76+1NCE
TLSH
T18A850295B35118F8DCA7427EC9558506D6B27CAA17B0C64F03B4362B5F333A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 a2f81e5880049569b874bff58b6e5b6f401f4e85146946c923c7dcc599d116ef
MD5 09c2d0d3c977b75bf7f69ab24b26a7aa
SHA1 3968a3d5338f9841debb41f067b05d33079b937c
SHA512 1e3908b261c69ff594fb7c5bf3ecd0b97ee5bb17128d277c48469455cf873fec2774b5674915c78c06cd1d09e4177bdba348bd565503356bb7d93523af38fc09
SSDEEP 12288:0i4e7PRdTfgwCHKy7GLbbdIvStM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:03Id9CHKy7GZj6mctvE/BT76+1NCE
TLSH
T11995CF90F3E410E8F0B78A7589769111DAB67C9A1B71CE8F03A4661A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 b3e3a0454682db44e1416595497e467ec5b1d7011a19ac73cb3146a6512890cc
MD5 eebbd75da49a29769c26d6fbf9b929ba
SHA1 5464a7522af98655fe62f36010c2a5fa872cf6c7
SHA512 4f6ac0b7805c00792c1d3ef5f6f6ffa4ad07f17f7201acc0b2c5e74dc0907cdb70ff5d34e59bb43281a53c4f0092d7e5afdeb94bc02c2d23d10ff7af619e32bb
SSDEEP 12288:TntM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Tn6mctvE/BT76+1NCE
TLSH
T144652381981B01D5E9DF07F09355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b79be8d54dcc4645505ce4c4fc536b9be2d7d9a8ca2f5812c4fb33cd297ffb37
MD5 76b39d45a171448268f4d7bfbe509ea0
SHA1 e90d29357427515de137e593c4e5364bcd91f760
SHA512 c68f6b5674a3d26839bec1375c80e92cb9715fb352d16eb3d26d4992acd7762d12a2ba48bdbfcba519858b35086bb54ef7c4589b00314819f98333a47031008e
SSDEEP 12288:yltM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:yl6mctvE/BT76+1NCE
TLSH
T10C652381981B01D5E9EF07F05296E296E8502FFE74DB1881F326841FAE705627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 077a1c41e4fcc870cbbed4ac03af80bae8fffff3c3512a85b77aa2dcb058b8cd
MD5 d43cd9523360f91b37fe148b7c262f8c
SHA1 2e5104896353ac667c0a3297f54612df44fafc7d
SHA512 bc7998911f62b627ebc1fd78b199c13a84122ded69face4cbaafa807d6c6d76c23d2ea2f91816a693babf1b2ce851970f70326a387070fa5ec754ba34554d6b0
SSDEEP 24576:Ifwvik9RX6wkyAIA6mctvE/BT76+1NCE:KMnYIA6mGvKVO+n1
TLSH
T18395D129EBDC04E5E1B7927C89B3460AF6B178691B31C6CF125A536E0E33ED05D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7c13221cdd240416d7795a17bfb6d676272081c8a92b6987e1240800b1fe813a
MD5 5ef8ab3d30576e1cdae279a9ced51d83
SHA1 e1fe1aaf6291b5582ae9301417ddfb15aa7675bb
SHA512 257f311dbc51d30368463f3bdf5810e4b2b9e898b085d903d950f80df6d1f841e9c8b3d0a3052bcb8f8f07e0f5218caefc2da4b63909fc44bad9cb8c89e7762d
SSDEEP 49152:cYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0b6mGvKVO+n1:0ySzPjXeN+1
TLSH
T126067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d3bb6af468ae05c2bbf507283326d329638f589e9d3723d14ccf907f4a72785b
MD5 0f76ffc3165b8dc11ceb88ca1cbee25c
SHA1 935bbed19e4785851cabb0a2bc20e1c6421db2f3
SHA512 b4be5ea2d5a86d6eff0bd0fa2b8baf1621b255904bdb0748415bb4043eb19239f5323083ee2d66d8461f23e3c7c294c08e8a03fa4c7d434e4546bfe4850e55ad
SSDEEP 24576:I47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYR6mctvE/BT76+1NCE:I47JUQj4irIhCnDHUPfF/L6mGvKVO+n1
TLSH
T14365AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 e0e7dc9c83d27fd8c6dbc4e942b76b9cbce2a001b8b6f24061fe679ca2c325f3
MD5 6586cefe0a9331bb8fec2499e6aa39ee
SHA1 dbde65162e6604c4181f46a77a4da3d04a19b138
SHA512 ccafca78caa22acec50a8152ff6c0c9b0d95a360b356117c47c77a0029e04a6f3013899f3d7b816ed13889f7d5d853e842bbf2de1ec0646256cfc3d50bf5c99f
SSDEEP 12288:x1sf8tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:S86mctvE/BT76+1NCE
TLSH
T12475F14AD25902E8C0AE12B5C7569241F7333CA5A7E293CB53D0F53E1F326906DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Player.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
Size 1KB
SHA256 0110d15f1dd6b55b7a3817f9261c37919d81f466789c5e71b98da2f453e3a33e
MD5 29c46bb40a9d5af86ff22370d0674c39
SHA1 cb8bf6432ce8fd7f0d2dd7b2b35062e5d1475e75
SHA512 efc07fac560a72b9ec9d17f8eedb0c25c926f55524102392273fe8bf1c136df8fff1e1ee6f4213583dc086cd4d31ffdedce44733162ce93324d8b4fac0d83329
TLSH
T18221CE118FE35717E2B7967259F50352EB73BD02FB285E1D428412082AB6020AAD8F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 8d921cc42ce6e3465eef8be4cf4b040c60cff49704b46561628d7568dc6f4621
MD5 b5521e494910d085696736443672fa47
SHA1 0c8fc9c46e5421209a155b7b176175f66e10c1b5
SHA512 83dd9a10a51083dc3b24d40bf9ad50618342a576ce580b18911252e1bb3977ff5f61aec5f3ea7c95033cadf0f07a38a38c202b6bd0cfb2c745446de22fca5924
TLSH
T1B221B1518FE75317E1B7967259F50352EB72BD02BB185D1D4194120C2AB2130AAD8F6F
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 6e836ba55e365894d7a5eb78c60e76b4982615f61f3d88839196d0b25aac17a5
MD5 7ec59e181d2b25cfc320293c56b407b3
SHA1 e46a511a48fcb40a0ccfeea344dd00bde9c3f7ab
SHA512 60a6ca567b2d512721af8b4e5290c264204ae93b027814044a7eea7a40b5b50a51c6ec528c2410abcecc23ec0c3cb8c7e13f64fb8338a5ff4343839d9a5ff40d
SSDEEP 12288:Yv7UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:eU6mctvE/BT76+1NCE
TLSH
T17F652382991F1184E9FF07F0529AD225E4157EF93B9A08C3F211851FA9305D1BD3BE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9d82e45915e0ff3a7e7d14b151c34082e3b8b3ea469eb2928b6cba644d223918
MD5 d7e70a6de165d58f5b004e1ed3ec30b5
SHA1 a7ca542561376a5f12896c8e2a7af1a63ede7faa
SHA512 1fb4e36955cbef0fcf4aa8a12689fed09e9b5d0bdd3e68aeeee3b52c8f3f0c564ad2672c8625c095e8b6674a0382b52194fe25932d9f14c6ebd0ea21e7ede2ca
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bY66mctvE/BT76+1NCE:kgb4mBIBhGFR6mGvKVO+n1
TLSH
T19A659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 676ea01741eba58463ee97441c12c9630607f98d916fb3d5cbc15f026b8f8d2f
MD5 070652e8394114bb1dac8f00501b69f9
SHA1 803073fd0dfe7e826910b961adc944f948e7808f
SHA512 7ba4ae34bde27b49e1055d1e70acfd866f709709e05f8fc67923dd5842f1b3e49d71a3e0c12c7516962dd339d7051dbc8eb22fddbf201751c6df6d3da079f975
SSDEEP 24576:kG88u8FpJqH1jzria7/mh6mctvE/BT76+1NCE:X7ZFPqV2a7/y6mGvKVO+n1
TLSH
T11F95F16176E101F0D47BD1388A864263F6B1B8651364EFDF07A88A561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 abd68c758c9062881ed8b745ae64e4490b6f6931b2ed6a788d904140415eede3
MD5 dad25225d48b58f2eb3638c3cc35193d
SHA1 477ac128cd358e1af13f0d730088c40697c308d0
SHA512 7781d20f0d07ee7eca190a3a380bbbce77c23abf9af74eba0e00da5d49e39879c7c8ed311c4ed6adf2ac6bf2e231800aec8106e900f71eb93771bc79e39a3396
SSDEEP 12288:wHvUrBFrEjwaQNtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:wPUr+NQN6mctvE/BT76+1NCE
TLSH
T13875F21F65AD18E5E67AA17C85828319F77178A2171292CF02A1813F5F33DE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4c1549a43507717bcc8342f97887d0124c35e4bfd9c8627c58ecd029be89d121
MD5 b35f2d9f51da77373a1b2f1a201e0c71
SHA1 5e423a650e87a79da2f82cc71d2a33846dcfa9d0
SHA512 e208ce76f51067262e1ec3c93a528975f7e37596dce074b90f38c312d17bbcd7ec1db8c549c451dc93c2bf2685bac81359bcc493bf53dbd6b32936310e6741cb
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjd6mGvKVO+n1:IG05lO43bYXeN+1
TLSH
T1E3D5C06A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6335ab6962c6ac12c60cfdbff3c3b72bafee0b28af9b005ed50435ab90f19854
MD5 51ac96fe3035022aa9bd08a96977c1d2
SHA1 3cca648404dc741cc1060c2f47fb90646d1e1d76
SHA512 e525c320d1e39c9c8b72b2dca45f9c628a707dc16d9e9d29aa7bbfd06b1b3bc52772aa6b1fec84b4cf87470cfa116c5d4032f8a2cf63e4406b7568961dafd39b
SSDEEP 24576:0fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnb6mctvE/BT76+1NCE:sa5POZ39Jt2pasx2+ml6mGvKVO+n1
TLSH
T1D565BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d8b671140087bf444c862946d9575ad31c3ab4388e24408e713204bd6dc6a9ac
MD5 2a762cddf31d10d76c951ee9b0e76bfc
SHA1 7fc75c55cbc0ee213469ba3f9ca677b1b96f6c7d
SHA512 7d7192aa7792d9125fe40aae9b5d7f2df08e42aa85136bfb680f0a07f2b65460d08792c8b5617a8ac517e1ab0b4689111353ed3a95717ae63d54e0f3a6ac3a83
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkJ6mctvE/BT76+1NCE:zNc/zEOVHFS6mGvKVO+n1
TLSH
T1CA858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 88e3133ed0749b6c0a999dd0f4b66e258bbc02027f0f53fea5412330f6b2c714
MD5 25884edc99126218682b1f6961e45678
SHA1 fe316f0d4550bb0c1db1c20bc27df600348138cd
SHA512 fd64dc5f082e3dc82f4e54e215d98eff7a31b9fa7706001b29e415ecf2d20d3dbff79a9e7e7393ab4617005bb1b0747cc25325b8d1d7045a6bbbdc26d4870d5a
SSDEEP 24576:ItkNvNnaFeYhJNtmZBmv6mctvE/BT76+1NCE:ItMwBtOmv6mGvKVO+n1
TLSH
T1BE55AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 996013fa88a158bd206f32ad3fb215ed6bf47c4f20201dba93e20533b3d0326c
MD5 b10dc588a4be9005c25707ac08def7d7
SHA1 42c4ef53193437ba92cb054a7eb9e77d54da458d
SHA512 b3ea31195a3d8de4c96f3ac2789d07200a0db9b6eecc35463276e6914a15375438fd8288133728fa95b379ec66834f0f31fd1c62a7adc64e6edca9a974917701
SSDEEP 12288:YQcMxWDXN1Dp/fshBItT1IQgAItM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:6D3FHshBIYQgAI6mctvE/BT76+1NCE
TLSH
T10485E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB0294C1BA5F67EE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-203-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/296-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/296-49-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/296-51-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/544-183-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/544-194-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/544-189-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/544-177-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/544-176-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1672-87-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1672-81-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/1672-88-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/1672-229-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2092-160-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2092-309-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2092-168-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2092-170-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3520-207-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3520-385-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3520-214-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3520-206-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4620-57-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4620-64-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4620-45-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4620-39-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4620-38-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4820-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4820-322-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4820-243-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4820-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4820-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4820-102-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5176-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5176-21-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5176-20-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5176-14-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5176-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5196-205-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5196-75-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5196-63-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5196-66-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5548-174-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5548-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5548-167-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5548-123-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5548-117-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5660-169-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5660-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5660-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5696-0-0x0000000001A50000-0x0000000001AB7000-memory.dmp

Download

memory/5696-86-0x0000000000400000-0x0000000001447000-memory.dmp

Download

memory/5696-7-0x0000000000400000-0x0000000001447000-memory.dmp

Download

memory/5696-410-0x0000000000400000-0x0000000001447000-memory.dmp

Download

memory/5696-5-0x0000000001A50000-0x0000000001AB7000-memory.dmp

Download