847198035087ac1c39b3ea08c632415b80896e0e34115b36f1e40e5558c47853

Analysis

max time kernel
126s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 5.7MB
Sample260728-p7mdfaxyc1
SHA256 847198035087ac1c39b3ea08c632415b80896e0e34115b36f1e40e5558c47853
MD5 5fb46567748227699dc295ff22585b63
SHA1 33a7acfd7fea3b97e627c26704337f43a744f5f4
SHA512 8adfa70029276d4906dcaf8c99a09808483eb739ac975d25d3d128fb2c398422430bedb8fd400f56c7d7ef20d1299f49c5b9b0df1040a0a522264a54dbf5400d
SSDEEP 98304:LtSuMOINjO91x364DT+Tx4NVMFb/55PU/yOa0xTQWj:wMJtM9/5RwW0RQk
TLSH
T17F56C001BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4292	elevation_service.exe
4304	elevation_service.exe
2016	maintenanceservice.exe
1184	OSE.EXE
5892	PerceptionSimulationService.exe
1748	perfhost.exe
1420	ReFsDedupSvc.exe
2096	SensorDataService.exe
4216	ssh-agent.exe
5792	AgentService.exe
3268	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	38	9.9.9.9	3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Destination IP	39	149.112.112.112	3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\966ae5b6e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c4aa1d3901edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096c3dcd3901edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000827ad4d4901edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e6ecfd4901edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030487dd6901edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005398f3d3901edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edec12d4901edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\OemEsim	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\FlightRoot	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
4292	elevation_service.exe
4292	elevation_service.exe
4292	elevation_service.exe
4292	elevation_service.exe
4292	elevation_service.exe
4292	elevation_service.exe
4292	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeBackupPrivilege	1420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1420	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5792	AgentService.exe
Token: 33	3268	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeDebugPrivilege	3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3536	2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	4292	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 824	3268	SearchIndexer.exe	99
PID 3268 wrote to memory of 2784	3268	SearchIndexer.exe	100
PID 3268 wrote to memory of 5256	3268	SearchIndexer.exe	101
PID 3268 wrote to memory of 3524	3268	SearchIndexer.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_5fb46567748227699dc295ff22585b63_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Unexpected DNS network traffic destination
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2016

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1184

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5892

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1748

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2096

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d13deba26fd97cadc6027851cf9c2ac88f28997832634868fa54de1fe21728e7
MD5 7a4afb568954a792fc3555805cdb75d5
SHA1 50b1c9fe13892b7ff947c02204c0e2542bcf8a89
SHA512 0fa4ad5f4026da74101269982badaad4523e534d693d79cb36fb1175a4e70aeec3492b783c88a1f811d4d9015cfd5f92abef6705a90bfbc02dcf88c90a575bb2
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnx95MdTAcQQfjP+:K3q6HjBc0xTQWj
TLSH
T11FD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d74eac62e4455536449eac7db5618524c9f4b5f08cd561c9b04e83ff2f2d2f0f
MD5 0ac0da9717b4e63df01225ec7c395086
SHA1 386e5b041c338c5605496de8f8456b8cc38f9b28
SHA512 103cbf8e6d5f81d243b248cdf49faaa79e8e7f9ceb5fa0dea79a287a1a2e88c84842d75973d8d6f865eff13cd23248b96b8d3ef15b8e189b8b642d014e0eefeb
SSDEEP 24576:IXYfDtczAQN94AMdTEvcQFuOjOP95Xdt5c:ftc395MdTAcQQfjP+
TLSH
T1BC65F12877D508F9EDA78278CCA18115EA33BC514760E7CB03E48A6A0F336D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a60308b5fe2c5519326583eb189ba1920d63b4f7f9589e78cec685a64041f577
MD5 b87100adefbc91069c7276927f3928c6
SHA1 4092051959cdc79cdbfd8ae4516aa5b56a933377
SHA512 d74065874849baa6bb809540850a9d3bb62dcb6e7c514bd07b8f56cf6ea0bde7ee4414cfe34f270ad7862d09d6161a3c4fcc686e14758882e5104e21746f6b13
SSDEEP 24576:G0Le5ji0hmxirMrN94AMdTEvcQFuOjOP95Xdt5c:GPji0Ac695MdTAcQQfjP+
TLSH
T1B6859E15F6788335D073C0B9C5D2A69EED7230825B308ACB4286D77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d24b122207778519ecef574840899576e5dc9800af06e31c2431f9ca17d09017
MD5 fa21f5fdc2bbc5f24b43c2f2630300af
SHA1 93df03d8b36d1e1cf93b94f47153acca6265d377
SHA512 3d35fbf8171da20fb3f9948274c145af74ced8c753a18cedf496bb83dbe2e6c6728d3d26ab80f5e38af5ac74a836ea95a03b568165cfef0c47612efc7aca4190
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWE6q8wyuhN94AMdTEvcQFuOjOP95Xdt5c:t/ezSC6vUzPvxHjy+95MdTAcQQfjP+
TLSH
T106755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9cf8123475a7e737ec4e727b1f5bf47b30c3edcf69b30ebaa8851273be10bead
MD5 eea640d18af1efe49dba19a4d1c06cff
SHA1 4dcbd81ffbf4229841055f251586c9420170d13a
SHA512 9061033ad8e978aa8429c723bf20a7f9df73b44f78e16df1dde4140204302a4aa8bb135486992a2c698408d3ae40af1561b859ef0885378bfa9c14f00d40631e
SSDEEP 24576:PVbqPb88hv/l+60N94AMdTEvcQFuOjOP95Xdt5c:PVO88hXl+N95MdTAcQQfjP+
TLSH
T17E559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 28b495073949b7a3f963250d893391bd35b387a3231f19723eada3697ffa086f
MD5 392c607e7c29cbbda8d8b27830e440f0
SHA1 00e458f98287c7a90b99bf3b54f203b08818c611
SHA512 37476e0dbb53e53b2e5c221985e46fde556854b5b278b2dbbb4566b11c1f055c9a3e6592428fac9be215e6330de10c3014bacbfa3dfd31324c544cd56f174d0c
SSDEEP 12288:9RvqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:9RvN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1114523653F8DD0BAF3D719B05CF880686D0B9F518E41964F53E25FAE89389C2D6E102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1466cb7281edcd2f10210652d12cb64ed2b7952a9e25b5eb6793276ba3878b6a
MD5 558741ac8cf5a134d1aeadad2153f38b
SHA1 788ee322d16065b8d31ed0806f03ee0990125880
SHA512 86beb8c6b3f480e2c5a72f0039a1c64d422960f6ba7accbcdf9430857fdd899077550a1524d9f058e1dc3a5d3a2c9e1d47b51c68aeb290948b0885bc61c76f06
SSDEEP 12288:KeBNUbTVO86UsqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:KJIUsN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T19A65CF3BAE28FCE2C27A5DB85A91C240E77278704F52A3CBD165830EDE235E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 00e0ff1affa2ca7a66259b04908a08897d12219f7a6b6e70154b5dcff669a5ae
MD5 c592a199480487c3ef3871799683eb8a
SHA1 ecf19ec28b5dff205ceb1e4ec7590a1e01cd94d1
SHA512 60bc5992dffa84617d7029a86d10951d093843fed2c4d452bd41b028b6c7f9c6ba9e001a898b969cc58e9da6c78a1d2450641eabf9356afcbeccd065d3221970
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:iQvGAdlCEL8c/yRNw5CX0xTQWj
TLSH
T11D266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ba8d3d9901f36c39557465b5c4df1292bc12c3c593eaa6da8df3b744edc3aa01
MD5 25b9599b773fe2cdcb627f5b9e9edf35
SHA1 f471af796e13262317f692bc01888b2795461071
SHA512 b04596fc61f555063740690d19df0cf92e0f88a6b97b2e3072b40056a0aec4dfde010430396a43e1fe55792a399945cb1bac0199beca7d1272c690b7745ade8e
SSDEEP 24576:OdewsAjKN94AMdTEvcQFuOjOP95Xdt5c:mljq95MdTAcQQfjP+
TLSH
T19075E031FE75E036C2BB0DB21B75C716182D7A204F511AC3E3E88E9E59342D267B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c8549a951b52e22fc01b90ed8e0494bb3c9c04547fcb77977f307289a7a737a4
MD5 369ceea746dd2940212491eff3f8f9ac
SHA1 8ec900fba5983696b5ec30ad945e9f2edc481322
SHA512 29e58e5b55eb365f103f223f6a96ce645c6897ebcb2277548f64081661f731d308c96fbccf4c5f336df68478008cf87b92f651231f7187aba37fcd5d4211f5eb
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHi0RQk:DUEtQevvqc2W1cpV2EI32i0d
TLSH
T13C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1b8220c19d4c4d34e9ebc9069bf92d51a4e662edb26b9e94d8009c16d056ba40
MD5 d36e305cd6e6c6d3d7905645fce75ef2
SHA1 0367cf6ac8904df1948c43464702e6cfd6a15c04
SHA512 c57a29e3da1bae1062294f0a680d331a1b6d7878ccc5d32ca9fc58ca169bd90126eeb8dbbd12add97e7f146ecbd3080707193144138c7805e1f1e8a7c1fc783b
SSDEEP 49152:kCbRquA/m2yL5zTfFiV+XenmE3/zK95MdTAcQQfjP+:toquVjnmb0xTQWj
TLSH
T1AAD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f4b3750ef7e9b3fd51e59a3624e68ff4efd335d8295079fd1bc463007658a615
MD5 471831e55ed6ca60e1a83a8a92e97cd2
SHA1 e67749dc6696f11e1f8bc22a7a929099d6bcb97f
SHA512 d5cd38d33ae8b03f278d921c6a6773022116152b9371bdad0332d6689852fb096af13198cc4dacfb6c77f59e90224250608b4b9ccb47370f80f6b785aee5a0fd
SSDEEP 24576:HAhGLJIFoiwtA5l7S53tN94AMdTEvcQFuOjOP95Xdt5c:HAMyFoiq5L95MdTAcQQfjP+
TLSH
T164359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2250D11F0E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 cbd166b3721e0014ccf1ae8f4111ce578dcdd030498c6ff8f175f13c97f465c8
MD5 2d1a671d6d1b69ac08a9520851e7847b
SHA1 1b796375e2a5f5538805aec4e9643dde5bd3e36e
SHA512 2961ff2b7506136537eef8cb07b8c0aacf626e5b7ace92b5ac5e2160cd77cfc568a1e95a5eec1db2b05427f4da7adaa1048ea9314c6cbf7b85e4d8e1fd1ce4fd
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CBqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:KwuoOW2N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10365F14637991CF9E9A782388597C136FBB2BC022A21D71F17A0C65F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f10a90c8a192cdd2e8d4aeeac4556a806a226290c69102963ff593ad54c04ead
MD5 e5845fc3360fcaf3b5cd8833ab324b43
SHA1 12cda4e255ee6b6b4a2af1eed187a21441c0c660
SHA512 8c610ca26bc7210e5d1525d70b6ec33ff23a1e986cc19de6c949b2e2c93ae8035a1c00b41aa885a1fcd801ebf40c8537996f1d062cd80dbe661e5eb0e1e794d7
SSDEEP 12288:fBZ1IyaqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:pZujN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DA5512593BD860FAE1A75274CCF48205EB727D525B3243CF13614AAE5F32AC29E75322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 12681e19c10791a2a851d2626f8a781d6e6d3da74275ab3e6a29f09dc6f4ed0d
MD5 ef0058e44d6d7a828a869c8aca9f4a17
SHA1 6c338b74bb4432b6edeb947b5515c4f450a6edc7
SHA512 1a9d171f84da8ac1738cc583414c8c72819f931c9c56f7a761cc01bec9ef764c0a45953a049785d8978ca80e1f7ccff5779a172b1c98f0226ee77c2de6821de5
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:aQRQyi36YOcPQLvw2gAf+PN3I0xTQWj
TLSH
T133667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d117cf55010296d1af38d391c8d7699777d20720e61c7e63e5a0744b67fe5de6
MD5 a0cf921ed0e14e1e4dbbcf4806a8aadf
SHA1 66e663eebe6d7c0257d4363a8acbd49ee451602b
SHA512 64fa94a4da58215f1c385179c59b638a7a5255cdacecdb80f41e339038dea655a4c14a6251da7bc0f80053117cf85c1e3e5623d5266315ab087148b40d9aca24
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:wQRQyi36YOcPQLvw2gAf+PN3I0xTQWj
TLSH
T1E2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 453846351fe2059a575ce502b42afe35476c2087c2619a10115ed84acfea5e79
MD5 c3311f75c55a20590599bc68c2d29637
SHA1 195f95a1e27e01a2acfa7c220e6753d2cc352ff5
SHA512 304fc095973d62226874d8a5f9faba2a1e9d620ed0f59b1024829f542b97ac68ca563d5e0608fdcdd55b19a5289401664ea0122dc5a141b8cdfa7827e91ebd36
SSDEEP 49152:E68Qg55nhheWu7PNU3/695MdTAcQQfjP+:uthWRc/60xTQWj
TLSH
T189B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a5416b5f6298a00b92a384901ef52a0fa1ed6f70026b4d9b213805818fa19db5
MD5 25e916a06e0c86daad2bc9b2856a554c
SHA1 4f5c2d124e622ca8146757f9468e00cef0d1bead
SHA512 f60191f0392953efd52ea2c996b814b3d741a5d5ec3565f2062fecca554e6b1b52e8aa5897e990651f3aab9f64ec1d423e7cacb2adec2157e51e1ad4827044f7
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99a:By5112gYy5azzVvL69nLKnhZF0xTQWj
TLSH
T16D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f01da4add7454c597a42dfcefa022a4505febc4c39b03113ac7de7309e789959
MD5 988c1ddab275ad6f22ddad153c7c263b
SHA1 b95b71d7f56bbcb75884bb7a4831d4552aa76626
SHA512 728376a15c62ab3a9a4b9a55e51182e3d56896cef2fb92c01661e995641d9842b758cc5487464093ee60aee07575f3b903b310bd2db597ab15b7cd7c098a34ff
SSDEEP 49152:DB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glw95MdTAcQQfjP+:1u6JmVxd2dw0xTQWj
TLSH
T106D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cc5629bfb9751d1a128d3a8d63702016fcd3e8cb0fc97f7678dd7e7f299c1f9f
MD5 d54a0731d3377db6e51e73b1fdf3aeca
SHA1 4eabce3dd12e483e249f86d1cf363da6a91f9d61
SHA512 f808537f6ae9063d1cb3cda4b99fe6e5b07155c0990e461c49f98da0b7c5250563df345cd125074d2ac8cc20e41be9b39913ed6ff999c45d1475e681fe09ab2a
SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4x095MdTAcQQfjP+:wmifPbRb0xTQWj
TLSH
T1BAB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 14e064256077ca9a5a72fc2a3542fe37221ba8504e9fea33fb5b5f77a0f7c33e
MD5 904a9926d297c6fd35dc9ceb155c700e
SHA1 eab9687df41ad34b1e0469efe832fde7002cffe8
SHA512 deb60f9f895e61ebb0669682248db4e232e2664c707fea5b9ba587498b5465e6db8c401820fe91a7bd8278c1c19f332b1184143abbcfcd82c7b3e2835f02d173
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHqh95MdTAcQQfjP+:A5dKTi61h0xTQWj
TLSH
T148C5BF13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f414dcdab5439f83ebbabe1fbdce6b24c4cc05802f5fe38e33bf60fa42bbb39c
MD5 7673c711e60e30f74cefcfee2113e9d0
SHA1 c3a912aa666fd66d1ced6db137cdc1507f1693e3
SHA512 12a72ec3fbea58b925ad87b28571eda6c68c2e919346b9f3f41b9f0340412b45913700bd450d600cfd0a141feff7e1a2cbfc30016fe77cfcc1f32616094d5c00
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wg95MdTAcQQfjP+:AX2iyphP0xTQWj
TLSH
T1B395BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5240959cd3fd340c706c0f5c1cf5d128bb75e8cccfcca91b426d034faf60afb6
MD5 1b75b09faf8e45e9b4b0b6b799982230
SHA1 032c13e4e63b85f39c67f99e860a2ad36ad93434
SHA512 84eba832c962fe60ecb384e2930130987e85b3606d1ea6d36e2286d12db18795c58378db0f4df293fccbedb24d9c0e2c865e2996f954ec608df5064d0fd80361
SSDEEP 12288:QnqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:QnN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F44523643F8EC1BFF18615B08CE88168AC0E5F56DF42528F63974E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 41c14d267eb8397c6a241166c73bafe23bd8708aa05d0c655569da10bbef3576
MD5 431c202b88904de2b4c2bec9d58f632a
SHA1 0e88349a9c565a8de78c7e0f50ce353e16a66ea7
SHA512 d7f619c6f69ebb101a732ba3ac02e732175a49ab8d9a18adcd25e31ea6fb40e08014d3dc5df0d87083bf5f7171ea6cae46ae224f07f353bfb11b5a21bdbc446f
SSDEEP 12288:q+qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:q+N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1454523643F8E81BFF18615B08CE48168AC0E5F57DF02528F67D74E6E8A34AD2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 12adad7493224868a55110a090de69c3d9672db89d33e1f75c54f7185518c4d0
MD5 7df1269a1bd9d5854d1c05d23b262e69
SHA1 57f1f3dbf8b8b683b83db7e6fe0f3e16db8a6fd0
SHA512 c395535a7ef6e5938da02a323165b48ca58536c331d04b57fda097f993325e10c9c895239a0e232cf377bde2288d18701aefd31459293dd8dafca72af28cb1d6
SSDEEP 12288:akqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:akN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T18B4523643F8EC1BFF18615B08CE88168AC0E5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a62b3fa8eb04a7a387041542833cf934ee4406245a1064c4d22f8650832943a3
MD5 41817e2725c5363d9fa0c165464e17a9
SHA1 e6929892ee6a7311b86f104366a0f0009ef8d8bf
SHA512 54563f637fc32d1c002902437b15cb5a5ba691442436267636d7059d25ea90cc47f452035ed9674fedc05f807b03d3cc7526252aa6e2ec948cf4b55ab07aeb62
SSDEEP 12288:QVNqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:MN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1894523553F8E80EAF49792B0C8F48168ED6ABF929F12938F57420E5E4E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e176439349bb580c8b230bb65890713ab616f31739d76274cea4105beed1982e
MD5 0fb19142aefff85a8b882c289b54d53a
SHA1 9a987deb84a1701aec2fae55747ce4f71ce67110
SHA512 68129a2950b713b6911128b3d3db9f1fe9a4d85d855717e451d85c11cdeb8bccc49ee3e2f4252b62696c50eb068c4a836ca511acd3395f57cfcfc78ff32b3220
SSDEEP 12288:oVqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:oVN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1EC4523643F8EC1BFF18615B08CE48168AC0E5F579F02528F67D74E6E8A34AD2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 51219ac5511fc8e8e08c858750d3cad5a68cd4e2c9faf5dba72c107c6634123c
MD5 a3f941f61d6ad4247ecca3d29a20bb2d
SHA1 73869b2afa7c0e9dac0a2b3877acedd8bd0a91e5
SHA512 9ad9e21cbf3f0d11b4dad59b3dd852390df846f67cf29be57fd3e4a994806f23ecdfd4642ada61df5eabd437b77c986b74f987c6b4b98b541edeecb1f67cf1c8
SSDEEP 12288:UiqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:UiN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1694523643F8E81BFF18615B08CE48168AC0E5F579F02528F67D74E6E8A34AD2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 be227c6ce04398aa33d8046d270f953617591a045c88e6e23fa28df967e4f7e3
MD5 fab66e857bec56f0fb8a80a9bdd122e8
SHA1 3d403cbef234849b314cf116b322e8453233d778
SHA512 050bbf993907a93f87d841746c84c3acb446da3ed752defec2823c9547ff6c0f3b0deb617fb59a7b2a784522796fe5dcc89b793613dbbadd79cd731a00447266
SSDEEP 12288:CmqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:CmN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T19A4523643F8E81BFF18605B08CE88178AC0E5F56DF42528F67974E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 460984045a8df0284e12181a7a2b7a2d71f11925844463472d3a3557e826d3ec
MD5 92e5239b1a7d05abce2db143671a2fd4
SHA1 29f2d74c2078d44071f66a79e92bb010604e7068
SHA512 846fa789aef09797e991ff7493fa050482f6d70e61827486bea3a73a2e1822b41aeb0c711eae7f107eb16bee79510fe5408f6f2e0833cc245048419a2f58e6e9
SSDEEP 24576:YZMSzFVSOeN94AMdTEvcQFuOjOP95Xdt5c:YZMSzfC95MdTAcQQfjP+
TLSH
T1CB650294779418F8ECA3813ACC658915D6B27C5A0B60C60F03E4366B5F333E15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d1157c4d6fd9f5d2bc06921897e10738bdfbac9246946e70c8726e9cbfbb2e03
MD5 a3b02230b416cff4ec1c837900ddcf6f
SHA1 9a31a8b9a16b7b0a90b5835388111cb91ee93734
SHA512 579e75656fd5fe9c76b70d06b3bdf24228621f1ec35bbe34c3e4fac98824dbe8035059a881313efa4b26120909ad0ee96cf8574ddb3b5c5a175b8f9579c22a62
SSDEEP 12288:VzqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:VzN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F34523653F8E81BFF18605B08CE48168AC0E5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f6803b5ca81c40e33c9d09e83658ae997b2c1792000e1c470d0c56e80fa5d521
MD5 385d728e2fb35a30330eb3eebc1cd732
SHA1 e631acbadcda0570f8561b6484b18fe7a0ac0e03
SHA512 1ce5b756bfc1cab23c39d730ba03fc73b3dc002061095a1db84837ef17a052ce102f3ab5e9a565bf01ffb572a7fd49d2029330ba8e97ecbc1eac6b201f698aa8
SSDEEP 12288:P/qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:P/N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1514523653F8EC1BFF18605B08CE48168AC0E5F57DF02528F67974E6E8A389D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c2a686c42b561316b307cb22a4f60ee07e2ec6f95e759792c2382380576f79ad
MD5 3dbe7d0195307779bbf82e205c87c532
SHA1 16540aa82d6c30767680be73a274c6bebf8cb6f6
SHA512 9ba9a6a9364f037b9d0d8644c242a5b4965b95a773aa6dfc6292e7213f72263301f83a335b74ab3083870323538820bc67dbb5cf88dfc7e524b3e1e7f54158e2
SSDEEP 12288:PyPz5L8aqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:izyaN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T104550217379930F9E1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 32c7660b0710c8250a1eba21cec5136f4ba4e1ee41c36d6277e53967198fd27f
MD5 7b8fe1e78efa892aa36fcd7f7c2ffdd3
SHA1 a1cdcfb53856c2f299f98ac665ac15d8196b2aef
SHA512 06a43d015f31c53a6380e0181b3d747f474af7c6e076804f2333d484866346828284bec6da07bda8b73032026ad9d17e1243d95e5a88b06701b00e924e522c04
SSDEEP 12288:tzqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:tzN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T11C4523653F8E81BFF18605B08CE88168AC0E5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0ca5e75964e3ebea2c632b3723ac823ec8f2144a1afd189a5d069760f26614d4
MD5 36aeb4664af2603d2caec54f26117b6c
SHA1 046bf253ea0caa1dd8e623308d5dfd307dcc0901
SHA512 a8673f3e209897f8bb4dc982d1fda9f286222dc9623260ff2fdff120a041de13c9766ddbfd47073b0881b38492c7d04e95c96cdb968e5d69f762d57aae9aba21
SSDEEP 12288:XzqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:XzN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1164523643F8E81BFF18605B08CE88168AC0E5F57DF42528F67D74E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5314a6a1a7e8dba18f48439cdf1eb58cab608f8caa5ed826d178b19b732c641b
MD5 a8ead235882a0a7acd1dd10af7360d31
SHA1 944a1d98a58cfabe4831116bac051575b4727a85
SHA512 5ebf5b3b64ee9664f2cef958315780115eda289cc7dcb797c6e5395ce6d2557b8d88ba7821e0c98ecf9058334f4eac4d9175805751c010b4fe25f4bbe8aaa3f9
SSDEEP 12288:HyPz5L8aqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:qzyaN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T16F550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7fd8d6bcd274ef713be926e0933ea4efd37acc8d8da2d3b4f85d7d6123adfe47
MD5 3b6d443a5b61f712790df2142a29651c
SHA1 21a515950de0e8869c929ac01d3fa919c01731b9
SHA512 3c2fbc5681e538e5ba5ce8f35fbd01700e7168711207da1665af8e0f50e0bb7e6ae5915d55ddf86e2bde818d9ec1445c8fd2337a8bd56d79f16f02f83ceb7d04
SSDEEP 24576:2THaLl3z0zDUN94AMdTEvcQFuOjOP95Xdt5c:2T6Lljn95MdTAcQQfjP+
TLSH
T1756502A4739418F8ECA7813ACC658516D6B27C5A0B60C60F03F4366B5F333A15D7DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 37b925e210f98f8ef9d38f04a64d84de8e663b5f74d8964450e3cad4c01a7bcb
MD5 b7319776698ffce6f416dce56e0d2668
SHA1 1dac392dc86fe38d0a0b81af8b5e80e6b8ed9152
SHA512 fdc0049e32537a6097838537484dcb7dcf0306ea5c49084dfba05a08b8d072f4fcb945bb5ba76cbe19da0156b1af32f71731f2eca1a60163f4b775448577151a
SSDEEP 24576:P37d9CHKy7GZIN94AMdTEvcQFuOjOP95Xdt5c:f7d9CHKyaC95MdTAcQQfjP+
TLSH
T12475CF90F7E810E8F0B79A35CD768511DA767C5A5B21DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9ff3c05d46942d789a2eaa7f28e04cee5132915b5f4fd6bf5ec11b5153727b45
MD5 2a01533682b0b367d3aa4ec01ac7e734
SHA1 680e8531287e161559682611265c355be13c33d9
SHA512 0fc972edc6d8561a581c54df14234a6715fab713b59650e8aee39a59464e6630169221c94e29dd3cd69a9ec135ee22deef3eb0003b294311b0a35d27c106638a
SSDEEP 12288:uEqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:uEN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B04523643F8EC1BFF18615B08CE88168AC0E5F579F02528F67D74E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 dbafb913bc5ad6b9cccfa127bb9b3ec357d2c7df056f3d738f657463d02fd4a3
MD5 c677483706ac44d0756dbc2903049a79
SHA1 238abc48d11a56b83b8f09d78fd5bf6cdb3f1135
SHA512 d0b279898085f20c3797143484c4b2faead95007f69cae2e2a48ab447724e1f55860dd4c1e9b1c7ad6612f60a434d1d50c97e096590e02a78f32eef3a26cbb15
SSDEEP 12288:R6qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:R6N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1724523643F8E81BFF19615B09CF88168AC0E5F56DF02528F67D74E2E8A389C2D5E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a4b4b0362c874a4a668b3271d0626c94c04cd5290812174a75c81de3857c5726
MD5 8d76df36141a048c06208eabf750212d
SHA1 7b5ff848ec355122778037a259acc7ebc2988610
SHA512 9ce351e31e15a47632e5f6b4a251014363f874ede1e2a22c464a3482fb1f1ad700023d0e1657108344dd2ebbb91a1dc646f1ca3f30c23ab0c04a2fa4cbff238e
SSDEEP 12288:XJqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:XJN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T14C4523643F8E81BFF18605B08CE48168AC0E5F57DF42528F67D74E6E8A389D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2f677c5561825c670b3f3de1b869741461711912380d3ccdcd49fcc685f1bd63
MD5 549e21d45de401286308e3e751a1f8f2
SHA1 b0343aa06bad7d2115e582a93354beff0ccad4c9
SHA512 bccd9702a28c01595069919b45e6525a7460eac9ec32993ff956eb9ed89a6db6a83906f8f4e88ea42de35ac29544f30b34ab601655701e7c82985fc1c13e61cc
SSDEEP 12288:5zqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:5zN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1034523643F8E81BFF18605B08CE48168AC0E5F57DF42528F67D74E6E8A389D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b7f605454fe7fee0fc07c1aebfd8bde39cd17c169110e4e919c9e05d1c7139d7
MD5 2e6c2d6fdc1e5579daa6a210e12aefba
SHA1 9628ba7d5e67fdc1e9e6359d887b75e2cf9789e6
SHA512 9baf2646b6110194ac7e1a7f7005e4c7c9e299213ad8e2f7f6466f9b08010e456ce56df407aef33d18e51a362135d77816c04fa13a0ef3bdfd16fccf6c8116ac
SSDEEP 12288:vEqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:vEN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1164523643F8EC1BFF18615B08CE481A8AC0E5F579F42528F67D74E2E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f732db25e01c16fd3fe7227a92a99600a00e640418467025d451b89a6f1d672e
MD5 cfc66f20e102360a1c03063988f38035
SHA1 eb1c88390879941b2960829347484896d9e6efa6
SHA512 7d52c8e2849bebe5d530c22b4eba270b95694ad9cc25528bedcb079a35747bb5cfd1acb5cce17f6c916fffa1007d63c1376e6c0bce27e52d070a3587eed44b1b
SSDEEP 12288:ybqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:ybN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1424523643F8E81BFF18605B08CE88178AC0E5F56DF42528F67D74E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 555af121c08a9e20434e82d1801961fe44b57e2f5cc8a67f13199290db53a4f8
MD5 d3afa4456cf8fb08fad3fc0459ac1a24
SHA1 bd727f31407472863121e77ce44c7d132bd62278
SHA512 46cf4c3f982517a52ce6e5e593cebacc278e80bbb24608748d17c93ea1c150f246550979df42b6d3e78177f4a1a34dbac251d3387c51d2c9ce33062c7ed0ad16
SSDEEP 12288:SVqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:SVN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B64523643F8EC1BFF18615B08CE481A8AC0E5F579F02528F67D74E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ed9ede4a8c105882c8d018428228c317c588db3cf21eec4d3548e4911c4b0a29
MD5 4858daf7e0ff0a01bd1dae2b41e64080
SHA1 313e9131550582d0e46fcefb8a998aba942a4aa6
SHA512 4506a97fcdea394ba5d52e0c17730c69fe0690a5c8366b2e5ab1abe1327a0ab36a8130f1c0a86519f677381d05e9b6620987539f814138357fea83dbc29670b4
SSDEEP 24576:hfwvok9RX6wkyAIPN94AMdTEvcQFuOjOP95Xdt5c:HMnYIl95MdTAcQQfjP+
TLSH
T18B85CF29EFDC44E5E1B7923889B7460AF6B178591B31C2CF129A536D0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0e228785ad6ce81c4dcd923c400f5b895a5ac56788b79a6ef890c57c48cb8fce
MD5 26abb0140e214b0677e8e99a9034a865
SHA1 9d9858663cf5a3b0fab182bfe800c165133ed99a
SHA512 ff3be19d91f3594e67b9dad42e18a3409fa97e0ca01aaf4eae4be4723c4a2fd88a25c833821f4d6786812ac20e85331c5b5221cccb0b51198963d9484ea8d83b
SSDEEP 49152:NYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0A95MdTAcQQfjG:NySzPo0xTQWj
TLSH
T14E066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fe6bd9e1eb647a6be6ddec0d91cda1e9c3231543f1e73ddae55e5be036ec06b7
MD5 4a3cfba311a0eb949d9524a7158d4f7b
SHA1 f0d7c9764428839fa2cea4e0846b30203865e453
SHA512 a60e6c0d45f56d419b5e1a3ae51657c2a2976fa64cf4199e2a38e8aaf526fd95cf26320e654071a9bbc2485dfb49617f673e8f42d1dcd635045b69676d2ec1fd
SSDEEP 24576:Z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYuN94AMdTEvcQFuOjOP95Xdt5c:Z47JUQj1irIhCnDHUPfF/w95MdTAcQQq
TLSH
T13D65AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 35b406f573d98af416bd429486ec0e03e8d0459d318b822760fb83deb30ba261
MD5 3a960ae9fc2a9e0c2136f346d03f65bc
SHA1 84b99245b1dfb9b4799cad19d2dc01d01c94c400
SHA512 e4b4e510c7ace861b390f8c2f9329863962e220c15598d1c3ae1baad78e598e354ed89ba144a3be1dc5b1cd0ee927f18733a280c7afa053830c28e42fa0b1cc8
SSDEEP 12288:CNsfjqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:bjN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T13755F119E68842E9D0AE6270CB958640B7277D258BE1D3CF53D0F93E0F366D09EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e22c79ff5807c90fadfa3b468e1e01f373b1de3c160a106d6d827e83c537b5c7
MD5 648a59cab1d9e56eee5ad5c00d679d00
SHA1 e85031425e4ee55acf3a581d7990dc0cf989037d
SHA512 af63072f6185e2070d6aac4bdb7df41f03e9fa8997cd28469e397a6862ff1efa6009b8809e5dd69461f3e03713146f28184d4f26b27862040298a29e50dbff3c
SSDEEP 12288:N07LqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:mLN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1644523253F8D956AF1B616B058E8C1386D0FBF658F0191CFA7824BAE89349C1DEF101E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dabdab3d2abdb3b43cb5dcc10d56429a931acfc0faeab00153bb0dbaee535568
MD5 2a2bafb274b7649c7ddbfe6468a9447e
SHA1 cb52c43426db221e9ee67d8bf77fb7649d5a0c06
SHA512 e36f4b61952d00b565459a1d21464016da990a49bfc3b64b87ef675bb5b71ccea2a7c7947832f5822f5794abb449675b63b7e9cdb6a94a3182999a30913af9c6
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYhN94AMdTEvcQFuOjOP95Xdt5c:1gb4mBIBhGFm95MdTAcQQfjP+
TLSH
T1D1659E1E22EC02F5E0FAD2B89DAA4417D6B278160731D2DF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 da39eb9679b2bac189b7d442f91efd210d8f72cc4c7f996d2d6fd6181da54b5f
MD5 70c596eb18a5053bdb49308ae38f84ab
SHA1 e3a604d5a0c3531bcbc8af96d333238cae135a10
SHA512 9557487f8f05c1a1fe82360cc75fbd5f78b32730c24d461ac88a88a266f4f8e5ccb171fb8bbb46a8527502e4d980510b2046abcae72b8c38579bd0e5b58916c8
SSDEEP 24576:nG88u8FpJqH1bzria7/meN94AMdTEvcQFuOjOP95Xdt5c:G7ZFPqVea7/f95MdTAcQQfjP+
TLSH
T1E385016577E501F1D47BD13889864663FAB2B8210360EBDF07A88B551F23BE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 05e0b0eeb4b18779b0364e1502c5d49c499d06ca6b9a8f7f16f3e01229f4dbb5
MD5 99b1c73a5704eef1d9cfb9e235f7fa25
SHA1 0eed2cb6df3d3a9aaa313eb938184eba49515a01
SHA512 6d212d6802f507892021b999072156a5e31380101453ffbf33deb31a46f117db0c2e4edbbe1db4048baea57bc8c62d3e7498585f386af384317599f6c016c070
SSDEEP 24576:vPUr+NQyN94AMdTEvcQFuOjOP95Xdt5c:vJQC95MdTAcQQfjP+
TLSH
T15B65E12F36DD18E5F676A17C89868219F772B8620712D2CF02E1817E4F27ED4BD39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 eb019fcebbe237ee9272b8e7b6c0881bed36c0b2317c3a237b3fac8b8d04c054
MD5 2afb4801220ee0871cb2896df9f22b6a
SHA1 d58285b0bf71d9157742ada08b1769914f386079
SHA512 b887cdc41cd84a9a545e8b2c72cd58c38b85f3c5518eb2e979906673cd3fa8677af1c52548f210becfb7c2ce3155a9bfe3683940d71bf53d3d9b4e192b920afe
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjS95MdTAcQQfjP+:xG05lO43b90xTQWj
TLSH
T149D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4b17eb23519a7ca58ae83ce6d93f0358ade265beae387a386b466a2314260b19
MD5 88f9faa99110915d366f248e941a2707
SHA1 c6fb4f3f96f3fc528e3871c377825fddc2c959c2
SHA512 f52e5acc88c093931f36affc0ecfaf2fd193616e3d8961755553a4330b32a78e8384ea2010377bd81fe732d450a8693f13f09b201b132571989df998ce013909
SSDEEP 24576:Sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwN94AMdTEvcQFuOjOP95Xdt5c:6a5POZ3+Jt2pasx2+m695MdTAcQQfjP+
TLSH
T15A65AF5EA6EC01D5D5B9D17DC583861AF5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6d286069a9f4f11799651ca1f321ef623b318ed5b3c5574015d8e24885f247b4
MD5 d8a9bd233cdd919d04921202bafb172f
SHA1 50d94e3559dfb42f4453ee7fcd47136ba29951da
SHA512 47aecd28d1e86c5fc7fe393f1c02a7366b4ce015ddbf756716fc5884fda14e37a423b4cbab1811e35ae2a69a6670365c5e5e87b23001322785343d1780a1a388
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkWN94AMdTEvcQFuOjOP95Xdt5c:iNc/zEOVHF/95MdTAcQQfjP+
TLSH
T181857B2623E901E4F1BBE1BE89679546FA71786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 92672e22cba2a4825ed69597cb63be25f1bd66d34a2cae97683536e69a5e5206
MD5 911eea2dec57751a999b3fe147351a4d
SHA1 05b125cfdeff4e2231ab66d2476b0428837a0f99
SHA512 8f661e04724b503c43cd8cc25ec13a5e1c1ffd6e76f441826374cce97f5195441e52660aadecd7f448ece0266100d31d90bfc0c928c809bdd471a61438d0a255
SSDEEP 24576:E8kNvNnaFeYhJNtmZBm8N94AMdTEvcQFuOjOP95Xdt5c:E8MwBtOmE95MdTAcQQfjP+
TLSH
T13355AF6E7AA846E4D1FEC6B4CD238512EA727861073293CB5390C13F4E279D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 91f3a0ca5a622887e8bf60c4096ee282ddbd3467129b9870480700eabf184f8d
MD5 63965ced62a539e9d6917b1b8d6067bb
SHA1 78e6b88ffe7944fabfbe56291f9d856473501460
SHA512 d0c784f73b55a4a9a65a0a0cc12f60a4e9a0467fbf68c09395c78b30905cc81633283334537653d8ba948076239f5e0d76dbe110625cd772fd0bbc4d416934ca
SSDEEP 24576:VD3FHshBIYQgAHN94AMdTEvcQFuOjOP95Xdt5c:VDVHeBIAAt95MdTAcQQfjP+
TLSH
T1BE75E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-57-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1184-63-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1184-200-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1184-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1420-82-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1420-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1420-324-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1420-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1420-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1420-277-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1748-257-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1748-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2016-41-0x0000000001E10000-0x0000000001E70000-memory.dmp

Download

memory/2016-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2016-52-0x0000000001E10000-0x0000000001E70000-memory.dmp

Download

memory/2016-48-0x0000000001E10000-0x0000000001E70000-memory.dmp

Download

memory/2016-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2096-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2096-293-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2096-309-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2096-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2096-101-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2096-95-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3268-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3268-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3268-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3268-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3536-1-0x0000000000C20000-0x0000000000C87000-memory.dmp

Download

memory/3536-6-0x0000000000C20000-0x0000000000C87000-memory.dmp

Download

memory/3536-7-0x0000000000C20000-0x0000000000C87000-memory.dmp

Download

memory/3536-90-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3536-0-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4216-110-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4216-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4216-299-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4216-116-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4292-23-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4292-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4292-22-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4292-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4304-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4304-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4304-31-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4304-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5792-121-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5792-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5792-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5792-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5792-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5892-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5892-69-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5892-75-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5892-228-0x0000000140000000-0x000000014020A000-memory.dmp

Download