Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe
- Size 4.7MB
- Sample261110-3ef8lsst8q
- SHA256 0ae6d288a647f8d0d05bcb6ed101a0cd872eb13cd5035e6b0ed2b220104e3a20
- MD5 3004680e4cc4ac1eea5c994240b0265b
- SHA1 9127b47f8cbc89b1a6a9e180c89aa13a56c6929b
- SHA512 a4f84cefb6e38694ce3f848f5a637d1f2faf649b19b4fb1ef7ffcae751a04c768b2f5e701a336f143c58734d027c446b0b3806e0f347fc914f2ea9dda815e4a1
- SSDEEP 98304:mJeV/ztZBem1oiImuUiK9N9EGQKF9lSHbr7axVQ:sS/h3kmg4EpbrO
- TLSH T17936C062BB41C071F9C201B964BE9F7A497DAE204775C0D397D43E6A88311D32B3A79B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 23 IoCs
pid Process 4704 elevation_service.exe 2488 elevation_service.exe 4184 maintenanceservice.exe 5056 OSE.EXE 1200 PerceptionSimulationService.exe 3472 perfhost.exe 3976 ReFsDedupSvc.exe 5872 SensorDataService.exe 3576 ssh-agent.exe 5996 AgentService.exe 5784 SearchIndexer.exe 8784 steamsysinfo.exe 9056 steamwebhelper.exe 1020 steamwebhelper.exe 9936 steamwebhelper.exe 10476 gldriverquery64.exe 10692 steamwebhelper.exe 10752 steamwebhelper.exe 12416 gldriverquery.exe 12680 steamwebhelper.exe 13732 vulkandriverquery64.exe 14312 vulkandriverquery.exe 14328 steamwebhelper.exe - Loads dropped DLL 55 IoCs
pid Process 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 8784 steamsysinfo.exe 8784 steamsysinfo.exe 8784 steamsysinfo.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 1020 steamwebhelper.exe 1020 steamwebhelper.exe 9936 steamwebhelper.exe 9936 steamwebhelper.exe 9936 steamwebhelper.exe 9936 steamwebhelper.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 9936 steamwebhelper.exe 9936 steamwebhelper.exe 9936 steamwebhelper.exe 9936 steamwebhelper.exe 9936 steamwebhelper.exe 9936 steamwebhelper.exe 10692 steamwebhelper.exe 10692 steamwebhelper.exe 10692 steamwebhelper.exe 10752 steamwebhelper.exe 10752 steamwebhelper.exe 10752 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 12680 steamwebhelper.exe 12680 steamwebhelper.exe 12680 steamwebhelper.exe 12680 steamwebhelper.exe 14328 steamwebhelper.exe 14328 steamwebhelper.exe 14328 steamwebhelper.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\locator.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\51a7e1b3c17a6531.bin elevation_service.exe File opened for modification C:\Windows\System32\vds.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain steamwebhelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname steamwebhelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname steamwebhelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain steamwebhelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname steamwebhelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain steamwebhelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language steamsysinfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gldriverquery.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vulkandriverquery.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 10692 steamwebhelper.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName steamwebhelper.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c4cb6d46a71dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006aa141d66a71dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022dd17146b71dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fd74bd46a71dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe - Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 4704 elevation_service.exe 4704 elevation_service.exe 4704 elevation_service.exe 4704 elevation_service.exe 4704 elevation_service.exe 4704 elevation_service.exe 4704 elevation_service.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Token: SeBackupPrivilege 3976 ReFsDedupSvc.exe Token: SeRestorePrivilege 3976 ReFsDedupSvc.exe Token: SeBackupPrivilege 3976 ReFsDedupSvc.exe Token: SeRestorePrivilege 3976 ReFsDedupSvc.exe Token: SeBackupPrivilege 3976 ReFsDedupSvc.exe Token: SeRestorePrivilege 3976 ReFsDedupSvc.exe Token: SeBackupPrivilege 3976 ReFsDedupSvc.exe Token: SeRestorePrivilege 3976 ReFsDedupSvc.exe Token: SeBackupPrivilege 3976 ReFsDedupSvc.exe Token: SeRestorePrivilege 3976 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 5996 AgentService.exe Token: 33 5784 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5784 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5784 SearchIndexer.exe Token: SeDebugPrivilege 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Token: SeDebugPrivilege 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Token: SeDebugPrivilege 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Token: SeDebugPrivilege 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeDebugPrivilege 4704 elevation_service.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe Token: SeShutdownPrivilege 9056 steamwebhelper.exe Token: SeCreatePagefilePrivilege 9056 steamwebhelper.exe - Suspicious use of FindShellTrayWindow 16 IoCs
pid Process 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 9056 steamwebhelper.exe 9056 steamwebhelper.exe 9056 steamwebhelper.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 5784 wrote to memory of 5104 5784 SearchIndexer.exe 100 PID 5784 wrote to memory of 5856 5784 SearchIndexer.exe 101 PID 5784 wrote to memory of 5740 5784 SearchIndexer.exe 102 PID 5784 wrote to memory of 1116 5784 SearchIndexer.exe 103 PID 4824 wrote to memory of 7784 4824 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 105 PID 7784 wrote to memory of 8784 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 106 PID 7784 wrote to memory of 9056 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 108 PID 9056 wrote to memory of 1020 9056 steamwebhelper.exe 109 PID 9056 wrote to memory of 9936 9056 steamwebhelper.exe 112 PID 9056 wrote to memory of 9936 9056 steamwebhelper.exe 112 PID 7784 wrote to memory of 10476 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 113 PID 9056 wrote to memory of 10692 9056 steamwebhelper.exe 114 PID 9056 wrote to memory of 10752 9056 steamwebhelper.exe 115 PID 9056 wrote to memory of 10752 9056 steamwebhelper.exe 115 PID 7784 wrote to memory of 12416 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 116 PID 9056 wrote to memory of 12680 9056 steamwebhelper.exe 117 PID 9056 wrote to memory of 12680 9056 steamwebhelper.exe 117 PID 7784 wrote to memory of 13732 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 118 PID 7784 wrote to memory of 14312 7784 2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe 120 PID 9056 wrote to memory of 14328 9056 steamwebhelper.exe 122 PID 5784 wrote to memory of 1980 5784 SearchIndexer.exe 125 PID 5784 wrote to memory of 10284 5784 SearchIndexer.exe 126 PID 5784 wrote to memory of 10592 5784 SearchIndexer.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exeC:\Users\Admin\AppData\Local\Temp\2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7784 -
C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exeC:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1769731672 -logdir C:\Users\Admin\AppData\Local\Temp\logs -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\4B81.tmp3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:8784
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exeC:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=7784" "-buildid=1769731672" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-11-09_3004680e4cc4ac1eea5c994240b0265b_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_qakbot.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:9056 -
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exeC:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1769731672 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x2fc,0x7ffbd519af00,0x7ffbd519af0c,0x7ffbd519af184⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1769731672 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,3976104196642728646,1352963464924981530,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1916 --mojo-platform-channel-handle=1908 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:9936
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1769731672 --steamid=0 --field-trial-handle=2188,i,3976104196642728646,1352963464924981530,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2260 --mojo-platform-channel-handle=2256 /prefetch:114⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Time Discovery
PID:10692
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1769731672 --steamid=0 --field-trial-handle=2316,i,3976104196642728646,1352963464924981530,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2332 --mojo-platform-channel-handle=2328 /prefetch:134⤵
- Executes dropped EXE
- Loads dropped DLL
PID:10752
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1769731672 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4116,i,3976104196642728646,1352963464924981530,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4172 --mojo-platform-channel-handle=4168 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:12680
-
-
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1769731672 --steamid=0 --field-trial-handle=5184,i,3976104196642728646,1352963464924981530,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5248 --mojo-platform-channel-handle=5252 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:14328
-
-
-
C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe.\bin\gldriverquery64.exe3⤵
- Executes dropped EXE
PID:10476
-
-
C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe.\bin\gldriverquery.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:12416
-
-
C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe3⤵
- Executes dropped EXE
PID:13732
-
-
C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:14312
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2488
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4184
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5056
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1200
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3472
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5872
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3576
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5996
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5104
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5856
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5740
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2940 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1116
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1980
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2940 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:10284
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:10592
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E41⤵PID:9640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:18076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:5176
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 ed6071ed64cb79c0282694b898f120d3425f02f690cdf726decf7ed906d9868c
- MD5 6ab87925fdf18ba042759c1de5c0f267
- SHA1 373a7dd0c8b348f5f16c73f0c362d6602b5f9acc
- SHA512 153a937e936f249b84d646db45029b1c6a5f5b7c75543808cfdfc07a6bbc9795dceb4aca72471e444531e1d0b89786c0844fff5850d8a2315073ac9c66126952
- SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJj4MYPVyGLM:03q6HjBZVQ
- TLSH T145D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 3bc21bf000f68078182acc797dd52709744435d31d1428262dc33e173d5d7ba3
- MD5 2e2a4579ff7b18cd78298abd1cc83a17
- SHA1 e71c5db3a85c9828106b21b28842f46c7b0bcb33
- SHA512 56dd0e73a2b94693483b60125b043a45125306f3e8f4e583c16b606be5eade46fb47442c29abd36dadf775641e4c53f224dfea7729ec2f396cfcb3aa65552ff1
- SSDEEP 12288:i1XLsswWkxy2lRq2czAM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9H:oXYfDtczAXSnnrFb4PM4MYgLxEVyGL5
- TLSH T1C575F12977E408F9DD6B8278C9A28515E633BC518760F78B03E499662F333C85D3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 5977e96b23bde92a01dc0991e0ae40db62c0ac83dd8b3ec671f46ebb360a5fd8
- MD5 75c10f9816556a16c096b8fab2638942
- SHA1 8875e2c1d34174b10dcab8e3ba83044aec591b9c
- SHA512 10c17d3c8066d117ee6ba4e7bc4f73c0634e7e7b71e04ab042e44a34df752bca291a39fd090c0a7a3e7617023b1f172ae89fc03bea9409a6abb0fc7923413bf0
- SSDEEP 24576:b0Le5ji0hmxWrMmSnnrFb4PM4MYgLxEVyGLl:bPji0A4Sj4MYPVyGLl
- TLSH T164959E66F6748375D073C0B9C5D2A68EE97230825B308ACB4286D77C3F676E68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 eec4e7085779c2ab0ca2153f3111b1923bff90506045ecbd229e6aa350cf8add
- MD5 d3314df90cd51c5813921d78ffff6e23
- SHA1 43eede6b27d5248185f4ca7738c7b7e7bbddf5db
- SHA512 f2991094c1e5621256581f04eaa868e1c97d2d7bb6c580778137715d4ec3002263617e4730f0dd526d3a02315b75b3e54daab4139fca76704ecc8df5db4cc64c
- SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyu8SnnrFb4PM4MYgLxEVyGLZ:8/ezSC6vUzPvxHjymj4MYPVyGLZ
- TLSH T151755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 ca5cf5ae91aca34c3259cc9b4c2b08b1f4a3422e196de35677cbbf04d08dd6b4
- MD5 24441fced28ae30c988aa5e5efe3969a
- SHA1 26b182459d89b3fab791d2cf77116117dd1fe632
- SHA512 66b794ea21abeee706cfb63351f70ef3a56f375ad9b1698bf2cf43ff5d0820bcfbca6a0bbef8b7441262a98bdfa2f7cc085d245e6ef9726f495879ffd1294d80
- SSDEEP 24576:9VbqPb88hv/l+6zSnnrFb4PM4MYgLxEVyGLv:9VO88hXl+Vj4MYPVyGLv
- TLSH T155559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.3MB
- SHA256 34f66c8a41c4e751830eb8f11d19726183e6631bbb93bd871cf2f90ef8592ce3
- MD5 02c7cc410d2873d54da43fc3a6e64b08
- SHA1 7c740c8bfb9d5eae7b6f35df6af53af5dfc8a6df
- SHA512 3229a6d65cc3072a9770926ce284e8411ac7c035a0966105f24fc52736a6dc2bb7b13d8f95337bcb18106008e4cb7c6796adfc0dc50098c6fc010fc39b377f14
- SSDEEP 12288:Swl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:SwiSnnrFb4PM4MYgLxEVyGLx
- TLSH T1695523A72BDC10EACFAD15B0D1B96AC8E6167C61F875B20B6750785B3A3F10DD892313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 be5d456f29159d37e971c45d5b2fb51fa9eeca52a1ae702da9badb870d440f78
- MD5 4255dbd4b0bf27433ac14804980d89fd
- SHA1 91e69f6c6cf8fdfefbbd48b1cd680d7fd3b0c076
- SHA512 2009ea6357bb53cf58f19a3591e8bd8a1f27f26f33c017c7d9d0848bf67b0304079c798c6abc466b04b1636231cb0fefb21f5e7df520c283c8bcf45edaaab485
- SSDEEP 12288:FeBNUbTVO86UY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:FJIUrSnnrFb4PM4MYgLxEVyGLy
- TLSH T1C875DF3BAE28FCE2C67E4DB857918740E77278308F62A3CBD164820E9E235D55D76C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 e0f3c5bcf865ecef82ac54548ed3b0327967584fcf960e60be13dff9a005bf5e
- MD5 e7394966d32765383b34e1fe7888b0d7
- SHA1 d9631804bd8b5756f03c8b93db06e6793e2faec2
- SHA512 5cc39d0e909d60064bd057ff6615f4c24c8d14f8a26b19c1161ca005ddee105e45426055fe556d0dd596441c914d0c2a3991de3384789dea742e4149ae137e80
- SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:/QvGAdlCEL8c/yRNw5C8Vs
- TLSH T1E6267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 731be7bf1db641526d2904f0f307f3a315c97d03223010fc5ca9959729c391a4
- MD5 251f5a7769d87e4fad2fc995d2be5bb5
- SHA1 3f1d8ed579a3eb7e2399c425f74cc6a068d72efd
- SHA512 948365585dfd7487bc3ccf2c9ff9b5f6326f29f30cfec7df480ff333cea627c23633efc14b25364b592b7b703fa0b7eeb939fcdc21f4ba625a85fe5e52328af4
- SSDEEP 12288:ZAwSfxL/2Dc3UDLLmt0LDQewsAja34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAp:KJewsAjJSnnrFb4PM4MYgLxEVyGLe
- TLSH T11E75E031FE74E036C7BF0DB21B36C716542DB9204B612AC3E3A89D9E59342C26776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 7857f7b023abd3c721a4a013934dac91a436948e80465579ea602340bfffcc3f
- MD5 5d2738473df64e3eb34dfa9ad7d122c3
- SHA1 14630c6b70a1763b1c25b12f46b9d5937fd4b01b
- SHA512 27bda286feb90ef95107c4100fe5cd317bd011be20e62b5b037d3f0c0548d8b361b1cef5876a5530ba987df60328f7555b4f1d6359aeb8550ae82429b54546d3
- SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:hUEtQevvqc2W1cpV2EI32
- TLSH T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 cb0bbe3903bb57f30a674d097b94b3cf7d222b8a7025ceff91e21fe231858236
- MD5 72dd54a13dfd77b185eb276f96327fbd
- SHA1 ad1654661bb5e00a4a4562d5a551a0c36cc74df9
- SHA512 88cd636fb5309389d2adaf015235c50d1d7f3ccb4096b407007c127399500cf656dddc452633c860f8370bce3761ba5348b96f61cbd2bc11311025586ad224e6
- SSDEEP 49152:ZCbRquA/m2yL5zQfFiV+XenmE3/zij4MYPVyGLb:2oqtVjnmgVf
- TLSH T1A2D58D0976B8C2E4D1F6C77886A2C647F37178158B31A7EF4265461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 4d0fe7d708e478c90dfa210a7e2b63657868aa250d7e89a15ebc28d2e97a3b5e
- MD5 02511568b2799b82a49d4fda8ff982f4
- SHA1 eb8a52a63257f857d3fcfd1a3e23fa474fff8823
- SHA512 c111e9922610b8da9899b4f4f4be171e84d1d94d69f82c0aaa81a8c2b081238ed26af09bedc36f9e21f9266dec2947a0beaed3731cafc89943a3d800f46378cb
- SSDEEP 24576:sAhGLJIFoiwtA5l7S53ASnnrFb4PM4MYgLxEVyGLe:sAMyFoiq5jj4MYPVyGLe
- TLSH T14435AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 2c0d3eb4cbca029504334bd2bdb857496835f67311a22107dcb4f1657e6eabbe
- MD5 545ae930d6281fc312a1fbd9ccf52cc9
- SHA1 45e6dd1795b9999374e5f4eefd1e3924d2de1b08
- SHA512 dcad2358f4d5b318d4a1e3036c08d0301fea3e6a9346cef3dd330e476fda23a02c7639a36ea6fb6134497f23663ee2fb0ee1ec3fb8bfbd4ce2f6a109fe23cb9a
- SSDEEP 12288:Smw5HEjsChNmBFgl0WDm+CD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqc:Lwu3OWtSnnrFb4PM4MYgLxEVyGLy
- TLSH T11775F04636E81CF9EAA74238C5978535F7B2BC123A21D71F1760C65B6F37311AD2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.4MB
- SHA256 73156e8bed6c5949cf53e9eb40ff5eb8c2e708afbcc96f7db83b8966d5a8a3a5
- MD5 ad7b081011331291144a0c61a8df7dd7
- SHA1 93813bd6e27f91b8ac91ca2ee55547c2796fe245
- SHA512 dbe1a2d864af4ac450dee581e471ce0f7a5ec9668cad0e48f8c801efc51b8521c6ddf7d986f7856f66c6fce410caac425415df17b29960fee70c2c0e373938fc
- SSDEEP 12288:y2Z1IyK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:bZueSnnrFb4PM4MYgLxEVyGLL
- TLSH T1AE6512AA37E820FACAA74274C5F55A88E3327862B73293CF1650555A3F37AC55C35332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 2339ea2805e7f1c7d1b20fb0fbd4dd3c5b4f8c1879d6e5c39351a5524d151359
- MD5 d192a88fdcbe8a9a34c83c3d3032b07c
- SHA1 31fa207c4531580f4c6228b767afcc668d8f17c1
- SHA512 d1e6ea4bf18a2085199f93ef8d702c27be2e6372b267700d68313e42e211f8520bb6e3eaaf5a498c97d330b4bca156c95379a9bcbac3507a07a007564a900fdf
- SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:WQRQyi36YOcPQLvw2gAf+PN3VVZ
- TLSH T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 cdbec8ab085262cef237cff712f987f5a8030229f06d4b9b167ab0725cde98a9
- MD5 5ddc932465e44a16c0a8619ab4c060ff
- SHA1 097e3ea63ed1bec8d7caab7c4ba8b4311c7a124c
- SHA512 50b9f27ae00e4ed4fd282cd49ea4a13fea4709c88ca092ab0f2a7a83e6eed69af184c19904e5e1c6a8abaa54ef7a9c3f557fed1d68ffd673a90dc8635b2ae818
- SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:7QRQyi36YOcPQLvw2gAf+PN3VVx
- TLSH T123667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 afc77f3768be567fa3ff8a2ff2e2d56a009237ea5f6a2a3d2ecd2f5181c66425
- MD5 e42b90609aaea2f497859fea92378c93
- SHA1 cab239b3fe0a54db42661e0fda3bf385a06f731f
- SHA512 8b72fb695b79c925ca403b2939058b04bf7447555a937b302533ea26d1bfb4c32c4c63e09c993d78c30b46f018bc5c902b65dc2ef5b9b30ff5f6bd5ea158d7b4
- SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0uSnnrFb4PM4MYgp:d68Qg55nhheWu7PNU3/Sj4MYPVyGLO
- TLSH T1BCB54933B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 da829360f5c32e917f2b26fb7fab9cc512d69b020ca161bfb80092fafdd284a8
- MD5 1d4f64f005b089e01a0b5e7fda23aa9b
- SHA1 d10f8622905d8b0c8da872bfedccd0e02369fbae
- SHA512 24436f428b0c4a5d0473779784f0d466fa72a233be5d5c829712b66d78da7e587a683560aafb48b6a4a1b8c40d0b8f77ec0d31a93f5307562094a3c7d41193a2
- SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99N:Uy5112gYy5azzVvL69nLKnhZmVf
- TLSH T151167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 95e06f4e6c941407ba9d294383caf4b4cd7ac8608c4a188ed289ae9a53095216
- MD5 07d57981900c188d315d7a5865d5905e
- SHA1 d4eec4184f5bc295223bda68ae203725b94af9c5
- SHA512 94c11dedd67b6a9a8024ad4461767ce7a4d8627bda55a60f97eac5dda45672714395c34433e8ca3884219e3cfb56cd4c631a7cfa5f2fddb6c8b7047bfe74432f
- SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgj4MYPVyGLb:4u6JmVxd2d9V/
- TLSH T173D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 fb587b7bb60327452639f64b34791cb132115c02a1d560524ae2b7bb531f9cf7
- MD5 e28e12a5f209f8b7d53db81bac7b5ab3
- SHA1 12dcf1164f3f9309a5b674243de6404537cbc0cf
- SHA512 e5c92a3f008f49300cfde70a8faf2cc3b0612086356972faccdb612484a1001727f96368e96b015c206d8495d7b5df157471c5f54a9a0e218e3107e1f47ecb05
- SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xUj4MYPVyGL+:nmifPbRgVC
- TLSH T14CB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 1be91f3e35029254c6fcd2b38381271f0d2a1dcef84bf9ad48ff7d45b90af1a6
- MD5 9bc1aaa0025b46bcf767e4de18b52147
- SHA1 a37b71787800d8b2c08f8635ea1b1d4edead49c1
- SHA512 b2ca1f584ce9a2d0f345c3282b656d686c7dedf2908b344a74fe9df7810356b70e4bdb3eabed784aad368de168cfe19c72167a99f2979d1dc12cbd9dc6249be0
- SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHq5j4MYPVyGLF:V5dKTi61iVp
- TLSH T13AC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 797c538178d4f561fded92580e8e74a18e54dadc828b32626a5beb04fc9eece5
- MD5 2d779bc8997bbb401ccb8c90e8e50d42
- SHA1 58b85127991fb6c903c8992c66c3422daf45e928
- SHA512 5b4b5f30b481b0c416121a12142ba0349ab12f43e74b99193e2073005df21b667c2e98b9381bcd8b01f8583018fba8119db504c76dc649a011397490fde2c040
- SSDEEP 49152:thtSn8EApI0figngiDn0AP5wQj4MYPVyGLv:8X2iyphUVL
- TLSH T14895BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.3MB
- SHA256 84f0c865d4f31c84332085646cdb40db4aa29a237f24d55682505eccd837e6d6
- MD5 3f166e0b57124eec8584a2a2f08542e1
- SHA1 57e7c56682b4daae4c3b76a968e1d83af8ef883e
- SHA512 5c033d3ce271abe6407a9a8572ff412d67e45d86a12118581f3429d40eef24e0ea60989703c881a66237c438c97d91c19c42759665e3a512db5809fa897fbc7a
- SSDEEP 12288:xd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:xaSnnrFb4PM4MYgLxEVyGLp
- TLSH T1F75523A62EDD10EFCF5905F0C1A56AC8E20A7C63F976720F7B4474073B3B20D9892662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.3MB
- SHA256 afca0e2a66ab1c499627ac456b63cb65ca539458bcbfddd72f54811e96fe457d
- MD5 d1eb05f99605182175f0f1fd0c84930f
- SHA1 34174066e1e50a2876403705a64840cc4011da41
- SHA512 3f4497df45ecadca80f3dd895f04e4e880b8d8a9b341973df2a2ab23e18853575608bab25766636b8f0a0245c90accea30ef757a03e1c06a9c27d0bb1f58a7ab
- SSDEEP 12288:ve34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:vVSnnrFb4PM4MYgLxEVyGLY
- TLSH T1DD5523A63EDD10EECF5905F0C1A56AC8E2097C63F976B20F7B4474073B7B60D9892662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.3MB
- SHA256 73367543ef119a51bee57be9b3448dff7818a5ba22ce4be47b55bba9b17824df
- MD5 dab98685529643f5cda75962e77598f6
- SHA1 af2429e2b00070036feaf145b04d4121f57c82c2
- SHA512 9c575ce069709222471978a4bcc455b06511ce4286e9f10e02edea57994f8274da7e39a55bede80b86425565165ffe29230bb006ffb23410b34b3f5d72f8e126
- SSDEEP 12288:vw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:vDSnnrFb4PM4MYgLxEVyGLg
- TLSH T1E95523A63EDD10EFCF5905F0C1A56AC8E6057C63F976720F7B4474063B3B60D9892662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 6aa5ca5bb36a3944fef2ecc19ed54ef310b133bd1c4510e3c54f08b5f0a6bd8d
- MD5 83b2cf338439994f7621d52e2e81a1a9
- SHA1 bfa8313dc675d10f0f49d17e1a8219b17b98dc57
- SHA512 07e1970ef2a941db03506e06bb2f6b5d66235ffa8f2a859df1fe2ba136e44737b823355b20fc2125b59a58bad0f2fa2eb456080d7555a74096adb85e9d6451e0
- SSDEEP 12288:FVf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:gSnnrFb4PM4MYgLxEVyGLS
- TLSH T1AE5523663BDD10DACE6A96B0C1B556C8E2257C62FA72B34F6B40380A3F773489C71761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.3MB
- SHA256 a63760232d3ea111b0e62124a9dc1a3ddd012febae3aaa223029bb7963a5d323
- MD5 c6f0ce166f6f65fcb22c0539c4a6b773
- SHA1 e235ffc1e4c034bec5bbce909e01a4a6b2421796
- SHA512 d1654aebe8e50e948a4208727372a2ac790d536fddc2eb6deb394024e7469bb6406ca92e6a745acd809273b159bb19e166c9d745468b3ebf014bb00bff416c83
- SSDEEP 12288:kn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:koSnnrFb4PM4MYgLxEVyGLh
- TLSH T1FC5523A63EDD10EFCF5905F0C1A66AC8E2097C63F976720F7B4474163B7B20D9892662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.3MB
- SHA256 2829c479a28940f42ae005a1d0e63f68ab079c64ecb169d913d7f69525939214
- MD5 1794f5264e5086162e1e9ae3b84b383c
- SHA1 9c460b93780765242627c18402076b9086cdef4a
- SHA512 cdf6b7da469596addd303efc1b12de7bd261e7626393be7db19b7baf76995b4077f1a248368a13adbabda31d9fb315a3b88de9febf61f982acedad3e2db669c6
- SSDEEP 12288:FS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:FhSnnrFb4PM4MYgLxEVyGLn
- TLSH T1485523A63EDD10EECF5945F0C1A56AC8E2097C63F976B20F7B4474073B3B60D9892662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.3MB
- SHA256 358a03ff04cfcd5a1892a11b37692bbb821e5028c9052f4c9408d39e2e4a31a0
- MD5 1578bea2483eb9c14061b42d718ce270
- SHA1 e89c6ce948e53318b03775acf3301c9668beb6ac
- SHA512 7710f9d2b75a0880fc3be1ff6cc95b96d913b80129ce5c9a3b6aad5b10a8f3ebf2eb1587a8f3b548c9534f3188ff7a80b4e784f52a0a3ff5d2b0a847b47a6630
- SSDEEP 12288:uG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:u9SnnrFb4PM4MYgLxEVyGLO
- TLSH T1815523B62EDD10EECF5905F0C1A56AC8E2097C63F976B20F7B4474073B7B20D9892662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 e75899884e17f799aa0e2824ad21e725a23b2c957d8728433707f50018a0bdb6
- MD5 c8c9c4190b4626e8696e6c3eeac1c03f
- SHA1 a9693dbf429a70898c34bc50c5159ac8eeeab5b0
- SHA512 08a50da655cb569bd156027e233cfa5099d073b24c3f97b1756fd1de7a405e0024fe1ea7f60aaeb08be3e623a3de6ec30e4aee2a578ddb4f4f9534565eb49f29
- SSDEEP 12288:iiZwbmzzFEoS2cPvy+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2F:FZMmzFVSO1SnnrFb4PM4MYgLxEVyGLU
- TLSH T1267502A5739018F8DD67827EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 ec8a4b6321a7cf76c8e4ea5c6cb1dd8c000ac9ae9dc2f53c21e98890f712d2b8
- MD5 5e997051407693f2d5c0b662f8c8695c
- SHA1 0c16575e01fc77b7b8bae04e28600c5720a57289
- SHA512 77ebc762cb0fc87c28da1b55967d6f7beab8d6efc98fc5222a8b047daf79ca298d2af66089aebd88dda7b12c29080ebfe279c5223d8617f0651af0eebcc81ef1
- SSDEEP 24576:bfwvUk9RX6wkyAICSnnrFb4PM4MYgLxEVyGLW:JMnYI9j4MYPVyGLW
- TLSH T1E985D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 319a37180dac65f201b84b7b6277f75b34832747e1799a0d00f7ceacfa1f329d
- MD5 4f0b507ec14fb5a6758dff0c0384d796
- SHA1 efd68824fa24637e5d409ad4222ae6d8c6e36bb0
- SHA512 3423bf7a4e01a61e4be1b4755deff761fa334d4093830fab42ca53bf58038f5d2cb19f871123d45d63f7c7b2f419220d8de4a9fc029aae82ffd8f1bda3764031
- SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wj4MYPVyGL8:dySzP1Vg
- TLSH T14D066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 21270a6e4596b658b8e6729a8738846eca3d63cfb7fb953dbefcc4403641436a
- MD5 0b92897e2357b3248fa4a40610e521f1
- SHA1 5d562f65f2fbc2a1684f327700f56baaddd0ec9f
- SHA512 f00591f8c80533e4efc6060fd8b94482301c3a9bbce77974bbc33d9aedd38affe2b3151aaee97c6038b64441e0f15aae9e8c77e7dbe0326f350166880e95dd2e
- SSDEEP 24576:y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYlSnnrFb4PM4MYgLxEVyGL8:y47JUQj1irIhCnDHUPfF/gj4MYPVyGL8
- TLSH T12F65BE1EA3EC01E5E1BA827885154A5AEA71742E6F31D6CF2270837D6F23ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 da281b5e4ff0096729fe5bd09298ef585d7b1eca9d2a666b3df6cf37c18363c2
- MD5 901819a0ceccc6deeed07dd5e47333fc
- SHA1 c2891848084a9846e5645ead43082aa0c462eb53
- SHA512 4c59ac7fa053ab97ef98325a60a45318568803c3ea773a88157f5531127ca039a0e39684c3b4ee05095c83183e93ad046ad41f0ac01048a047a38fff6a52fada
- SSDEEP 12288:IcsfZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:WeSnnrFb4PM4MYgLxEVyGLc
- TLSH T19665F15AD29801E9C56E6171C3565A84F3237C21A7E1E3CB67C0F43E2F3A6849DEA713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.0MB
- SHA256 b79cbde6212177cc361070c94076f81d600405e64e13aaa521f74db8dfc4923c
- MD5 b8426fd0f57a24ad8596374670a986c0
- SHA1 4aa176f834aa49041de02da17431114e4d1b1d6d
- SHA512 f15780889998faa689de34b19d8d2826310ce7245b9969cbae349ded8e11b0eee769f4421b2d70ae8f5f92d009c3fb1d7fc038ef7f0585c3ee7e6f91b30f13e7
- SSDEEP 12288:WjCqU3fpbF1X4bvMrrulIC2KwfE5QwZ1+Ebu+:Wj9UPGbKuC+QwD+EC+
- TLSH T12E3517507666DB4FCA6940321E33D1CCAB707D51EE04AB0373C98B3FD576659BAE2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 c94cf53eebe028b18f7069a712650f414892a25079d44ea86f5a50c6417be148
- MD5 361ef7e02ee13cc4c5def06718c66075
- SHA1 03ac00c2e145c5edfa78a1df9c690846d4ae670a
- SHA512 32754d5cab348d84e7a773dd3bf52f79200d25522dc10488b6b93bd05011fd0d0ec61486479ff33f00660aee12631da271696faa3fd8cd62c431ee61df58696e
- SSDEEP 12288:QnDe7a1vs2kbP1fiR7vkp/uiR7vkyW9PgiRjsw:QD9s2kj1fiR7vkp/uiR7vkyqggsw
- TLSH T14E65F941A537E78FD1B66032072B5B8C6764EC07B7096F22B789453AD86BB11A0F93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\017225cd-4c9c-4109-b09c-17b90b1580de.tmp
- Size 2KB
- SHA256 54f1894da1ff237c1ad6a7b5e6ccd31f395dd83ed4a4d5a23e191f9fd32aec89
- MD5 39228577dc0f56f5a9f7843d99a59e3b
- SHA1 54f82d86ddbc843453059ba5edc80b68fc67710a
- SHA512 23f7273be0b4adabbfc82ec7ea0258f9e63990286c3d1fc0e866417f3b4467a4d1fb571d0f8d8e57f1df6e4bbb6450d4fa4ebb26cc93017333dfde514aaa3e72
- TLSH T1E5517534A4A8CD77A6BBCC51B6067B03CFB9306EE5546A94E5EE0B1D12EF49C0342917
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\7cb31fec-f607-4d79-87ef-3426195b6da8.tmp
- Size 1KB
- SHA256 2b790b0ef8b0c75d769ce3b219000ac3a863b54c23ef851a28b0ff6919dd1f11
- MD5 e3d4a6edb6627923a6a3455d5db174ab
- SHA1 3cabf0d0356e1ef9d8e2b812398aacb4bbb4a247
- SHA512 79f4a7de777c9fbbabd34152e52c627977749eb75929c1302e0a6e3b29d487f3641c0679d092fe3035afba12ce8ba55ab70c4c0e723d102548817df992228d1e
- TLSH T1A3116570F1688E7ABF2B8D657706B7434F31146EC0184A88B5EF0A1A62DF88C1226C36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\1d069ccc-66e8-40a3-9b7c-8a6ccecf6134.tmp
- Size 7KB
- SHA256 43d3a17138803426e924979ad99d0ac56db97757ac14c807c40eddbc1eefd07c
- MD5 6d1c003c6a29ceb9b2115c2ebd86a381
- SHA1 a7a06793df008686478b2c3ebb0b283f1bb8a6be
- SHA512 b4657064b825d564795b8e466a7fe902e7e1a72b71ef45411b447ea3659dfb791bd29703156e9158ceb695b90a3f46446c6972093ba08d0a0ca188c8876383ec
- SSDEEP 96:rP7JwYhBO1LO1Vie2Ef6ZFX7/x+hHMSm+tpYe2pko1CXa2MMAy8yIsnIejhAhgtS:rTiGGefgXV++wpkpkokKPM6yIsnDjwgQ
- TLSH T1E7F163196C18BA7F8CCAE718EA267B47D7F9202134953D48E7F8CA1C24E76DC2227517
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\temp-index
- Size 288B
- SHA256 ddc1241c84dc70ad2e06c57e65b368ee3fb1aa4a98a2a3bb4f00925020de96a9
- MD5 96e1bca539b7ac058f8a9c2a8b039e5e
- SHA1 b04f340533b4763a2a37ca3fc79d66375d35cc15
- SHA512 be8180d86fdbfd3731cec951891cdc9d194b009cb2e256592a7fae757b70a49edfc1be9738485c1a470a4cab08e26298113f65c301cb72561bac8a98e079b068
- TLSH T118D09E2055CD9859DF432DB144C9ECDE36B58A7325B75F4257A4047488773D4267B210
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\wasm\index-dir\temp-index
- Size 48B
- SHA256 c89289c8879ffd161717554831b0980f80b51ef0e865f215a835d2687e44fb65
- MD5 a410a0e38b5bf92a4815a5f3144cf630
- SHA1 7727870f354eff8270aa9ba1e5cd59bdd8bf8090
- SHA512 902a1b321e335f016881eae5c6303c4701109ece83c20208604c2dd758fc5d74e583bf004a8e48f104021f7d84f85e2568ed118908b2a0d6fba1e860964d68d4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\4bb61e39-4614-42f5-8403-2fdcd6ae5ece.tmp
- Size 188B
- SHA256 42ddf26984297ad72a8c68c782476a942a0f6eb48fca806a0ef2a9abaf12c0de
- MD5 c4fdc5eb0e16957dfdae35212380329d
- SHA1 00f919e27c097c33ed38dca14ca005ffd3d0ea41
- SHA512 864b2b97586505e49b0c6600f8821a6a3d5eda71fd24749d5c9f9d9d10f6c4de16fb771128a26ee29dc9435b4f1481a08af58b98773124d2c787284a214511b9
- TLSH T1E5C0C072007EEC3210B807311ACC7D219F3AF030008054F88143473C70D4E764213243
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
- Size 188B
- SHA256 51d95f1f6dd182fa88beae730e7b649f05c414b977a5ae7e47c3efb422ffb57e
- MD5 639e2069749396b178036ef7606124eb
- SHA1 810df6c2162be30b5b9ddd441ef44787f67759d2
- SHA512 8efeb8e139c046ba640bfb9bf44cc35d33b58e6511a5f5c9aaa74adc6b7a3b91b1c3c6f75b53c34a23192db7be6f514ce6508fdd6a69d162f7faad95f51709ef
- TLSH T164C0227280AEF832103805212A886D08DE3EB03D108050E881434A3C50504AA4223082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
- Size 7KB
- SHA256 0ec03445a9722e175fdb679ed10d42489891f210aab1042f3c2c6124d130e3b2
- MD5 8ea7b7603b2d2aa0e155c7e9e69b754c
- SHA1 794feea4728adc330855c48a7261c1417b365152
- SHA512 bf15f3b498a5d9846e98fed0e4a4ffb7ba5f595ae531328f9233e71040dcd9e1d4d584b24daf6351af5239a22bb30d22bf2246ad31a0487af89677e26aa2902e
- SSDEEP 96:rP7JwYhBO1LO1cie2Ef6ZFX7/x+hHMSm+tpYe2pko1CXa2MMAy8yIsnIejhAhgtB:rTiGhefgXV++wpkpkokKPM6yIsnDjwgf
- TLSH T188E1751D6C187A7F4CCAE719EA263B47D7F9202134953D48E7F88A1C24E76DC2227517
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Site Characteristics Database\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
- Size 889B
- SHA256 a0df980aa2eb43a26899feecaa4522b524e433939ee5f11be8fda4c7d899ac6b
- MD5 d55ef1f9952dea7636c14dcd3315d4cf
- SHA1 0a7a7d920b9d0c86ec8a22a3da3aca525904a425
- SHA512 35ad835ac2b023e0b51e417e3775b1d05bb1c50e075093bf85390a5dea3be1588142b476b1d206d3c346c6d15f0a8ab94b63f618145fd62472c513c8e226371c
- TLSH T1D3115670D5588E69BF268C257706B7460E25186FC0180A58F5EF061B21DF85C0116C3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\b2969698-1e9f-4261-a4a8-b4000ed8d112.tmp
- Size 2KB
- SHA256 c34171c7079aac4bed36f153e81cd95b62777bbd3ba8dfd157deee437d8b3994
- MD5 88510b560f7f9a8089eafc7016d4ac43
- SHA1 9a072aaecd40d9b7316712a4d522c9404838f86b
- SHA512 efb5c993c23a28bd4a90deacbc5b8d5cde20cc6411b53e27296057bbafa146596c587c9cb3f41625ce2ad657cc921907612e79ec75c716a2c1623c8989f16576
- TLSH T1A3517434A4A8CD77A6BBC851B6067B03CFB9206EE5506A94E4EE0B1C12EB49C0342817
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Steam\htmlcache\f21947bd-06da-4520-b9d0-2ef68037d4a3.tmp
- Size 2KB
- SHA256 a5325ec95af3650d9b23183c1d03ff84148e44bdc03e88ffdaeb62483e1a1e42
- MD5 abfb9cfdbbc2842bacf076f2de6c28c1
- SHA1 8460dd96862ba31736e44e3749aa02d401b1cfff
- SHA512 11ecc6fef6c11335fb6a69ac75f632d0fb7d7b4e9c753e468cfda085d76ae45d00de983c7ea0933014d1501c079ca052d1b35fab251a5ce72ed1f012a134c214
- TLSH T176516334A4A8CD77A6BBCC51F6067B47CEA9206AE5506A94E4EE0B1D12EB49C0342D17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\aom.dll
- Size 11.5MB
- SHA256 fc34ed00495658ba6443d31cd23c8ee61f5bf7cda312ca5505f1dff879e94a5b
- MD5 7ccb797b4695021f5e2d685e7a054986
- SHA1 d26b13079fe69434a67ef528e190e4217734a41f
- SHA512 5ceb077f295879f7301ab16e80e8f1858e984973c0bea5e88df1134b56c1c1bb4b0c2df5f9885207cacab4b2fae47c398fcb777a37540913a337ccf1dbb90af2
- SSDEEP 196608:PZ8zBy72Bz94DgbWKu8tPDJou3tEPuStrVV2H8uJ3XKw8ZiaqBZXHcwvoyJoLATS:Yy72BigbWKuoJouOPu672VHr8ZiaqBZk
- TLSH T1A6C6AE93E3827199FC4688B1826FA9F215383235631581EBF7E53B3592306D6B638F53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\audio.dll
- Size 196KB
- SHA256 3a9cb2108001d5bde5bdeb49c36436ce484e3ccec370330fd06e34933ec877b7
- MD5 3760a42bf4c406823267e9014231cb1f
- SHA1 6f1a8677fb39249094e3040fc4746fb8c5460f34
- SHA512 c7bb9af1585dba1a6def26066fd6e7a8ba1350503f7c6f3c20e083018377d3768e6e70fa43ed74f65172524567db445523f0c2b9d07100ab037811128e875c44
- SSDEEP 3072:itZiZCruQn+0P9QYM6BTNzOB4WVYF6kXL5nyuiL3EaFq2kxJ3Ag0FuNzh2C2gMka:iniZMuSdQYMaFBKYFFlAOJK
- TLSH T160149D12B191C433D5BF14380CB8DB62AB7F79608FE1C9E76BD48E6A5E702D18E35426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\audio64.dll
- Size 257KB
- SHA256 7766b0afb01b1fc6a223d795d08be2f6f965f41d9a18e25829975f3eff812a34
- MD5 33037d5e997eb80ac0ca990e9d1f8464
- SHA1 5bdf5774c069cf248c8eb25136f59804dbae182f
- SHA512 75c0fff5ffbd6ac7fc2434e4e99ee8b0f5a6ba73d220084b58b423ae8626ea1f6ccd3794a8c4ece2cb3029c701af775b24e8e24b8b6824751f007afd095b2525
- SSDEEP 3072:T/T/A5VhW/TFcaL6zsvzkkVTgtSmXBnUdxII3xsMoXp3cvK5XKG9fGzCqOeQPA5w:f6ALkkVMQAUdH3KhXWvK9nQwx/
- TLSH T13E44496477911CA9EDA3803888438A42E2F2B86107A0D7EF53A0825FDF6F7D5693F751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\chrome_elf.dll
- Size 1.3MB
- SHA256 b253997ec12d825ff5a560072fc71a4bc381887ff65410f55f7db5ec46d6be43
- MD5 cabe102a67c8c3f38264d3a2ce64a4bb
- SHA1 f4aac2f0204dfc6c07d0a0ef37ac5ab9f436e93e
- SHA512 326afdbe6212cd33643f7973ffc3a87f6f47a6b39f1a22fff746ee9f2de883d0f15edc89b8dbec420604ad26df913aff32aabd5b8c066ced709c49de95404bf2
- SSDEEP 24576:4y8ARpeMdd26ugRZiZaIzJbHJKVwpRPzJh:j8qpq6ugRZ2aMUVwp7h
- TLSH T139559D17B2D981A8D06ED17487578236EA72BC520B30B6EF0390B6192E77FE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\d3dcompiler_47.dll
- Size 4.7MB
- SHA256 33e3aa69151c9094153924c1e9b4b44faeb221d185947f92e4910cc1c4e6f801
- MD5 a9b5329f4912637ff09491024b3ed133
- SHA1 2e7fbacce20b4d66f8306cbe2675c3231970025c
- SHA512 f324254da08d1a9949b06f9f24293fec1bf0da93f89c1f31acc56be1f9446eed53b005dac041615801fab9c9eaa64ee54974e89d097abb78dcc06997bde51282
- SSDEEP 49152:NCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN2:8G2QCwmHjnog/pzHAo/AyT
- TLSH T19D367C5673E640B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\dbgcore.dll
- Size 211KB
- SHA256 9a41c428c65be4b399e5528b8bb3d5604ac70d91735c1de16aed7e1b653318bb
- MD5 082db4b043b076fb9b990ea1920669dd
- SHA1 d295d6ee01eafabc870597aa8502d52283315342
- SHA512 452889dd6b9a1c73255b0ea88f96fc1f1847c18bc18b6c7613748aa1fb3b3bf50d21c8b9c36958f269926dbeaa170eaca56a483c45f7d073a08f5aa24011a62c
- SSDEEP 3072:TfIjKqQsgkw6Bcyp0Tws0VlK+zruB+Y3JxCVrKKASB0ddOkfgOxTs5mG5Kb29eq:TfS9tgt6ayp0Uu+uB+OJxeASB0ddO42d
- TLSH T130245C29A3B95494CE67C138C2978617EBB3B421231167EF01A0C2B9DF1BBE4793CB55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\dxcompiler.dll
- Size 21.0MB
- SHA256 9756b567e1274fd26096e54984db9aeae0162934c897388a6aab06f5cbad62cc
- MD5 975b5808924379dec693bbc5ec8ffc62
- SHA1 e01ba0ef53d84eb44df14f3916114f6191ae5892
- SHA512 87c3758950525096d8abc8698211f772e382fa2fdfb7c441d3f804f1fcd2daef1831fa3c23fb602a2171a7d291ec5036154890272b836e5be108f2f41f9d26ee
- SSDEEP 393216:tSfHiwqmrjOj+0awbddiTj9V/JVXENdNf9Nug9YixQwce75lqFT/1/unLzufNCNu:q7X+HcuvYx
- TLSH T191272912768658ADF05EC8B083478A63CE6434CB1F3ABDEF449451292F7BAF41B3D625
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
- Size 117B
- SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
- MD5 b46cdf246adb25dd32b81a328e154f53
- SHA1 181a1ead2bf44bfafa67339153c4e446863b450f
- SHA512 9230a9ca314bc2ab9dfffbf2ff069e7fb7ab9f57f130cb20e44776b7a82060fb0c2f93359b91d7be95f50ddfedc203a58a623cafbb07170c5822dd06f8a549d3
- TLSH T1B0B09243E89CC4AE01680A5DC0A2C4C1214A0677885105E23A9A9618E95E111456D94E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async7784.tmp
- Size 184B
- SHA256 661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7
- MD5 3cdebc58a05cdd75f14e64fb0d971370
- SHA1 edf2d4a8a5fc017e29bf9fb218db7dd8b2be84fe
- SHA512 289c40fae5ec1d3dd8b5b00dd93cf9cada2cb5c12bcfefea8c862ddf0a16dced15d6814dad771af9103b3a5d3016d301ee40058edde3fdea30d9767146d11cd6
- TLSH T187C01283A48FC67D44541E0D826A80F5194D02B6CD911AD22685D10C948D910042FE0A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async7784.tmp
- Size 1KB
- SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
- MD5 6e6a2b18264504cc084caa3ad0bfc6ae
- SHA1 b177d719bd3c1bc547d5c97937a584b8b7d57196
- SHA512 74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679
- TLSH T1FA119E5C6BB7490FCF1E0877C28FB955582FB08D79C354D8BFA448997E10E22106ED15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async7784.tmp
- Size 1KB
- SHA256 6753f6c8d1eb43e9737eabe8ab9591897f047b8fe12894286b9189bbec625aaf
- MD5 d3d923f7d7b5995a852b508af2b0246f
- SHA1 9c96c72e74fdc14e07db1087e999033cc089725a
- SHA512 2f3192d4fd3c66f737a9eb692b31992b87899432b8f761f204df9fbe716f983fc81f798e4cbb273b0c8092d3e692130e1e397fc896a076fb99681ef06d53713f
- TLSH T1BA21C02A5B6B495ECF1E086BC24FB9D4543FB15C7AC314D8BE9848CE7910E11A039A15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf.async7784.tmp
- Size 1KB
- SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
- MD5 a2ec2e91c3ef8c42e22c4887d032b333
- SHA1 e2c738a2e9400535b74e2263c7e7d1ecefe575f2
- SHA512 b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3
- TLSH T1A121002E2BBB491FCE0E0C7BC18FB9A0543FB15C39C314C4BEA4489E7D20E11506DA14
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\crashhandler.dll
- Size 381KB
- SHA256 e90218de2e066babb8220e61c787eb75a7c037ab65e7d44d0241264e2952879a
- MD5 e663392bd0be254cdbad56ebf5997bee
- SHA1 d666a9923d17751ee3dbca5c2b3e2b35e19101d2
- SHA512 4649253d0e2d48f3ba5041e3c4c6405cebb1998277f7945f32da8a5b1d3aca86203a036999411ce0eaa4db819853a905269ddc5be9904ec66479c3357ba44e98
- SSDEEP 6144:/Q8iO0NcrDFvGevkgH+wutt5kcsmabq/s4ugZKfqy78AOfWZSyDogmu:Ij3NcrRvMtwuttXsmQAyANWZbDo5u
- TLSH T12B849E11F4D2C072D9BE14307878AF6A1A7DB9600F74A5EBE3C8197B5E306C29735B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dumps\settings.dat
- Size 56B
- SHA256 0300ecf6248cda335994ef6ce53923e85c47ffd0ef74e89e30e359c56170202b
- MD5 47caf756cd7f88259012f211a3128c48
- SHA1 497037054788c072e9fd0b085d9a04dee0911942
- SHA512 179e2a22c9bd9aea23c9145c49ec220a45f892d1ff345a834e9826e1a6b4dfece02599b3a5c0dd738a222bc9665d276cb4d319bfd17219e98c1ad38385579714
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
- Size 13KB
- SHA256 dc2c2784bcaf07598218ef81b4c9d6d7ffb4493cd1dc833bb96007b8f79ed7ac
- MD5 4fa184186780a53abe5c5b9e1e26422a
- SHA1 edd16a4d171920a913d95ef7cabc73c1f8291278
- SHA512 bbc269a708b5231b5e47627a5394461236daf7e76a65f50d2688813a8ff549443fce0993f4c78fd48c12b4350bade2bf4eb4883e754046cbf29224acafc16ee9
- SSDEEP 384:cKS2bCg3PBKjY1CpEmgFHFWgk53WkEpD0CfgAJJ/b1j1UaFzPE:tDxmgfWgk53JEpD0CfgAJJ/b1jqYzs
- TLSH T15852259B2A5DC43EAA9400D389BE0DDA9C0430135B051ECDB764D99DB5A2D31ACFFD2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\bins_codecs_win32.zip.vz.d9d8ef26467ee44cc445b1d78216580fdc6b2c84_6136735
- Size 5.9MB
- SHA256 f5f02bbebf3a7f1bae7a5f9e39c522c17bebd2a392dcc88f27809705b46a3886
- MD5 31250d0ddfb462737862fbc71d723204
- SHA1 d9d8ef26467ee44cc445b1d78216580fdc6b2c84
- SHA512 1f938de5c10cf08cfabb5f437519e6f3505d9dd9861a70b7b294bb70b95cef0df16e5bcb451d67cbae2d8449393e85bc336bbdd32a6fe7f538acb480ac017abd
- SSDEEP 98304:Op2o/2by9Ge8mPcEJhSauKXfnW99BMuAXBn+fAK914/G0tOne5XQsvGgzcAVp8m1:Op2oRgpEJhbRvnWPBMjvKaULgYgbU4+y
- TLSH T16D5633496D1FE201DD788045E7A32AD636DED73AE30E44BCC19E9094C4F99CCB9698B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\bins_hardware_all.zip.vz.306ae066fe4956d11ac55b1ef54f2decf827df44_268398
- Size 262KB
- SHA256 de6c115ad818836abd4f23ae3a205835a8897591f45e01b25056a86662eb70d7
- MD5 b216e1333db8d5cf5c02e8da947f61fc
- SHA1 306ae066fe4956d11ac55b1ef54f2decf827df44
- SHA512 2d52b34713dfee38d0769b4521697ec0d086f450c236bff8feaa97da8bbafc05a98eb524dde945dbbe537bdf9c021de0f653a521b5406ed1fb1f975b16a3f80b
- SSDEEP 6144:9Xw2cHaMd+KTJ03c71TTQtODJQEzCWNxoMx8MDkRjpDuGMVXoo3M0AU:3MdtTpRTTweJVxmKk3CG+Xo0bAU
- TLSH T1074423CC77EBEBD1243AD2DAA416D8CBC72379AE2898007A303464315FD791619F6E43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\bins_hardware_win32.zip.5761afacd4ecada95f3b6c780bd881b46edb2f34
- Size 6.8MB
- SHA256 3e2687ac8fa49eaef75244316a4739e4262f2533f5e54fe0e2682807540e175b
- MD5 e6d1a2e5faa6683c257776a98d91a1ea
- SHA1 5761afacd4ecada95f3b6c780bd881b46edb2f34
- SHA512 2ccbd9b36fbcd60e16603231731a18e862a904a2a89af3d44b00a1dea0bcad71ab69e16ddcc24ee66a0cf719672509e1d347d5b886e30a2135b18a10085a9de1
- SSDEEP 196608:gcU2KUGg0SKutm1dGO6bXx9DlaX4alyCfE7KzCHnJc7fZh:3PZ0SKutgabQXCCsfcT3
- TLSH T17166339C0C316825FD68D0770ADDBA0F690CC8F875220A2D9FED73191ADBADD5EA7016
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\bins_misc_win32.zip.vz.825801daade33a37975c094c79ce2958eb41fd6a_11881906
- Size 11.3MB
- SHA256 a0a041e0fd20f333eda1f115facc107ed323d0a64268380d52c70959e8adc284
- MD5 fd88eb90b28adcd3126bb2db857fae45
- SHA1 825801daade33a37975c094c79ce2958eb41fd6a
- SHA512 b5d65ee98f525ce4b4f40e4875648dd591a7762ac9f1707d70acc9bf3526ecf225c2191a78f3a649ccab1d00a05a138ca06663d01b65553f3efdb3f77365f464
- SSDEEP 196608:e9lD/Bfwx7ngUaespk8zRY7SIg/agudVY1JagzztsSz1CQnmshF8htYIYK3Xfa:kZZfwx10WGhX7uDJEsi1Cc+Yifa
- TLSH T141C633379018187268792B76786FE9DD8744871E6F06D080D5EFEC943881BE8A73AF35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\bins_webhelpers_win32_win7-64.zip.vz.36920971a7f411394bb3e017c6df811f0fd4dabd_3585052
- Size 3.4MB
- SHA256 80445766d122f27d815730a8d7b0f465aa52efb32bb19872c269c756f7e142b1
- MD5 60395eb6c91b8fc8581c1023817915f4
- SHA1 36920971a7f411394bb3e017c6df811f0fd4dabd
- SHA512 01b7b209a59cac589e05533bcadce0db93fee7a316e1022e31dabf677fdcec276613e13c67e1f5c76869c84d100e46dd37e05072c4878b46e1fed87a37204770
- SSDEEP 98304:Z+YwIKbkV1YSGF3ShnYxCeFw49755IS+wGBQDF:4YlIG1ta3SYIan9n7+6F
- TLSH T16BF533B70395942027CDEFF7382E66205C92708DE61A5CCEDD32C959E7C40EB2AA659C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\bins_win32.zip.vz.9e2e9a682812cea461b510de33ccbe43ebe31067_31353717
- Size 29.9MB
- SHA256 699ff0c6cfbb9ea7a40db050903668f3076163016fd84bcaac7f4534367a9530
- MD5 cb5267ba78b9bad6732cf9c4533ca4ce
- SHA1 9e2e9a682812cea461b510de33ccbe43ebe31067
- SHA512 a9a0f8e003328f54729d73a7b9867f90f2056a8bfeab4b7171af53cbe1b0160eb7b461a308ade657ebc6101311bcee35b8bbaf2359172cc5f6b1e31b1f6e0c8c
- SSDEEP 786432:mqMN3XRm+1JiGf7GaeZHOluRSrSlXYp49m52WEWoFct:mXZ7ZCQluRBXYeuJt
- TLSH T15F67335BDD3768CCB53A87F3F0F12426EA199A328A11D2CCACF5DC1A7C9948634156CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\bins_win64_win32.zip.vz.f1e8aff3b2a8672382ad817491e7dd633eefcb4d_5004865
- Size 4.8MB
- SHA256 e14be78a74221fe6664c520361207fcca33ab1df2a95ed11322e6979ca598e08
- MD5 c89323bd707d8e8f3507dfc7e19ba123
- SHA1 f1e8aff3b2a8672382ad817491e7dd633eefcb4d
- SHA512 613df593ef8d5948e5c6bce4f2695f81935de54935413bebf03550ff29806da8107ae2dd61d6b0ad8e2eced7b7bd92a9417ff17c6e08e82a15246e8c0aa3d371
- SSDEEP 98304:gZB5L1fFD6XMYMcYHisn89w4hY4lbdveiVe9pHYThUomfJxgJytzCz7du9LXbmlX:o5n62cYCxy4hY4DvtypHAdmgUtz47dc2
- TLSH T19F3633CD07746704ABEFDCE1260DB93F324F60175F6BD5248967F8C058AA312E626C6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\public_all.zip.vz.48a9a991c3ce62641e0705c48fd483b4587d09cc_23753492
- Size 22.7MB
- SHA256 9dde4b0ae6263443b762479b9ce566ccff3c89a975e26fad3a550fe7d8414706
- MD5 d1913ff500e6f7852df4fb4dc87f0a06
- SHA1 48a9a991c3ce62641e0705c48fd483b4587d09cc
- SHA512 d62bf3620d52ba73f9b1bf4cfcf62aee855392e412a5f6e8aa9672776286e812175fcf3f6d58327d700d4956f441d714df72cdff88a94201d6e2fb990cefb103
- SSDEEP 393216:U9JoByzkJXzztsmeBUQXE5fB65GA2H00Zdm9767LUAtOA4HuktOigWO5Nb:K1oJjzOBA5A5vZem07LUAQOkVgNb
- TLSH T1F03733348396451AF960CE9BFCF6B6DA445A30F1FBAA10DF4CA0418DC253CA75A63C9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\resources_all.zip.vz.3c8b3203e5c69d75ea0684c2409b86fe4d0d6f83_2856188
- Size 2.7MB
- SHA256 2dcce4e5888c857fbb7d931f2d03c134abba0f024edde20244477012c5994ddd
- MD5 fe163eba99df9a4ddcce37613ccb648f
- SHA1 3c8b3203e5c69d75ea0684c2409b86fe4d0d6f83
- SHA512 0e7b7495aa83921ff1bb939d526a2f46f1954229e0de9c02afcd33f5566420b06a3c68299f334141e6fa96ded3ba93b24ffda0a9b36e03e700dae84e4ea3fde7
- SSDEEP 49152:MHQT0HYJ+oJTf4+rc+AtJPRpmLRYNd7cmhb4hqTco6WOf/FBRbvIR1tsWhVYNV6:kQT6Y0oJMKchZpm9Ocm9444WkHbAssVb
- TLSH T162D5334CB3B6142F9C8633B3C0BD0981224F66B91A09BCD7E56687F6F421A85ED451FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
- Size 55KB
- SHA256 e9cfba9af633e9d216a0cde97b1177d4cbca2a1aca7e83aaf38655dbd9be4b7d
- MD5 a207adc9a20f0a199494a0be559f423f
- SHA1 3de815c3117712cb9eeb7ea4c8b275faf481dcfd
- SHA512 7ae69b616f5a581fa483f4cb02f41d4010896866f28ea3e8b024f1fc917718f0a26f59baee13e27b617ce35e444f401278a6f8ebb8611e9aa9dc100d984716c9
- SSDEEP 768:gmqP5beFYAtNJo8WyJTaoeEUQ2zZvNZyzbHkzTxRR2Np1/lAOJCtwilPl6:85beFYAlWyEPEn2zxXyzTI2NpxKmbQd6
- TLSH T12743029E17B619C98C4288FF1F753E51D36A771903BF1C427BD91A886E21C6B24071FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
- Size 2.1MB
- SHA256 5e9ca0aac16b4d5caa2ac77ab2ce239e8dbcabe5ba6f0565112239ebb127ab2b
- MD5 aa34041580654fb4136750fcbb4be63a
- SHA1 e86a975545f3ab21a77373870cb311ef93934b8c
- SHA512 fbca612cb005f70057840af54a99f9f1327ad27c53bf7c0ff49a397b11493d6f3ec25f43a11c4dd5660bc029f6cdf5984eb8910fd9385351798c7cc65fe46fe0
- SSDEEP 49152:Et8uyihO6YdhgzrlSxM5zgheYC7nwe57zEeay7DBGcEK6XmuH4X:EttyihO6BzrlSxM5gwbxFdZAjG
- TLSH T1B9A5330D81C23E131BA6F4A644398CCFE0591D39666F20A854B3B92D3D1BA5EFD539CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin
- Size 3KB
- SHA256 215514e3e16baf46aabe5057c9ebf9e3c5c6a368b9361ce048f7834097ebd8a9
- MD5 b68f977b57cd80a6e944119b8d1b693b
- SHA1 ee4f17f303f19a7676c3c0cf6c90762e0a7eaf27
- SHA512 aa03597bf526a3ae18ebb01c9d31adc39e6d73c55e3d64ef14a1219be0268cadd59e6efbd0a00d9d09e5ec7964b569e5f0c8e7a940a1e98c27e1b8a48cd26b8a
- TLSH T11971EEE9851EECBD9FE40E1C0C45B16E5205300B8DB2FFA6DBD64E89AD216C49BCD42C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.installed
- Size 480KB
- SHA256 6f508bddf6140329a7abaf1dd95c559d668a2cbe568e2415c9966edddf08bf7b
- MD5 a6533535b59b7711d9c3837e4107875d
- SHA1 6acd096e4944a2c03372298683001a958ae7143b
- SHA512 072e6bba3948a23c1b94233e03cb075b015dbb7570806d7853a32e305a197136277a2512d893dfa1737a36ae6156771588a38cfd7fc3466f79826292e6050e7b
- SSDEEP 3072:1wDatx1kYuoQnJQybungES3Ce0RbbeJkUZrU3:+DaXuoQnJQybungES3Ce0RbbZUZrU3
- TLSH T1B7A40118AB74777743D76ACAF72BDE2D0D4081E6CB014B8F4309BAE891D6D81BA37854
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.manifest
- Size 8KB
- SHA256 cee78c3245b22e28deb3261a61d8041cbff110c8b3ac210ad74ffdb6aa5c1bc0
- MD5 0856f688dd45e8ddcc5e29c944c13caa
- SHA1 87fa7f5f12492f1bfe0fdf871a4085815d526b45
- SHA512 01be71ffbd72aa727f071b9d903d9f8ac92ed1e037d4d5a49fce73d98a594091d6591efc5ff7cc112a10842c02da11d57075a0c5c3be1e7511cb09a342d5daea
- SSDEEP 192:ZDPMpLQ1x8kH4z4tGUUBQZkJMEnIUFPoH4:ipLQH8g40BlwMEnIUFPB
- TLSH T16602A3A33A45B06426958B4B84305ED90FE8B64752BF2DEBCE2ECF1C98F2D4579E7004
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\steam_win32_steamrow.zip.vz.bbc936b85d699fd5a58f846502da312446c5c690_1884139
- Size 1.8MB
- SHA256 980dc90bb3a49e895342cd07d1c2179c1b2e2047a39b559c4d36700c545c89b4
- MD5 6637b93f712fa21848dc3823419e781a
- SHA1 bbc936b85d699fd5a58f846502da312446c5c690
- SHA512 9080eab01c7fee5accec080733bf0bd92d6be730be9ccfdfb5b2faf1392154e55000669004458a64df254a81f3478fb27087b018b6ad00a363012e439b959ea8
- SSDEEP 24576:pANqUpAIod/h/Aum/eEXfMNsBwPXfKAAo1t2LzmoHzCdNiDOz+rMXbPMWC:pANlgxxe7KSAA1Lq/d8DOzHXbMWC
- TLSH T1C99533664CAA3FBE55B941C42EF497703E30AA7761B390E3639856CD73AB42F7502183
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_all.zip.vz.3454fedc48870f10019f5c5707aa34b9445f8fce_25053126
- Size 23.9MB
- SHA256 277710f1d0be759a9425f218900e65f27012713ad5f4a93c48d1ed5baed5aef8
- MD5 42659851848fa059dc964afdc8acfe2b
- SHA1 3454fedc48870f10019f5c5707aa34b9445f8fce
- SHA512 9c8528ad1d866cc7008634d8cc99a0eed98eb82bf283b0598133c202820fbf1426fb1f45c86621dc312d85cb4b040108520d6a9fe63826288f25103478138838
- SSDEEP 393216:Y9Dj463fyvTQz3UN9ov5nF3xVKtIfJPEHNPbxSyCbY8tMMp8SuQ1MS+yuPw40mVV:Yh84yvTYo9ovFZrJP2I+8/mU1X6nVuu1
- TLSH T1F14733D3F5E53B86EA3803805484909F42097E7D67BFC4B09126C2CF9ECAA87599DDB0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_movies_all.zip.f556f4b9c7e087e07c0fef2da2b1d9f27f734cff
- Size 8.8MB
- SHA256 aa89de11cb2e8767b044d9f0aa0e37686fce03187d1c8e3eb0a70793bddb3996
- MD5 b1d802222486d515e13d785e241afb42
- SHA1 f556f4b9c7e087e07c0fef2da2b1d9f27f734cff
- SHA512 842231521adda5994bc7563112356663fb4496dc0070fef678d17fcf9197a8e805ce2060a98afc85ab6ecf44f3b99d1caa582f630b20a4c5ccd339ac7d440f01
- SSDEEP 196608:yi124U+FlLkuGBYQqh2N12V4UqL2XMOQnFAR0bRYqrNQagl:yiMkFyuGBAh2fwGffFAEDrqaa
- TLSH T16396337ADE2DA3D8B09A7AB5DD3880AB44F558BB1E9CCCE433AE535401DB4E49FC4841
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_sounds_all.zip.vz.5ba6acd8f4dfe4b93437895b20344fab5bb3ff96_3714779
- Size 3.5MB
- SHA256 ac62e3d0e6213bcbdcfe973c624eda0486977dccdc4098c10b60b62e894ea93b
- MD5 fb239db3dae45520d4d21fadb2ec972f
- SHA1 5ba6acd8f4dfe4b93437895b20344fab5bb3ff96
- SHA512 ecd9c334d01f8898289eab87c1de549b68fa893376e6ed1491e6f6a7ec73add02a4011edd458a5194a11ea8592b2418e4c24baae54f73b1e3074af0faf6b4ac1
- SSDEEP 98304:FUH/lhGM/mgHEVRCubbBva5/VuqIjE7diB97MI7:sGQBuvvBvS9cjmiB+m
- TLSH T11206331A301CE833DA8A0A28CF42C3E49D371246A459AD06A6258F771F5C74EBEFCD57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\strings_all.zip.vz.c8734726f00a425eca473282cbd933f4c0f13a00_2015332
- Size 1.9MB
- SHA256 446b826c2a50991f45342511bf3e8c305d09aff576bf90744143918295148dce
- MD5 05f768402a5d389128064b8e38152ff1
- SHA1 c8734726f00a425eca473282cbd933f4c0f13a00
- SHA512 fca91f6637eef2f6c821e82c7f4547bb81105e7a37a74d63f4761d37cb73e1d345d3af883f40b311c54262c4145db29c3510a22831c941a5ed8ac8ecba52db13
- SSDEEP 24576:A9VtBs/haBezUVrHd/IPiJrbiXPW/0zotF8tYXz5kOvweqznXZfBWI45eM8u93EN:UVfMaBNDwPqaQXziteqTJ5WIFMxiLfmE
- TLSH T16995333AD4C7E293E57ABDDD02FA3D884619C8CD24DA85B5539FFF9D148183D6C21828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\strings_en_all.zip.8eef428d222948911a09e2ceb6e5e8a7225b3447
- Size 111KB
- SHA256 82ccf2caa9b4f8ac58368dd273ef7a98932eec481f65e9f14080938eaa1d2d50
- MD5 0cf939d1247be464b5a97610576fe056
- SHA1 8eef428d222948911a09e2ceb6e5e8a7225b3447
- SHA512 8c00788c2d2bf27c4d0cce34e26ff172b54bb3543127173cd9d611d2992fd3f7ea6dc0470749fae42f5cde4192f47e65cc634ef67d44a9c842cfe591bee9b106
- SSDEEP 3072:4MHrZPWgGgAJBo5VLmnQMkk78TGlLZ7D/3a7nDlRNWy:4MNWftk3LmnQMk68alLZKfl3Wy
- TLSH T137B31211C9046B82CDDD67B0E38269E0CBEE87CE754BD1AE50B0B5320A066E5CBB17CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671
- Size 5.3MB
- SHA256 e1fee3beffa9d08a415a35ddc7d3141af6c44269c67e67aa0a3eea6e56889bd7
- MD5 ce671311034f93e30eef0e0998d15285
- SHA1 193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7
- SHA512 25a0719450fbfbf09b1bd4e525e696e8f72c673cc0909bd196cc3fed823e7b0822f062dbd2855c6c2ac6e465232586da64abccf84e9976e02cea3b016a45a1c3
- SSDEEP 98304:GkhPe4pzPRRacg9mzuxVXB9EYioUL4rvAi67jWWpYrsv0jtX34IAf:GOCUuxVReY/y4MFW4YwcjWII
- TLSH T1D94633721AD3CB78126C57E5A49FBC8EE78D5A593EE6700321094C43A4B234E6ECDE4D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\btnOvrOffTop.tga_
- Size 444B
- SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
- MD5 89cb2bc5ccdab01b0653d4dbb3d6a062
- SHA1 afb947fffd5f5f3723e0c8c3b52cb8cbff406ee9
- SHA512 e5bef83bfad930e2b68720e00d450aa879619dcabcf8d96f9f8c47636a95a9662bc91b04cfa9160081d8af79a1257b75647d89677123f28b8c609808d5b86653
- TLSH T1CFF004040C400137C744757DDCD7C5CD77D4F4301540014C57D0307504D5041D1F44D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
- Size 15KB
- SHA256 d3af480fe975487ea4754c88dd56df0d4cfe68633eb9abb2458f42ae3df34479
- MD5 197451ccba3445f0649ea70af2478b67
- SHA1 d5d8870de59dd92b2689bba27aee85f85211fe7b
- SHA512 348b98e050c6f9525e3a6aa291e4da9b30542e62d229e002b0e325e6d967903d18d853eb9eaa460eb152f3add3583e7fdf3b69d48f024a830ad929878b12f651
- SSDEEP 24:iGgAjdynb5D/8RLrOMYMRZ3+4qTenMR+Xa:iGgAjMb5D/8R3OMYMRZ3+4qSnMIXa
- TLSH T1076268643F941FD0F43609BC9389B52856EBECEBC59CC62D2C153C6234B9116E1EE484
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
- Size 92KB
- SHA256 f200aca23ac6739a6d521298094972383f835d8fcac24b7bdef820181ae8c37a
- MD5 57200ac4f495266f043f6d2c602b35a8
- SHA1 da7b499312cfbfb32ef8966945cd84a32b971387
- SHA512 5c5b6b729db7874605901519ab7a0e5701550b5aa909b0f9124ce4d5ed8d1370993806f7b70e71e6c93e79e84e7ba40d007c6942951ac49cfef3a9dd75ed50a9
- SSDEEP 1536:Wb4gI9INyg8XLjHpSDxuzraWReEmAmrSUgIx9lPCVTZKq6WLCLO5B8yJDt/bdRNg:1SDAzAEmAmrqIx9lCVTZKq6yBzZ0
- TLSH T169930040874EF02353F9E75C65058DEB29B24CCF594706A3F230BC0ACAF16E76A196B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news.tga_
- Size 20KB
- SHA256 42c410136a35b64c7e0a410b1d2fd2e2712782039cd7237615219ea57d7c40fa
- MD5 39676f09eb4735e6414aa3a083dc9760
- SHA1 1058f3157b0131e68c2bd6dc38bb62f2d6e877c2
- SHA512 14120d30f4d26c939fb5ea1622cf981c2dd1769850773b53a8f99740ff53cdaa7dc8279a0fdc6c93878fcb235476e24b27f4add58f4b1b3f147690be3769c6d2
- SSDEEP 24:2KLEacayw/QAsGk59L6uY8ntRD66611fgii2N0+5q:2KLEacayAQL4r5u
- TLSH T1FE92A570C975BBCE6C6818E76CB605D50864350F3B730D776A8718BFC89AA486CA3F01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\tabStdTop.tga_
- Size 48B
- SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
- MD5 bd64c051ae2410eef96839a3cb7297f7
- SHA1 95a5b0455d69127fe50e396153c795d9914ce0d4
- SHA512 ea2f76c8cf5dc2fd15017ad9b942d020c3ad5ce1cedc2a1604137ea02f8411cfff4166ffe93c101756b404344488b304cf2b4a71c25b2929654dda9a88a88793
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_updating.ico_
- Size 47KB
- SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
- MD5 da277b7a17374bde018ffab02015238b
- SHA1 ceaafa1a1ed7d2101ad3c2884159364aacbf9dcd
- SHA512 5a6e542ae9938f560d40348ceac663feaf889a6c990efdcfbea919531dbc34771fe2f0f366ab7adc15e998e5ed392d80dad78a8392f11b9c8fdf2c67f0431a53
- SSDEEP 768:CHjkEJqa7vWVw70BCDiSfUpWy46032U/C0Tz+3TaZeYJqF3D7RTB6F0SBS6:CDlJdvIw72ILUsyi9/CQ+34eY4zBCph
- TLSH T19F237CBEA78A557DC9A0473840CAEA7C433A6EC5E0A7C2C751D07F5B5C35643BE0E1A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_updating_posix.tga_
- Size 64KB
- SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
- MD5 be3a210738638c4f33aa7e01cb475e26
- SHA1 02276a10cd77cfd57e4c796c45d69d526f8420bd
- SHA512 6a11640800df51a8d88ef4224acd39cbb051dcdd6239bee82575ca11772a6a52e40c6614af3ea61320d29b4f75fc9611f6182ad2a55d7284863fd38d89631feb
- SSDEEP 1536:fQF+zt5w33333333333333333W3333333333333333333DkqbbbbbbCm/b77vBQT:d5bbbbbbCm/b77MquuamizaWraS2Dz7o
- TLSH T165535F64EB112ABC9EF1BF05A6EA967813165D42113BCCFA168D7F4231F3A319DC6D20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_banned_thai.txt.gz_
- Size 23B
- SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
- MD5 836dd6b25a8902af48cd52738b675e4b
- SHA1 449347c06a872bedf311046bca8d316bfba3830b
- SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
- Size 4KB
- SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
- MD5 27993eb75894ca4894db266ad9b5e61b
- SHA1 4def653ee04b0514822b690052598435ec25e686
- SHA512 eaebeee5b1a7dfb9bdf661623554793d7ef7e15d9f9cf01f94da1eb0b84b88c8f24176463d15c407ebf670c5b7fd4052daea33ba43e75c1de2979487c4987bab
- SSDEEP 96:hSlb0IG997a8ICgARZ2pWHxUBnXPz5dc6LzIIivI/BxkHLs06706XDQH:8lHmbICgAr2oHaJc6LkIiQ/DOLsV7VTc
- TLSH T153A1016E072A71F145B1A26C760E06D3998871BFA3220E5816CEC31C2F5712B73F7364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\51a7e1b3c17a6531.bin
- Size 12KB
- SHA256 1849dba280c47a8eec1bc1f05db26ad24bb8d1e7533dda547120e30612bae409
- MD5 aecfffe9443026825fbaac1611371a75
- SHA1 9f056b1ae4a1f2129a655e19e02e366ce6ce9a6c
- SHA512 1855a2df59c6e38b76e0492884d45f4a7fb1c6e0caa0e3c619d5b52fc87444c6a448e5d27ee238e9e6784f95621d98597e7302b1c1bf632f1c08ef81bb83a43f
- SSDEEP 384:Cwv7+Cyq+wlsT7m2zHXSpYfd3zDYW4NPGVh8xM:C+a+sTbHHdjD94NPsh8xM
- TLSH T12042BF6E187132C4689F3C1F81165DECD8584F0C6500D24ADEDFDCEF9DA5671AA127E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 cb6f53eef1c4a0fee857a8153c2934de0e2b2d5030dcbd804c92b9ee1e0fcc90
- MD5 0250b4f846b704dafe29b7195b37a6c2
- SHA1 cb0d30449d26804bedbf310ab9d879a55ed64478
- SHA512 41c1c2f8b24d7984246032fc887d40b7495428cdf2b371fb741f014aa12d04b42af7f4e781006ea25ad155b79949dcf2deb1500ee885903f883e7d52cdb39e4a
- SSDEEP 12288:qJ7B34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:yGSnnrFb4PM4MYgLxEVyGLC
- TLSH T1DB5523722BDC14DADE7915B0C1A99698B20A7C31FF61B18BBB4074463B3B688DCB1717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 8903fdb4df00c38b76617ee4e4a15484e79769d9ef930168192d9cd3c3eb91ac
- MD5 f8644837467da463eee1c0d60c16da7e
- SHA1 30488b636510809ef4c54727193a242527de8708
- SHA512 d6fb90d63fe1e2d8c9fc567405bea773d4cafbf1b352faab1a4ae4b1734c2f262b7d64aab9939dcd2873ec7469ef0a114db15006838737b0e7e95a2ef6c27645
- SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bY8SnnrFb4PM4MYgLxEVyGLS:Rgb4mBIBhGF+j4MYPVyGLS
- TLSH T1D265AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 8fa551baa420465a335dc4b6263c8c6f0e6e4fc7cdd1d88d567ef47df734bbe0
- MD5 dd0fdda03c429713a354befcd1da7193
- SHA1 e2764ce77b9e5bceea57235bc5c7dfbe762c93cf
- SHA512 aeaceb93acc48178d1d0cb4706261329f69ac218d46e9db341ceb9e8a664c309fb2a4d69787ecd8e0d2dfd6e1defdc9c62159004188880b32e79f64155eeb202
- SSDEEP 24576:7G88u8FpJqH1Azria7/m1SnnrFb4PM4MYgLxEVyGLx:a7ZFPqVfa7/3j4MYPVyGLx
- TLSH T1F495F16577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 68d3b8f84dfcd8cc682e83eaf6f8358c2221ab8c68b6e11836ebf17adb090c8b
- MD5 d69b419fbfa8def3b589d3de0bbbaf95
- SHA1 94b99369f7ede38a3985b2e9f77f14a14a5e0145
- SHA512 548796c9bd5975d16dd1f3ad6b08be4d21e46cdbd41ae3b8ed0c4dbffb2cce5d0cb2cdd6b85bfe87c3009dc99eeeb3fe40603ba947e27a5fde846e5e4c878126
- SSDEEP 12288:rHvUrBFrEjwaQC34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:rPUr+NQRSnnrFb4PM4MYgLxEVyGLF
- TLSH T15575E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F37AD8BC39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 593bc77a2546a04d19138b2aa2d897f8f1508dc98629fcb3b158d51232a79495
- MD5 c03fddd9bc0edcf5aa3f464238223b23
- SHA1 b6ba45db11bfc82ca894a8d9faa17775f1347529
- SHA512 a8ee3ca7bdd2936ff2d6f9b9e50c8770447de4001566a83fa721ed97ef0de07affdd4520d7e65016b892ec6ee7627142d37bf9e41a3daef5d06e3c45bf4309a5
- SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaj4MYPVyGLp:DG05lO43beV1
- TLSH T1FDD5CF6A62EC11F9D1BBC17CD9C64A0BEBB23815033556CF02A486A91F27FF4997E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 9b696618c60a7ed6ffc2f11c2d6e9164e03763c64b2a8a02d36b42909edf5f55
- MD5 1f0f7f7263eaaa988b568723fdc33814
- SHA1 4aec87dd50f11d10cb626edb8ab0a8ab44d4a46b
- SHA512 cfe98ca55be41dfadf1911a01ae66d3d9f96ea1a3708fcddf926ebf85dad044e1a03ff4b711868394f06eb60ccc0811a105d46baa61fdfa4dddf480dee38fe49
- SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3SnnrFb4PM4MYgLxEVyGLs:Za5POZ3+Jt2pasx2+mSj4MYPVyGLs
- TLSH T15A65AE5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 4fe335d7f867ef3985f98162e3d9e441ca656ad2060bc6004818210d8633e43d
- MD5 99a228af0bf9de5d5fdbe987cbcdcb91
- SHA1 6f163f9ff81458b13ede13925ac2b58e478644e7
- SHA512 2f9ece7342325ca97f7abaeeab3956c41566a8f55a75d30be99c1160cf56d5505cb69ba2436c2581768679d08d7939795a66de77c50f778fee316b45308121a2
- SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkNSnnrFb4PM4MYgLxEVyGLx:QNc/zEOVHFXj4MYPVyGLx
- TLSH T15C858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 75559a0ea664aa109cd52ad8ae64f36bda9c469e93bd5f0a54be1708002b0311
- MD5 fa9a72e9b6d0bc5c40bbb23f0ed6774d
- SHA1 dd5b296ccf7e580155e432e1a07e9ebfaa6889e7
- SHA512 820fd9adda2e6c26c09a181eecd1d2b74c8678976226d3cc39621d9881fed719a8f75f87fff5da52f7100e21643fdede9f0ae6a21ba360c4ea82b9219882d0c5
- SSDEEP 24576:I8kNvNnaFeYhJNtmZBmbSnnrFb4PM4MYgLxEVyGL6:I8MwBtOmkj4MYPVyGL6
- TLSH T17755AE6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.7MB
- SHA256 a92a5a1996f2ed1ddf294e21180b7903244f7ce36bd96f3124697724ba502ebe
- MD5 51f7edc87118032accad0d46f2672a94
- SHA1 93395e909a72f37283e136d401ae5f816b403cd5
- SHA512 5745e1fa7509ac7a6a2bae70a513265708c483ec8712ad72f3e3537370b685ba33be48fbebdd8555ed31b98d7e776fcee5199b5ec97feab5f9090b01f3a97945
- SSDEEP 24576:lD3FHshBIYQgA6SnnrFb4PM4MYgLxEVyGLA:lDVHeBIAA1j4MYPVyGLA
- TLSH T17085E17EEA9C04E4D57AC1BCC6638A06E77138A9033266CB12D491B61F6BED47D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH