6ab919a6b3704a0d63d5ad8f1223ace9c15686a850c3fa27042a9e105bd2652d

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 5.7MB
Sample260715-ye4lpadt6p
SHA256 6ab919a6b3704a0d63d5ad8f1223ace9c15686a850c3fa27042a9e105bd2652d
MD5 bd42df36f73b95fec21dcab7d6a68022
SHA1 f0f2ee6b2b40b4c3d8b1b7d36609ee0c94e580f3
SHA512 de3bd6d8cba9a44c51d04867d9cec6b09b2be9067205b9f9bce92b009a7b1378a6d001302c5dd60e90ad137c887cfc4d9dc2028488145a913e5a6d7caa199634
SSDEEP 98304:3tS5drV2MeZ08RdazFPB4XqCc8br5MDG/rxwD527BWG:0XoDaCcmr52qdwVQBWG
TLSH
T17556BF01BB85C5B1F59201B0597AAB7A583EBE38573089C7A7D11E2A84302D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2092	elevation_service.exe
2564	elevation_service.exe
792	maintenanceservice.exe
4132	OSE.EXE
5632	PerceptionSimulationService.exe
5464	perfhost.exe
4760	ReFsDedupSvc.exe
352	SensorDataService.exe
5752	ssh-agent.exe
3692	AgentService.exe
5180	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cc598a968f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076ed45309214dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c773e0309214dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\OemEsim	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\FlightRoot	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2092	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe
2092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeBackupPrivilege	4760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4760	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3692	AgentService.exe
Token: 33	5180	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5180	SearchIndexer.exe
Token: SeDebugPrivilege	2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	2300	2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	2092	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 4224	5180	SearchIndexer.exe	98
PID 5180 wrote to memory of 6080	5180	SearchIndexer.exe	99
PID 5180 wrote to memory of 4172	5180	SearchIndexer.exe	100
PID 5180 wrote to memory of 1100	5180	SearchIndexer.exe	101
PID 5180 wrote to memory of 2976	5180	SearchIndexer.exe	105
PID 5180 wrote to memory of 5816	5180	SearchIndexer.exe	106
PID 5180 wrote to memory of 4540	5180	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_bd42df36f73b95fec21dcab7d6a68022_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2564

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5632

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5464

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:352

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5752

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2568 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2568 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ee4beb4eb83e40e67c59846adfbdbe3d5283aa6c1faed3565b0fd9165fff5be1
MD5 0b44fedd58151d8a57a4b4654ba38877
SHA1 cab3da014ec4d72799f9bbdae035aaf72db61a28
SHA512 b0c541c6cdceab7eaae11bae4ccfb9d54173931815dd31a9651ced594c06f10f75dc562b36df8417acfa654d8c5969e9b94893455d0bf4e0310b48a07b86a3e3
SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDDmg27RnWGj:H3q6HjB0D527BWG
TLSH
T1D6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6cda5240be076e31378837feb3e434f7961e77ac7b6235c3d8531e5a2abcd56c
MD5 2e08b736811c839df1cd54c722401c14
SHA1 6874b2aade74e5497ea5efc2bf47f7a3c1a60c15
SHA512 65cde068b2f500affcabbae23dd0c3d89bad3f0d8a880278a525ca8a553c327383320d9c0217015c7f9f4991200740549931fdf9996f9c6cedf0a8a5cf6c6f69
SSDEEP 24576:0XYfDtczAssqjnhMgeiCl7G0nehbGZpbD:ztcFDmg27RnWGj
TLSH
T1CB65F129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ee2779198cbccf9d500d3989c5ae154a18c75bcbd0693b09748cdf8e46631d93
MD5 592520acc11a7069b6fa8b29b5c6cf63
SHA1 a4e6a3249549eed6a12dbf6b6662a4320ce84129
SHA512 84c2208f5ddd3c358724e9096cd9a8971e66286c15866dc773e745561b6d7e8f01d18c4c5472709159704cf6c9fbc346c2d9cb51c3588acfff6ae86a40effe6a
SSDEEP 24576:v0Le5ji0hmxirMXsqjnhMgeiCl7G0nehbGZpbD:vPji0AcGDmg27RnWGj
TLSH
T138859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 aca18e1004512fe46b0d3aadf7f1344ef017baf49e0b22516a673916330aa8b7
MD5 34620a141c20a03598dc9c6b2d8f5019
SHA1 3977bc6d0fad00c8c538e4440f8339f5dc1e8bb9
SHA512 a9ebd0f15b2c4ccfc9516d1770385a054f0edfafc7d4feef9ed2fc770b8b0ccc1cc4a8d91bab6319af1ff482e49c923c2bf5ec53724a2b1da5bc294817383e95
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWE6q8wyuBsqjnhMgeiCl7G0nehbGZpbD:Z/ezSC6vUzPvxHjy6Dmg27RnWGj
TLSH
T148755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f5a4a21e8650f2d7a118496f25a41e4a4cc881772e406b3fb3eea04f99974461
MD5 7fde07b3e4e40185ea4fde420a4efb0f
SHA1 d726cfd7e983423cade68a9190a42c06c62d84ef
SHA512 16c963e789c36c2d1674aee4f56593864c6502b581290ab4c5370bf5cd41824a8c9e55c6360aa91f301378a1dd78bfa1861a61f5493297be6d2d1bf214b5350a
SSDEEP 24576:uVbqPb88hv/l+6YsqjnhMgeiCl7G0nehbGZpbD:uVO88hXl+vDmg27RnWGj
TLSH
T147559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ac477e208284fcd6a18ba408f20b14935b2202727348896a6c6b4ed0caf76c10
MD5 97af746482712b717d80e3cd36f8024b
SHA1 80f5d90c8e354ac4222595dbb1627d5dc8e5d45b
SHA512 6ef474f1de3e6a9900799709bdb020d2f090b9b8f012ef6fb83682ff1f000cca731951b5311e49f92fea5b0be02219f71a4725f20956d3a44b2aeded6d7c8426
SSDEEP 12288:KRDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KRDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E74523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1677ebb921c894102582c8bd65fd2e03b0f9452add05595d935bf6f3ffac6db3
MD5 ceb03d92a4eebcf43ac9a3f6a6188de0
SHA1 271450a3b5df7a36c5b843930dc785620aae79fa
SHA512 8dbc1b10b8a003eb861f56188bfd0fa218cde5d483ccdbf93b41afd11df8ad18d7198316ce98966ada30f88a1a35775b31d30690f12661bb4d8fccbce4a1be37
SSDEEP 12288:OeBNUbTVO86UwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:OJIUwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11865CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0b770567549ccc7e2739b673b99d74e9be57af42939bcfe4438b3655a7ce33f9
MD5 916768217db0dd0e54d2406e938137cf
SHA1 a7b5c3f6bb1eb15935a66dfa7f0b9b746a145d0d
SHA512 846eaa77957146875bbd1f404aeb6a624f7eefb8848b7c4f60f35a7fc631e2b7ecca0115594efe5047ae68f48c328103068a98a4c027e4df78ea968a9b80e391
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THv:WQvGAdlCEL8c/yRNw5ClD527BWG
TLSH
T133266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d7aebc48e4e592ba7e64ae65bdae7db3bab25033452a2fa4341b1812beed9c3a
MD5 7635ae90fa3509f2dd99e63386fe83c9
SHA1 bbb53a382758f57d4b4bc1db6cd6bbecf3d99f7a
SHA512 8b6eb23e7563b37ecf2cba5f23c10e99b3e11a20db498318b0669570df076a0efad9daef6809a73b80c4622a9bafef15c1b2126411e7c5980695375d845d85e9
SSDEEP 12288:oAwSfxL/2Dc34DLLmt0LDQewsAjSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:NdewsAjSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10675E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c107c1084457ffaa7e07655444fb055b9ef50eebc51b0c228d1fbae8005f81d3
MD5 cf0e86e536590b545110500a8a10bec2
SHA1 aba4fe2c493a61b882b91aebd632b7af8388084a
SHA512 ce1b364a25a576c331fa94f96b56d5bd23ca46fbc4e71571a875636effe790c5cbee961761c5abef9f7a3ee74d24ec69871b9a6d1e03af87abc0bbe5c697a333
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHuVQBWG:sUEtQevvqc2W1cpV2EI32hB
TLSH
T176474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 756f0c74c65b9382e32f162c884b1c399a2ce98d4e8f9be10699d3fb28b39f51
MD5 026ba3f2c13ab7426e7702c212629cc3
SHA1 43cff43f40d5dfeccd8d619609480dcf3949d354
SHA512 4debfc92e39296dbb9bd173ec044c890afb1f401ce912732aa18f8075bcada6dafe2158e0291a353c52b8c963fa5248ac318712994aa3310010f56668edc41e3
SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/z2Dmg27RnWGj:3oqtVjnmZD527BWG
TLSH
T179D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b838cd610ab5bdbc92bb2a15c09ff2b1cb53c7e966771a2517fd166f917219f1
MD5 61f1acb342c5c5358a906f8c5b73e915
SHA1 84c9bf529a7afda26f1eb4323a0c0668dc68cfdb
SHA512 76abcd07b02c2a33285c5547c5963bf25a4aa5e599ccbddd0bf59e1ed534ccec2747e739884a4ee52997999b4e86ce7c5d6a25c212965ec53eadf90117b13b2f
SSDEEP 24576:MAhGLJIFoiwtA5l7S53FsqjnhMgeiCl7G0nehbGZpbD:MAMyFoiq5pDmg27RnWGj
TLSH
T116359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a4fa366cafe6be19b574c84081988bd77c8afd5594693ed012402303a2622b7a
MD5 46850cd88840ffe5bd2ce846577d1643
SHA1 cacb626ecad6cf04c355e3d1b216eb2faf11589b
SHA512 2c9a4614b36eeb239ff65d1c92d3eb60cd29a2baad34a29b9a9fe96e348edcd1fe3380c4ef5ae9a64cb83a7dca86150edb48934a6e408689a55c6ed8da0066f2
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+ChXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:5wuoOWWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16865F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 13da359fdba78a5ddbf9fd103d653d2854ea17d2a6d6f0b3b5c924b8caf1279f
MD5 42dd23ac7e19117f3c9579f9b87bf49e
SHA1 0e85724115a9574f470ed15902c5fd24ac7345d7
SHA512 69dcf0c7549a58351c1664a1bf2bfe4906e2463e0da6ec1061187ef465a2de52a391072008259da7dc8c4c54d45de2ba8f5c57011755e62a2c2e7e8184ad8989
SSDEEP 12288:aBZ1IyiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UZuvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B5512AE239820FAE163417CC5E5D609EB337C62673003CF166656AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 70f3fc5dc0de1faeaea5f6de3508cde49abe247e8c85423135d971a9d37d2707
MD5 838a0ebaf52af393ec8268bb465deda4
SHA1 9c74532e2ac76194521dcb80b06ae5afcb79936e
SHA512 b1a6fbc36f5f4f391e6e3f7185101db8ef77fce62ac135d632a7375f1b3e0f6e9af6a3106704669e0232c25bd14bf72373ec86430b0edc1273af07ef7b1e3b5b
SSDEEP 98304:LQRQyi36YOcPQLvw2gAf+PN3gD527BWG:6QyiKayX+PNQVQBWG
TLSH
T153667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e6f05bc4199e9b8fe367c13ab9e76e109bd15f9fa7d57899731c0ebb0befa8ee
MD5 fa09cf67fde22b051dbb951e8d400d16
SHA1 200ca083c8fee3c5dbc827b2b3348228ab737e0a
SHA512 625207c0d97c92bd77585e78131a8cc5e2cb5e334f28d5003762de83d997b8a4c0f4f062a5319587d8fe9236bc258d03d883ff1b95bf33e36d9a341782acf971
SSDEEP 98304:YQRQyi36YOcPQLvw2gAf+PN3gD527BWG:PQyiKayX+PNQVQBWG
TLSH
T14B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 17695aec35c12968bae49e7ce3140f3e55dde1c84116692791a891be0821dfd7
MD5 8a657646df9498ecd629666da7746e33
SHA1 7c21494615fc3851673c4021f888982bf81befee
SHA512 4a131187f96017c5ceca7b4c2dab2a8615d72eea1dfe78b5a42926b054813c30bd38b3011e216ddfe3446b836815c181f1f61cb58fc80a84347c8e6889999564
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0fsqjnhMgeiCl7Ge:d68Qg55nhheWu7PNU3/GDmg27RnWGj
TLSH
T18AB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 835a77808f5c103e3ed2f1cbc7179dd784f01bc50700ff263d4767155f01c9e6
MD5 6644372c9da09cf7fc8aca7470a20e95
SHA1 7351f42e00514957551afb5a38756fc9d50fff45
SHA512 ac3474357292b6337bfd264b6d66a33ff4970ff91e0eb353de16e308b9088a6eabe947ff3d4bcd982a4a346eab7dc5b8d8735fc142664a6c86e53596f8da4daa
SSDEEP 98304:5y5112gYy5azzVvL69nLKnhZHD527BWG:ULIHmWhxVQBWG
TLSH
T143167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fe446a1e290fd00dd59ca59bb0b2435175f4d6ee0729ea1bbbe5ed8b28c3341e
MD5 5495ce3599d2cbaac01deb529734bcca
SHA1 1e4b6b7504b859ff3920672e7c631a262c621bca
SHA512 65b0aef3f5e4c337129c74b2dc5fefd1ff09eb5e66f2fbb004b8bb38f237a0a22c7dfaac02364f28d01fb21b578ef4a5c5ee2b173e7d42c3faf85374ad354cc8
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIDmg27RnWGj:pu6JmVxd2dID527BWG
TLSH
T1B7D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 48ad1f0ea48554406af2abfe29a098c6ea7fcef9fe322073519980150820968c
MD5 b31f18765b23ace000185143676e67c1
SHA1 1b1b6bf02c015e630a0f711dee369ddbe41c0f91
SHA512 687f6d654485e652c388b9d281dd3825f5a9eae789b0ed70bb93fd1363fac779f8dbb98cc8b4e17d92f2fceabecfe4732d5107bfc59ce59505a09a7ddd6dea41
SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xMDmg27RnWGj:mmifPbRZD527BWG
TLSH
T1A4B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ab951e8b194dea5a64db72d2d1b835f3599db1f76fb595e90dbe41a69a1dcfc5
MD5 3a167077879a3fb4bcdeba238c1321df
SHA1 7f7de3ca3ee0a58a36408421a9ddf755bad6401e
SHA512 bc9d5f36ddba8b5249c54f2ecfef80a98fe33a006a82446c9e66b123c623fce6ff5e4af87b8de3d029c6616bba5d50e1cf0adb00b723cf6a1696d6be30ab30e4
SSDEEP 49152:/SuZQIY0Be2KRRVtOnks6NMHqTDmg27RnWGj:F5dKTi61TD527BWG
TLSH
T124C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2fee976a0eba6042f8e974f983571277f7da87f7da832f4b246d6f7fa468edb2
MD5 62892d7f0ccde5d8db10eb2425561eb6
SHA1 3e4fd0cd13a1e9880ec1ab386b0f79ddc188640a
SHA512 f9f754da5a53120cdd4eccac637be645736f80ce3b8742b5df020921cd05685e0b28013ba586cba704d8c5774aa7c66a52048cbf2157ca4e4a242cf6afeaed0e
SSDEEP 49152:9htSn8EApI0figngiDn0AP5wYDmg27RnWGj:sX2iyph9D527BWG
TLSH
T1E295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8cde7ca28ce41d396f4993909127b8198066a2031900d962dfff842e29f4540a
MD5 7aea1209ce1ade63f8960af0fe495066
SHA1 4ad3e812900067416bb7940e9590c92aa81f4631
SHA512 5baba638bc78b316534270d81bc93c5b5d757293c1c410b243fdea662d6ef4af7dc481892fd491b60b9da74839bc8c996355f82b9b07d436e12ef78bb0bacaaf
SSDEEP 12288:z7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:z7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1384523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A5B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 452c116d8cd8d3fbc043ee64cdd8f0b228a46e55ce38a44f07bdc04c818ba477
MD5 4c1ac98678a60e7cad1afa40bf6e3e6c
SHA1 bba047d4145528513ad0d41daad38e65463fcd5e
SHA512 5c3d23e034c4249e5e48f789ddb8dfffea7b7adbc949f402b75de37122820b1a622a48deaa2164c91e6b25cb62d1db6f2b0dbf4ed86733d26c92a4f371f7ca93
SSDEEP 12288:UeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1134523BF965C41CAE52644B5C3E5F10DAC073E5BE92004937A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d01f32d189720771361aaae0a21d90a455362111081f1c235a1433ef82ffd541
MD5 8fc1b98c2cfac4487590e70d1995924d
SHA1 10f927293d5c287ddf96d5630950dfecf10a4d39
SHA512 8a9646aa50237e2560261b2acdebc37a8894742356dc16f61110823171b0e2c81c77c996ffcce3d48f6fe8d21b2f2e10499ba2573a46e01a23a69e7b59364ccc
SSDEEP 12288:2IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 837fd95219df4c833407a781e086b533bdb3dde081eaafac6877570228831420
MD5 3b268bb23ef78276327ec6d9587d6051
SHA1 57affae64affc1ccb2006118fd3432a4c5f1356a
SHA512 fc89e5dff2b5b91bfeeba3476a984f561a9d50df4066703d8aa45065e94ba46192b379029fe133fc810e0b1c9fa975c9c2e48fe710df0715e8452b7255bb828a
SSDEEP 12288:gVlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15645236F675C00C6D83285B5C2F5E11DE8237D56EB3005DB6B532CAEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1466ba4ff06cc993b6abe60e8985322579325dba8638f8857ebb8d8734549e80
MD5 b02a920e041c286c946701f9989e6fce
SHA1 9bde2cfbccf86cede09511c9a91b344ea02bd554
SHA512 636668e213076b220164880dfebea4ba1eab0dec2c72e083262424d3b210abb5df8afdaf079ab6a8397a9e5adb8e622555d1d5e2d5e85f318f264be129b9b49a
SSDEEP 12288:3tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bf466297f8dbc6ff9bc584c04579a6a72431656b712eecbdfbaf8679b5c1c806
MD5 345ee47733ea3d77ba91c00270db7c2a
SHA1 b82c8b5bc972ee8a1056e3d3f0e208bf491bd443
SHA512 8ef5d725b0ec82850f82ac06e3a9257901cf5cfdb9ac73c9188499601e24d0384535d32d9f2920175adb722a5a2b222d2825fd04f0e3dff5a59a49d29af51221
SSDEEP 12288:7qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D34523BE965C41CBE52644B5C3E5F10DAC073E6BE92004937A5B7CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 464ca4b25736d35ea0b2bb41c0bd10baa3e8feb42192145d4904b7f875dda985
MD5 d1d72fe4339de63c7fd6427bed3766cf
SHA1 48d97e5a1dcc1302b27077ffbabb4af74b365be5
SHA512 9c5188b5218e451cda1f079f6efef759a94e90b8d1e8582638c54e29c8c2b510b503cba64e8bb4a1642072073574b36d5756e2489a91ef5f1fb8d0fc622621b7
SSDEEP 12288:BGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1094523BE965C41CBE52644B5C3E5F11DAC073E5BE9200483BA6BBCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c7cad6d2fbc5a52c0da9b642cc804bb2a43d962a938d8fd6023cb55225f05e92
MD5 ef2d46944baddc71fc3d6605394ac673
SHA1 192d1e81abcd775aa3b478f427ac3d4f950ef975
SHA512 74f0e2cadd12ae08db28c0dc0bc8297ad342ccab0831f95830b2fa7239a49c00435beb9e37d6f2fc9d9c3a87b1dc003baad062da893ba8901034244309352774
SSDEEP 24576:RZMSzFVSO+sqjnhMgeiCl7G0nehbGZpbD:RZMSzfODmg27RnWGj
TLSH
T1276501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b34cf8b58e9ff65a56ca315cc74b19b572985ffbb36c5569f9b28ee4b38e2995
MD5 e3480d77aa7131f503bacd250c68da1e
SHA1 088f6c7c863048e758424d430aa002c93265fae1
SHA512 dd890f762806afce0bb40883059d9040d93cf575eb2e4bdfcc8ba1f36ded24e3fca3bab7900e3a99fac25055979f05d2890eca17fea0033d5c32d0cc9d1b68c1
SSDEEP 12288:g/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:g/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BF965C41CAE52604B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 39a865c84b58d975fb849d7d460020b3905898cc0e07b5806082d15d7d7e62d8
MD5 1e4e383ef749a0cd4a22a0daf2898f46
SHA1 d517712055b33321f06b3baf188235bcc3d818e2
SHA512 2195e0c454f40eaa62bb7126892920c87f8d2854b855c92f37394e508582597ac2b1964f95f732124df8838d335d29036047375bb8f8b197dcc2ba6e01bd4e8d
SSDEEP 12288:GTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BFA65C41CAE52604B5C3E5F14DAC073E5BE9200483BA6B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a87eaedce98d75bd126fb399bc7f6460122c28110c71263a9f3e5be4ad817ccf
MD5 d923f23f5007a420455ae263360f068c
SHA1 18045191c3597e37e83525fc791ecdeb5754f386
SHA512 8cca2666de83adc51906557f5917af8ed366d70b1b505fdb2588944bb6e8011f41d68e5fe07aca5ffb54334319b122f04dfd460daced1fc94c1b5d7a7ea251cd
SSDEEP 12288:1yPz5L8iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:czyisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA55125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 db30519608c13f81e3c845a9c6a6e737eec46ddfa081403a32e65217b3529b8f
MD5 b43379e02055a1083df616d1df323604
SHA1 a34923e7789b96b0e8999f1dfa43e0836753aa94
SHA512 3ad6d334cc63dddb4cadacccff3da00b614e915082750d75c35311f5551e95cb7491af32f446e0eab041710aa745d491ede1778604203c4731851500a22da256
SSDEEP 12288:K/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE0:K/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB4523BF965C41CAE52604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b520add699b661319270d28de75ed7db4ce48277903cc5100a1b9b2aa8d5a26f
MD5 c377fe5f77275c514f52a0158a0fa8ae
SHA1 160286184ff8012326a1c6b2a918537c5e98ef98
SHA512 7c78d40a67d71584aa7c07986aa949396ecb2f3c7061ff5ebfd4c379e7d38d26d8770396d2bbd8c1b3982f708b2c17999f3a0b90c3a4d6800e9245be059e145d
SSDEEP 12288:y/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BFA65C41CAE52608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 85f7917dd0ec8136e88339a8dda8834d5fe30d8d25fa924a1919149fd7f32de3
MD5 8e714913af944e9d52cbb43a8a98a34b
SHA1 251bd9d00cecc1168e2af3f8c783a8ef6dcab706
SHA512 85441f847b49a6cff94331b5feae1c9f117cae6da9f4c8ccedd8638464ab4b0c85103fac0e656d945b3817ed946e290a58de7a68c143b2b55587a346fb9a1fda
SSDEEP 12288:HyPz5L8iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzyisqjnhMgeiCl7G0nehbGZpbD
TLSH
T11055125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 80b498b396d2eb64976e1106c0f3a2f4e16d439f5406fb10a22a8f7607b5a611
MD5 e097870be91225ddf71131a81790a2c0
SHA1 8aa35051fa8cb18d997622b89bf00c86dec5227a
SHA512 1c54b339ad6859768aeed55c9ab1a185e2e53162964eabd65d2de3ef345e35ac9f256e65dc2d3f5e8dbcdf17cb592c351a72cd7f1b1e5f6f3e76b445cd3fd6a2
SSDEEP 24576:TTHaLl3z0zD4sqjnhMgeiCl7G0nehbGZpbD:TT6LljVDmg27RnWGj
TLSH
T1A66501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ad8f4b425c44be426ab7d970571141fad3822b511f0d1ed560b6cac03705e974
MD5 c960c7173cb5a5623951269f9b8e5a9f
SHA1 0106528bd17a6ed85f9a070a3fffc4d9d04e3bfa
SHA512 90d5d7744a507b93c10f9a87d5bcdb1027b793024625660cdf15033445f8366bc6baf7100fbe49045eb34bbafccb83e48d0b2e94d464eb1a0056a9ab10589453
SSDEEP 24576:c37d9CHKy7GZksqjnhMgeiCl7G0nehbGZpbD:G7d9CHKyaODmg27RnWGj
TLSH
T10775CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fd8d8971b29b6d90aabf04be21864465ae17f06043de4fdba4813a567a8c363e
MD5 9cef43829d624645fba81739239a9555
SHA1 a54e50f5e8e27f4b0e94825768e53cd5e2e2a4c8
SHA512 df6522871d55336324d21c28754a751f3640b320fda03f9af3a978d666f321cb308a30b376a2d64e73e004905dc2c3282f0725fdb23dd7e4c4132b3848f2fa3c
SSDEEP 12288:7oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC4523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ccf6065bc5ec033027659b5639b4e95a58df032ba12424bbb2ad2fc72b7ad3ad
MD5 dbdf2a455ba0741d810ddf3ce07968a2
SHA1 ee42a515238d471435c81729ac3760e8ff76df1e
SHA512 3cd83988916934537b6f1692493db2a68ded031e656d9edbbf7137ff776d8d1fc71088f18ae634c5550d89e6ef2bfe6724f087b0f59de711cdb0e4c9454041c5
SSDEEP 12288:GCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C4523BE965C41DBE52644F5C3E9E10DAC073E5BE92004937B977CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7ded5ba6ba2c3b57bba419ad94390ac92d57fef877177fcdb0b5c6779dab7902
MD5 d3d0100b9a27d4a4226d822e4d1b8b7a
SHA1 bf8a74afbdd462cbe9b54464678a600a70fb3a19
SHA512 0a49e1d6d99cffc8fe676233320f37a0e6a072fea0f14a569436d9331d7c2512288957a37ea610e7f243ca2d22555013bb86281a51bef5155445e37e4cf8f4aa
SSDEEP 12288:HJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1604523BF965C41CAE52648B5C3E5E11DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 356cc0b41f16b5ff89751a33dbd4ef32cd4e4b947f29743c7e649d1851d8908c
MD5 490f715d6d8115e4189d192f6d8f2cfe
SHA1 c434dc596f99f2944f586baee2694b8ce3d79009
SHA512 abb833deb69a31a6fa8a0c847a5d8477173e5df025b841737a47e2ee386163c22eee33b325ba891aca55c65b81c4b770a87bdabf318a6fe340f5bf8630508658
SSDEEP 12288:5/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 41b0df00f5cc6a6726c97ccc478cd456d99971b2fc5cd530fced3b4f219cc767
MD5 111a83061222234d6af3382118ab48fd
SHA1 d9b387c63b9b82a08371cca2de7fc487491e3f17
SHA512 21387c8ed651b42c28f056d4d491f813d5bc694fbf91c556ff0bbf16c97ac06f97854aca9f1a49b73a0eaef5a64329c7045afffa518131acb5ddb1db16a70a81
SSDEEP 12288:BoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BosqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 360dc9bdd87cdd906c822136c03398103fb67b7d310fe36e7d1b7aa4094e31f9
MD5 c048ae73b4ccd1dd4a8e12c058eccb38
SHA1 ff83ae5a2ca535eeb8743f2306d73353041f83da
SHA512 3b96e9c1335e79211736663c068a4617572897f733b9a0d4396cc2abd4b8d381871feb2039428b101c2cf8b99ed1f73abb9692cde49b93bb8ebea051823c942f
SSDEEP 12288:zHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E54523BE965C41CAE52648F5C3E5F11DAC073E5BE9200483BA5B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2026944042dca9b8cc7852ce9bd5b4c06829f368e8b9d3546bb280d76b7172b0
MD5 6da872b5e1efeb8672c19605385caba5
SHA1 58e06a2d6faf14c0e123b16b577c5ccec403a61d
SHA512 336877222329038816fc28680f002cff76f0af590fad0fa07064c8ebcb5af07f081ea304c9cf2028f25527c4eb50ce03a478f0617d56e68592f669e8f0265152
SSDEEP 12288:utXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:utsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BF955C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 366603980563c36b046e3217d76bfba91bf1c06541a65a680f8632b93e3f2002
MD5 765638f45820b1dbce4538f77f29605c
SHA1 a85ff3550b9e012b7148b50f696ee8de5fd6c65e
SHA512 45dd512d516b6775042b7d691f7aab64384ecab2820d871817c87662234562d8b5bf642cc8ac78baa690b252bea1820894f8d9b3a4ee96ee8292ce4f08393924
SSDEEP 24576:Bfwvok9RX6wkyAIjsqjnhMgeiCl7G0nehbGZpbD:nMnYInDmg27RnWGj
TLSH
T1E885D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2e9402b511cea4c12f84e84f7e00210a7c3cae20ad06f6d092833e01701cfd8c
MD5 d98705ad46a44eac2a756f90dac9147e
SHA1 a590dcd443c6fcb23c987873a99a6af0c57f8206
SHA512 748d984c0809a40c7d29362d4e1e6cbc339cfda3b50308d0e787e47c2f6f35c5bb4a68123fac56e464bb75b6714775aae6330bdd668fd6d54e194a477cf3381e
SSDEEP 49152:vYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04Dmg27RnWGj:rySzPAD527BWG
TLSH
T134066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2af2413629aede2e32f1230b1ad532db7c79c3f61d4d6cb5c5b41b6dba5063e9
MD5 fc819757e794b53ccc914616ace7332a
SHA1 7582b749c7f57424db06fe1d5991f5d4588120cb
SHA512 1fcc9bff13da0502204da2385587d3f510f09ac9669eb7f0e770875b73b4ba906d4d2249e5b85cb4f63a67630a1e39bb62a86ceebeaf07079fd53690fa803213
SSDEEP 24576:t47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYOsqjnhMgeiCl7G0nehbGZpbD:t47JUQj1irIhCnDHUPfF/IDmg27RnWGj
TLSH
T17665AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0c5705f0edae1dd92c783ac9c203c20ba0b08b787ce3c19a19affaeac1dfae5c
MD5 a8e1b010502ac37979538262543e488c
SHA1 ed369641cc7cf4c44ed8e5f6949e0f4217728ecf
SHA512 7e82e0d11c81852d92d7cb66f5bacf2ca0e7dbb1045d5731247e0f9e09467244b38a3f48c3deba43c1cc3f89890c766c8d4761b4066d82f0fed368cf3d1981bc
SSDEEP 12288:ZNsfvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:evsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 920KB
SHA256 dd5cf0477e919ca27dd77ec1eb61c7394234c22cbae5c10a7b2ed457b1b02c55
MD5 9a086f017ff31972591fd033460030a4
SHA1 070d3334e09326e98301d5efb12c39504a1a540c
SHA512 b552aea3332399c7c81410aae70012e8bf33fcced2f11ab7ac8a2dcf5357985026b6910d338e5255bf055a86ed6025deaa9c319499d4a7abb668609ed8c7332b
SSDEEP 12288:770UU3fvcKSE/IsZku53M2iRp+J4ZxZVYuE:775UPRxIYku6LOJ4ZvVY
TLSH
T1401507107626D74FC6A944321E32D5CCABB07D12EE45AF0373C8872FD576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 78935b9666b828014afa792d6f77086e779cc953edabdeff81b64d8ae8ab40fa
MD5 e7f117d4f7d7cf37a03212b66c9d7d53
SHA1 7731f08d248a4a118af7099cd720f43c08a6e136
SHA512 6b311dee5ee9199546ff435169265d9093005e0b28e148e28961794acc3ed586d2318b492ef6299ea70131e71e1dc4fd08e416a4efaff80ea361abaad9f3fbe1
SSDEEP 6144:DqdMVaN0k9Ymgrqp3gdNUN+RSqtMxNSqtMxO+rw0aIZkJQV4+jUdsUxeaw31/:DqdgIYwp3gdukxZkJmGsUtw31/
TLSH
T1EC65D7405037A38FD1F62032472A9B4CBB64EC17B7496F22B3C8453AD86AB55A1F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6ead09afcec0e977e8cc6fab41ef0d03acfc81149216ac4d48af6ad33335d3bc
MD5 200c502e5ab9a10c87da92413f6cb8c1
SHA1 ddbb28f42caa35bd7b7edd7bf7718230269772c0
SHA512 9c98cb57e11a9bfcf471a637c6e35cb67e668693321df24867b61464b55a157a594c5c8c2a0399cdb717723df3c17f29cd6e39dc14c1b02c02aa673a7b18c232
SSDEEP 12288:5M73Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17345237B935C518AF93605B482EAE12D680B7E669F1044C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f730bf806cf9b529613c683c234b6037f4ce7c5ee801e2b852ab45e5c1eab6b8
MD5 652f343c121fc7aa82206d30be471c9f
SHA1 056adc045de6f7bd13efeb436f0a7bde263dcc13
SHA512 9ed198cf9449af4f847d205d080816026c70b1f9e69ae157c83112fc8e565771b9f0236c7e16ef362c9b9e78af59fd3091367075d9ae4f24311482a1b4d8a633
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYBsqjnhMgeiCl7G0nehbGZpbD:xgb4mBIBhGFiDmg27RnWGj
TLSH
T10D659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b7bd51013228e55cc992679e9cf5d6900b8609bcda3def8851874e5447a90d5f
MD5 16167ce3f5c0fbbe350edd9279b8622a
SHA1 68d43eb1c4c3573c2db38fe9426e3235903f917c
SHA512 e055b217b45f70316c1746fab55351ef737cebca4f243f8cd88a303aaa461a3c62d8ba652df608d1c6a71d6c39bd850c919daa6126d819055f09738aad587237
SSDEEP 24576:PG88u8FpJqH1bzria7/m+sqjnhMgeiCl7G0nehbGZpbD:+7ZFPqVea7/tDmg27RnWGj
TLSH
T17B85016577E401F1D477D138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 cb031ebec5cade7ae80a38156ed48d91bf846fa670d67669fe6979e5bfe20d5e
MD5 751628cf78ae6e2f8581b15acf7ffb44
SHA1 18f1425d8a2026351a74c18455a46a4697c17de4
SHA512 1778067c136e9a2936ffb625b47aac97f7232c45f42389077f94c04a19f4f80aac96424e30bc47857a9b2c7d70a746aa894bf5e072703435b605ebdd7e3089e8
SSDEEP 12288:SHvUrBFrEjwaQ6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:SPUr+NQ6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11565F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 39359a5e238f0f98184d60267b4a64933377fafeff44b8f2e24873c93a09cbb9
MD5 b8cd6f8a8ebb0504201e9a05a13e35ea
SHA1 2decc7720230c3764e5fd8a04f5b02d6aef9bedd
SHA512 0ae36d849c184b34899523eaf402fc90ffc9022e36381e2e6ba68b761b1460aaf40df564aac7bf4dc198dc287efbf9cb28512f87f3800ef11919299a58dfd8d3
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+Dmg27RnWGj:JG05lO43b/D527BWG
TLSH
T142D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f95c684773ffb99bd4e15a862359337960a885241b855fb03f53858a1d43d60f
MD5 0123564685fc27f6a56a5a5a90c3f9c1
SHA1 ad78570cd8786bcc256905d2a1781f27bceceb48
SHA512 7eac82c7e71da14fb91ba597feb20a069624ad81c90ae293db79f5c01346fea3b1a13d39cff95777d5e3d586b99040d8ef5a4a943d39d12c7352937cc97bf246
SSDEEP 24576:ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnMsqjnhMgeiCl7G0nehbGZpbD:na5POZ3+Jt2pasx2+mGDmg27RnWGj
TLSH
T1CD65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1bdcc6591167a218704caf5d0787f418aad2eee0d61875d47e313d4ba9343cd7
MD5 abb167df77e57878b76b51a04bb78909
SHA1 fd904b7f14166da7d9f9b443665777341c489119
SHA512 b8eb2bfe51a3d79c1b24070d9e5fc9b8adc1603ab9afeceae7dabd7f4a607e5626b9aff52bf0e15b2056ecc0f3ca365be5cf6c89625ff654db606f93538993e4
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7Fk2sqjnhMgeiCl7G0nehbGZpbD:0Nc/zEOVHFNDmg27RnWGj
TLSH
T147857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7df3b3302dc0e0ce219c9cb658f313170c0047e3bb5d176316b343a2eb1b5563
MD5 6970df7ba4d976e3a747b9f5b86a155c
SHA1 a9adb2976942510c8e893c44ca50974388451868
SHA512 79b54821311ec56f0e4bb2c159518a2c9477d925971322a765a2a9899fcbdb1f4ee2a91f346174850b191a5280b8dc4d75ac51d7e09a04370dd7c77b85fdc9b5
SSDEEP 24576:f8kNvNnaFeYhJNtmZBmAsqjnhMgeiCl7G0nehbGZpbD:f8MwBtOm8Dmg27RnWGj
TLSH
T19055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9dfe020c6b248bb75323dff29c6bbc2587d5b9bd5e6e55ce33d457a4a9deecad
MD5 fdc491b16f676ab1a10b04c417b558ea
SHA1 1c4b26fb9ee991a630bc007c22d6ef2886a35656
SHA512 c67df1f55707895fcba5f0ade455f636c049f70a44aec8704d58c2cb2dfa50c1c5e5b0f7ae23657ed952108ee14464719fe200f8b56d40269478efe4866ae277
SSDEEP 24576:SD3FHshBIYQgAbsqjnhMgeiCl7G0nehbGZpbD:SDVHeBIAAPDmg27RnWGj
TLSH
T1E975E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-313-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/352-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/352-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/352-103-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/352-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/352-294-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/792-51-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/792-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/792-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/792-47-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/792-42-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/1100-408-0x0000018CC4230000-0x0000018CC48B0000-memory.dmp

Download

memory/1100-329-0x0000018CC4230000-0x0000018CC48B0000-memory.dmp

Download

memory/2092-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2092-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2092-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2092-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2300-78-0x0000000000400000-0x00000000009BF000-memory.dmp

Download

memory/2300-0-0x0000000000B20000-0x0000000000B87000-memory.dmp

Download

memory/2300-7-0x0000000000400000-0x00000000009BF000-memory.dmp

Download

memory/2300-5-0x0000000000B20000-0x0000000000B87000-memory.dmp

Download

memory/2564-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2564-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2564-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2564-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3692-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3692-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3692-135-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3692-129-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3692-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4132-169-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4132-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4132-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4132-63-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4760-96-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4760-282-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4760-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4760-90-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4760-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4760-330-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5180-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5180-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5180-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5180-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5464-231-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5464-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5464-80-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/5464-85-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/5632-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5632-197-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5632-74-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5752-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5752-116-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5752-333-0x0000000000770000-0x0000000000942000-memory.dmp

Download

memory/5752-316-0x0000000000770000-0x0000000000942000-memory.dmp

Download

memory/5752-122-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5752-302-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5752-418-0x0000000000770000-0x0000000000942000-memory.dmp

Download