e4351bac3a4b6126e086a13d7b09fae1fc44c1e5d51c1a06c791aaa2fc85d011

Analysis

max time kernel
138s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 5.7MB
Sample260730-va45wacd99
SHA256 e4351bac3a4b6126e086a13d7b09fae1fc44c1e5d51c1a06c791aaa2fc85d011
MD5 ebca8007e6199de5075f8ca43a3d2458
SHA1 1e3659499df09c3f2705c3076133498d152c19d5
SHA512 17e5781808c25cb0a7ab9202fd7491583070831e03271bab6bb02c970c1a35b7d79f550e760ff797b44e66c1c9dc23dedd9dfc5258188ae0bd4b59af5a7cda80
SSDEEP 98304:LtSuMOINjO91x364DT+Tx4NVMFb/55PU/yOa0xTQWj:wMJtM9/5Rw+0RQk
TLSH
T15156C001BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
2864	elevation_service.exe
5716	elevation_service.exe
3240	maintenanceservice.exe
6088	OSE.EXE
3736	PerceptionSimulationService.exe
4124	perfhost.exe
5132	ReFsDedupSvc.exe
5736	SensorDataService.exe
2912	ssh-agent.exe
5964	AgentService.exe
6080	SearchIndexer.exe
3332	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	40	9.9.9.9	3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	\??\PhysicalDrive0	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\773e8075238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000abd374c4320dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005e6094a4320dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000671c024c4320dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000016a544c4320dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000033d774b4320dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
3332	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3332	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3332	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3332	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3332	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
3332	7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeAssignPrimaryTokenPrivilege	5964	AgentService.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: 33	6080	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6080	SearchIndexer.exe
Token: SeDebugPrivilege	3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	2864	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 2364	6080	SearchIndexer.exe	99
PID 6080 wrote to memory of 2780	6080	SearchIndexer.exe	100
PID 6080 wrote to memory of 4148	6080	SearchIndexer.exe	101
PID 6080 wrote to memory of 4944	6080	SearchIndexer.exe	102
PID 6080 wrote to memory of 5552	6080	SearchIndexer.exe	104
PID 3080 wrote to memory of 3332	3080	2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe	105
PID 6080 wrote to memory of 6112	6080	SearchIndexer.exe	106
PID 6080 wrote to memory of 676	6080	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_ebca8007e6199de5075f8ca43a3d2458_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Unexpected DNS network traffic destination
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080
- C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
  "C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe" -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:3332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5716

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4124

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5736

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5964

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:676

C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe
"C:\ProgramData\WPS\Installers\7e8c6075c436bda4a292f681c77d14a9_Personal_Office_i18n_Free.exe.601.1304.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -pinTaskbar -defopenepubebook -compatiblemso -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5BB0AF -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5bab31\
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a4c8388c39fe6f825131f4176ed90c53bc0131d3777bb1f8912eae669afda309
MD5 981567e3cccc44d6ea8becef03190157
SHA1 f7252e019e9e2cd437cecbca69b7747be71e3d82
SHA512 d937c449ea683db49d89f19b763af398c111dff819e9902695c3490713bc945027f6e69a30223ff5474ab84a45c2ba45acf8fbbbae41b85d52214b4caa5f2fe7
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnN95MdTAcQQfjP+:K3q6HjBc0xTQWj
TLSH
T1D6D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8d2ca7781ed3ac3589fd4613e64ec7cc037e0cb62cd70f3e2848f42322b91d6d
MD5 bc451f7c0d7fa77345ed2e0127fdc2ef
SHA1 a398effdfafa75bf208601bcf2b4adfcc8f02aff
SHA512 64c513ddf5bf8e7f3a0a1cd9f9d4cda924155bae2c332f6998183e9b42f63035bed00f5000212db02dfce06963c38e8991249b81412780690648a648082cb5a3
SSDEEP 24576:9XYfDtczAYN94AMdTEvcQFuOjOP95Xdt5c:otc795MdTAcQQfjP+
TLSH
T12A65F12877D508F9ED678278CCA18115EA33BC514760E78B03E48A6A1F337D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 fc3df3549737b835cfdef9a00d32ae456619e3b65334cc2585280e7fd287deb3
MD5 1f1f67a7c6fa4e8c400c0a2188bbc202
SHA1 8b802eb4e83f5cae9900baaeb20bb5628fc0715f
SHA512 0417ad39ebaa069e6ac0fcac12ded1fb2c35e4299126cdbd5062b5a7db5d6be67ec367b127090e257f78dc39b6ac28f2cbdf63634db61d4faf440893995510c7
SSDEEP 24576:e0Le5ji0hmxirMPN94AMdTEvcQFuOjOP95Xdt5c:ePji0Ac695MdTAcQQfjP+
TLSH
T1E2859E15F6788335D073C0B9C5D2A69EED7230825B308ACB4286D77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 be22b7dfdc391116c789361fd84e7179483e4cee27106a0557dc4a1dde60faa5
MD5 99f5a998bf958116b647bc860315b064
SHA1 1b9a60440f866e784b04ef2ac114f2fba11e016b
SHA512 40a355834ec06a70d8f8161f20ecf44b0f9487a0dd4ad2c8bdc2cec9c05cf204e5379a1863be3f5c98b9c52ee25fe015a28cbf998a1ec4dfb96be2717e909037
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyu9N94AMdTEvcQFuOjOP95Xdt5c:V/ezSC6vUzPvxHjym95MdTAcQQfjP+
TLSH
T1D7755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1524b1ef7320e4ff76fa80a4cfe7cfe8390e844612111c47e8c80ddbdef84e53
MD5 692775f371d661f97938d004164c0948
SHA1 b2fd5b7fb0af28603f08a873346c3f5bd7d7b3ed
SHA512 4e8e84750f68f4f92dc5e2231647d502c4ab70b04eec7167f2ac5c7368d10608487a6ca5e9b19dac1492485d3bd8a5bf766b64719f08feaaf880c601181dbefe
SSDEEP 24576:gVbqPb88hv/l+60N94AMdTEvcQFuOjOP95Xdt5c:gVO88hXl+x95MdTAcQQfjP+
TLSH
T196559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2ae3c9ccc57145b22a53e69fc3c2d5a86ed5de70ea32e205bc7a02f405318e2a
MD5 60e59e90ccd69e1e56a25f5ca4d52ec4
SHA1 e40850efd98f5602f1ab51e2de31cd62b061a5d9
SHA512 34b3aaa6b99120c4c883131a7bdd8b19d26780563e619105d56c383c7db972b4319adb9710d5c4480e9ca5170c7566a51a26aae9c4f47258556feebc76c95bf0
SSDEEP 12288:yRrqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:yRrN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T18A4523653F8DD0BAF3D719B05CF880686D0B9F518E41964F53D25FAE89389C2D6E102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ddedb50eb4259c09aa43a0966f06638257d7b087d65824d382e28a5b0587d36a
MD5 e3d6d473c95445c782d630f07ffa5b62
SHA1 5fe1764e919c0c49d9cec98a35f30e55471e9dd0
SHA512 bcd1c38a06223e9dea7e93453664a429fadb39976358b27797ce9f957dc18ebc933a23ab70bcada9c97fe90243c293b9035b9e8ac0db663375b06ee721d7c598
SSDEEP 12288:FeBNUbTVO86UcqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:FJIUcN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T18965C03BAE28FCE2C27A5DB85A91C240E77278704F52A3CBD165830EDE235E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d8fa99c820d407afddbbd18a4dca86e91d56b4bce70ae3bca06d84a1694269d3
MD5 77bb157fdcd48e741d09da8f7c642eda
SHA1 8ae767f25030be7123b4406461e37f2ef130c96b
SHA512 98360002701b419e0e7bd364395ad2f55a721194d77d727b103799fc920becdd7153cea27569290b8ac599a22db34f3e061def0de8cdfb43753748a9a2538cb3
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:2QvGAdlCEL8c/yRNw5Cb0xTQWj
TLSH
T1D9266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0b47c8cca84da509c3810cec5210219de25a0e8a28d1c0301bc96c17ae0998ec
MD5 8545ce2953350f72c304b9b9db35ecf1
SHA1 35a7a814a856f9a8eeb2398c8032f5541dec33cb
SHA512 c11444a18fee998363361330635b099afa4219eb8ba629d5ff56c8a6bbbb163c6756f94e120623686b0842a614c8003300f2fa43e25373a7fa3380206456175b
SSDEEP 24576:edewsAjKN94AMdTEvcQFuOjOP95Xdt5c:Wljq95MdTAcQQfjP+
TLSH
T18975E031FE75E036C2BB0DB21B75C716182D7A204F511AC3E3E88E9E59342D267B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 786b9c0ce4063a0a3f2c88fb926774acf883429de96c804258a322cd3ffed44e
MD5 fbaa5258e6591bb64665e42061c88d83
SHA1 780243640d41a01c881d58661c41d2426de7dfa8
SHA512 951d2feffdadba6c3ab3643abfc48a1387f19d32f8d32a7b758279f188b2feb9aaae4c8cf2c425a83cdf6a41e32058d144219d46a0228b8cf4519cae3474592d
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHS0RQk:0UEtQevvqc2W1cpV2EI32S0d
TLSH
T158474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 392fa397a50511866f5a4712b21dcb8bee86916ffd9355b0332b55b13044bb36
MD5 e6ce0752f9dd42da67b4de5d876eb13d
SHA1 d406807eb5d967a5da39e0fdef132d9afefcadb3
SHA512 a6a27531e3deb5d39e367178f90f391a6307a0ea152bea65019d90b87dca9c913b3cde97e5145f43f8b2e5c48a5a0801eb62ecbb25dcfba1cbb85383a99d88c2
SSDEEP 49152:ACbRquA/m2yL5zTfFiV+XenmE3/zK95MdTAcQQfjP+:JoquVjnm30xTQWj
TLSH
T1B8D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5f090f3718df8bb84df530969f0e6c0a642729e96c9ddaeca2b2c176fdb64452
MD5 924765cf33120963f9bb53b707089aee
SHA1 732313b0af873b747d3b8a9553a09ddd89a0dad6
SHA512 8632f65cab502f1be9fa8c5938711e71e9f47074e04792185b0685c22d97c01f6ca36e7e06a0915e926e3aa2dcf9aefcac13af3651a4036cef5eb680bc0138d1
SSDEEP 24576:lAhGLJIFoiwtA5l7S53xN94AMdTEvcQFuOjOP95Xdt5c:lAMyFoiq5n95MdTAcQQfjP+
TLSH
T163359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2150D11F0E33E809D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 42b70c8425251b922c3ae128fe245de0564809db7e6526ca9ed656de99ec1b32
MD5 bee5f67cc558e2cca5d129f0162199c8
SHA1 8820b8acc4e371bbb3e6aca392e324ca9a6471cd
SHA512 3e8141ff3cf214a796a6c063a3a7d305bc8704a525dd6e36da6c59d77845aa8647f1c2b0c3de908f5566d7bffa6303eee6e46ed88ddef3e2866881e068ab9b73
SSDEEP 12288:Kmw5HEjsChNVBFgl0WDm+CdqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:DwuoOWON94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F565F14937990CF9E9A786388597C136FBB2BC022A21D71F17A0C65F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ad75191e4d5ff032d026ea1b56cbb9199bca424239962b9f109ef65414bd2b18
MD5 c23e3c59b486adbb8a4a4e37fa469906
SHA1 d2d088facc7bf9a8b7dfb992ba523cc51cc56174
SHA512 6ef2bcb8c7ca6f715215932f424cef7c5a414f5e604c1b401281e9c52bd2bb0731e83affc4b0d5d8addf507653c8735f70ddd04855fa4e07c9599db4a720ab57
SSDEEP 12288:8BZ1IyaqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:KZu3N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1525512593BD860FAE1A35278CCF48115EB727D525B3243CF13614AAE5F32AC29E75322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f0a52b13f2f3b6a3c294747a320df5e3531e8007bee608915a55a4bde2aaa38d
MD5 04cd87dfe04ebbc4e64744e774b956f0
SHA1 3604120de46fc169e3cc2f1697eaaaec5a29c795
SHA512 bb8d741245d0c071cad2ba8aa724621ef755236ebf7160b7599088c9fc65a2878ddf89c9b150c51a077524bdb68632140ddd36315229ff099febd7bd293fc163
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:sQRQyi36YOcPQLvw2gAf+PN3w0xTQWj
TLSH
T189667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1ff41332bf86046f4e9e3415947fb88639f6a254a184491225038c6dd57bcf48
MD5 a857938c333080e037078227ac117f04
SHA1 c635b463d1e3adfc1dba3f01c8abedcb62d28e9c
SHA512 68ed4924639154ac4946943e8c5c08d46c34b1a9b5628438c93891cfb94e0025542f386a2867460acdc833a55c4c193423482963412e3eac168d83bf32689cc2
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:EQRQyi36YOcPQLvw2gAf+PN3w0xTQWj
TLSH
T12A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 595cb919e72b5c81e39829bb45217c9f952a6690b35d697c44d11dea19cbcced
MD5 025c0dfea5782091bddbd12b545a2f45
SHA1 1ce49201ea00a959fb4751db474857912f8c1bff
SHA512 f03afffdc8b530c9ca6fe0c07958d417d5763fea45f70efdd65edfb73c0344fab6437656c49c490d206f23848c7b0320b95b19334705af70f34bc96b291559ba
SSDEEP 49152:F68Qg55nhheWu7PNU3/695MdTAcQQfjP+:TthWRc/60xTQWj
TLSH
T1CBB55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7d94f13cad28ae0d9a41479ebdddc181cb03221812647659d2d5f8d7b2dc4c3c
MD5 dc4e17dc4dc22c39cb632558c6bee80c
SHA1 d556a45a5f007ef24b611dd76134d5e3e89a19ae
SHA512 61a054a3a8f33c3d0e68b034ddffb3b58e52ef859b97a094cc0cc2331201fb228ace14903ead4f275c9f8f6977600b0927faa1557b08a88bf76a4790ea7fa381
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99a:ly5112gYy5azzVvL69nLKnhZ50xTQWj
TLSH
T1F1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2a39c521d156e9de8fd4f15ebc5a5cce477aee285e2824ac8195638afad24458
MD5 f03fb24b4a6ca403f24c4bb41b9f0618
SHA1 f94b29def827e485f40c2de7b820f7875ed4224f
SHA512 713e699ccab2a5530ba05ce96e1ca0ff57fdf11a3c144037b14359ec3820f2f2275e0f601cf965dee8ccb799fa7dc307036a38cbbee8426abfe605c9961f13f0
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glo95MdTAcQQfjP+:Nu6JmVxd2do0xTQWj
TLSH
T1C3D59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 156a43b7641c276679d05d5a9eae02c5efa85c32a3fa2deb07c3a6c2f7e8de7a
MD5 95cba220d69c434eaa212c7f9ab0c61c
SHA1 cafcaa87defc5b7dd2a8906417ea09990c715c8c
SHA512 789a2a2046df580906846f3155a3a9cae87fb055b4d67ee024ec72d746f6d245d2b4c88915d539395670ca74e041355d03526a42078c5cc34978baa8b598bc37
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xE95MdTAcQQfjP+:kmifPbR30xTQWj
TLSH
T19CB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1dad1d6d86e464a7bfdf9c110aaf421eaaa6f7a219d0a349a5815ac06814a7a2
MD5 b64a3fc74a8933dc74ef3f3704b7ca14
SHA1 7f45a87f3b8ba77711ce9197625c4c8346db721a
SHA512 23587f22c29a34e97d730031883d762767714d0dd89bce45a1773aa5a9cf0c7c1ab9124b41eccc35f7e999f8f31f985a4cf369e157c5f7bcfa32dcf5dc884fd5
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHq995MdTAcQQfjP+:H5dKTi6190xTQWj
TLSH
T18EC5BF13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 147ff8605d9559c6c13afdab46f3372ff6bccecd105d06408f4a3e55333d65c7
MD5 c59c32d49bac87a818438d064d268a38
SHA1 5f0b970caf29615bae7c331f8f822e3309471e92
SHA512 13c07ee1b00fba853103ba43e0aeaccfd35720f61b9ca0d5f780e748f3632f25fdb72231a313c7b79a606ed85ca09a30964a5f293d682e8a56fdc5d0a457819b
SSDEEP 49152:QhtSn8EApI0figngiDn0AP5wY95MdTAcQQfjP+:BX2iyphj0xTQWj
TLSH
T14D95BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f490e2652230503839569aee56ec04071829a5343e8cf3692947959e58d21db9
MD5 1a0a601d5c98ea064e4ad4c769f0d0e0
SHA1 6598136984ff86578ccc3b757552df18be26905c
SHA512 534b4dc14810fa36e434fa7c37d4ff1fa4d288a56a9a64bcae0fc79b7cdd723a7f7796d43ec2c86edeac8bb9df31792a96a142385095a6bb320d82c072c38dfb
SSDEEP 12288:ITqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:ITN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1784523643F8EC1BFF18615B08CF88168AC0E5F56DF42528F63974E6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fbd4817bf842efa478a34fcf85a34f4e5e78fb55d2f27f02cf1ed6ac2382f850
MD5 5f31750e9517bbe09b89618d5f359673
SHA1 5fb6939558493056a903ae801fbe2996c7979cd3
SHA512 b5b1c66a1a014da23ef9875a68f39de5da480363dc444f581a47e3799c4eaf5f482f0a641e2c1f42c3e5a34355cdf03afa6d534805008680fdc21e4ea58f60b7
SSDEEP 12288:aGqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:aGN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17D4523643F8EC1BFF18615B08CF88168AC0E5F57DF02528F67964E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9a2083d17300a5318f78485ee13d01bd2e0145cd1f4be7937a14f0892a8146b4
MD5 964312c0dd5df8788df3e042eb69927f
SHA1 7c5f6448d25cccf8ba3961942492d5cb4d006d5d
SHA512 e2403d945e7e37d92ac9922ade5b806c0b8034a88c775c176da29fadfddadc7b008672a10a2ab2fe84b9e60b29d9765e33f9240ac18452d327a35398a00b627f
SSDEEP 12288:KkqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:KkN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1024523643F8EC1BFF18615B088F88168AC0A5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c5873ab1376742d4c71226b84813126c9e0bca03b0c803d9b4ce49066fbde56b
MD5 3444dfc1d5f93c25ce9b1c38fdd9e979
SHA1 4e6c85b4f4a9b912f63a20068fbd5f4aae902a2e
SHA512 6a241127c83c90cff0f28980cdeeeecbccc3a551a8a5c5ab65c56fd3f57ddceea15e4058a90c33f3b073c1b41a561e5438cb8dcec7009695902644fea8604914
SSDEEP 12288:zVRqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:fN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1634523553F8E81EAF49796B0C8F48068ED6ABF929F12938F57410E6E4E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 878464718ef127a6d57718a0a0269edd4d6957c6e43d2b6ff4114754a3d0dfef
MD5 a1ba44a21f85ff4bb888cf2b1c75679e
SHA1 2fb9a2263fed2decef2c8fedd43db30105cc19a3
SHA512 6ba99a2d2382b9a08b2c64bf684a0b96b540686a7e69b5d8eb6ebd32731ca13fb86523559bf14a10af053135ad912945348185e681ac553204ebfaccb96fcc46
SSDEEP 12288:dJqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:dJN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1794523643F8EC1BFF18615B08CE48168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b33da722425121859deaee84da08dfbe7292000cb0e17771d6d9b2621f9fdc7b
MD5 100b18d8fb7a03f0ac55f1836c99c1b9
SHA1 674f68bcfae3c471f792dac6524abcaca057bd84
SHA512 e93ac16289736800deb24c21e36ec1181a85500835ed3fd3eec06f42d4386135a5dc8a75d169e26c9fe15b702cf2d54c1b52f5e6e64ed126311f1391b38d6967
SSDEEP 12288:9yqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:9yN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1954523643F8EC1BFF18615B08CF48168AC0E5F57DF02528F67964E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 81c52cef6a8688bb29fad98b0b5fd781b3a2dd4b470319e768b4c6e07f568b9e
MD5 3df4c6d20aba67ea265443465fd51d12
SHA1 7d979268b93629457936b985d4ccc6b107852ee1
SHA512 0936cd9945d09e6d663d8df0b4ac3f9b196817d931744d5500523d322ee19804ebf183b6ebe4c9213fc5262d56cc403ace736943bf371a9457ef194acd2fc901
SSDEEP 12288:W+qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:W+N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1524523643F8EC1BFF18605B088E48178AC0E5F57DF42928F67974E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a1d32300ace97fa99a770e76467f46b60aa09af0419cd78186811d7399b0d33f
MD5 bf518a9198cf8a5a7481f34512ee6f27
SHA1 1771e67b40a905f436113cdc5c66e2b4ca3cab1d
SHA512 c0949b4188d2ab3a76f2ec5eb1a3ed020bbaa595fc33b0508a8a4ad307a7ada8944c6601e906a56ea2fd3c67d4ea29676bfca38f79d83c9b6e64ac022ed79954
SSDEEP 24576:kZMSzFVSOmN94AMdTEvcQFuOjOP95Xdt5c:kZMSzfy95MdTAcQQfjP+
TLSH
T1CA650294779418F8ECA3813ACC658915D6B27C5A0B60C60F03E4366B5F333E15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 733eb784c9dbaa2354d2105851a39f7add4499cdb51e429e6c86ead823936340
MD5 7c71ae5317bdc16ee7e4af405cb46848
SHA1 c618e6f34888d747def87429d52572be723bbff9
SHA512 1d665f88def8d6c5c8a9bf45c10ca8d9eb2bd9fcd369a2f58c6d932e41c34afd9ed9b52468c774ced80261c8182f21a9beaaf833c76c069f6bb5d01e8fc26773
SSDEEP 12288:tHqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:tHN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T16B4523653F8EC1BFF18605B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e5bd565356b93c7454c5e974864ce673d63e6dfbfebdcbc5abfa7d88486dc8b3
MD5 e5433764f9098b19f5638736873ae682
SHA1 7736d1d01b2a6e09d43459de71ee4c17c4404547
SHA512 5dcb953d4c50805a35edc4d65c8e0c797583ae5e34a6dd415b0ab8cbaa54f1c845a12ff3d632752167256553dd0afa188fa4a880dc88deafc7b144cad384a29b
SSDEEP 12288:k7qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:k7N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1FA4523653F8EC1BFF18605B08CE48168AC0E5F57DF42528F67974E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 066795028ab7667e8f938f82919df497f3c30d58bb032131ea5bd2c9516f936a
MD5 4fdeaedd790369d352bb4c762699cbc9
SHA1 8f124f9526198dd4317a67b453ad568043e59d69
SHA512 574f1ae92d1a6199894e3ce4943e979416fcd037e3b4d288f22315205fe09a53672627ad02beab14320da50408cc2113b8521fda8fdbd39e840d87d9fae3602d
SSDEEP 12288:ZyPz5L8aqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:YzyaN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B4550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 53c8775b7866cc1c126ab28cb522812904c740e0eac81cc0a6205cd7a61ba36c
MD5 d8573804c2be78f65d90b1f29d57afcf
SHA1 534904f66ba2905996bc581112f3a309ad5503eb
SHA512 b22b70644e3e5e7733d64268f82837b4c62e2cae104f726db2f00f572625aac4c0b7754b00d6c81aac34918beb3416b253db3011a043627dcf6fc3480852b692
SSDEEP 12288:eHqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:eHN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1434523653F8EC1BFF18605B08CE48168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6661d8a18e9ed5302ecd02bdf77185ae657e37adb4469136ad5904b29116317c
MD5 563cac1186008a8386c1d1b27e674de1
SHA1 9b8915e32d0a0feab9d596d8dcd9e8c8c4596567
SHA512 ac7dacf220ee031185abc2fca35cdd983a225bed6cfe34dac774a9f5b574f5ced493c1ff5b6482b3548698dbefc7b27cf8c9ce6643786f71813251052164827c
SSDEEP 12288:HHqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:HHN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T12C4523653F8EC1BFF18605B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4f774bafe68b4306b927d0970c0b177606d3ac33c907ba8a50c6826eb2a04d47
MD5 4a4655044344e85e812cf60e5929019a
SHA1 5f40a56e650f8c7367da96cf2b0d9bb60054d837
SHA512 5a85daa108be13689eb7fab2f8568590d8b9a937e2063e19f2b4f73d3317a7a947ae7b45d7803998628b0dcf6c2ef9b6ce316e60e8ebe8e882ca694122b5b266
SSDEEP 12288:YyPz5L8aqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:5zyaN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17A550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c970426e9df31e289fed64547840151bb8e26f9085bf83cf6c1e547c45b9c67f
MD5 74f3e3925d28c35784801b6f871435a5
SHA1 75894ca7a757e854310f48b359035413fb43fc8c
SHA512 ede24be2911d0ee7dae046f586c8d2fa4afedb17340434a8e191331482f8201ac77c33930eda80a37ebdb2749899b3b6e66e4745e9baad752bec2ec5cc170be7
SSDEEP 24576:tTHaLl3z0zDUN94AMdTEvcQFuOjOP95Xdt5c:tT6Lljr95MdTAcQQfjP+
TLSH
T1176502A4739418F8ECA7813ACC658516D6B27C5A0B60C60F03F4366B5F333A15D7DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 741a0ee650f22118af78bed2ad6e1b3aa287d9bd1eed8a7710abcd8356223cbc
MD5 40fa0090c76efbffd69b6c1cead2d268
SHA1 a9632ef51cbcd00c67b5b0a53634b6897dd3da8e
SHA512 4938fc0b3a19c97eb117180529b148f6746e3c3331fc88bca18c264639db008cc11b2716d9ee5294f8e1592c25425b80efc1f88751ab6da080cdc71b177b3864
SSDEEP 24576:c37d9CHKy7GZgN94AMdTEvcQFuOjOP95Xdt5c:G7d9CHKyay95MdTAcQQfjP+
TLSH
T18275CF90F7E810E8F0B79A35CD768511DA767C5A5B21DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ee539d1ba57fcd9b3df55f49d0f8ad639cde88a8ce8b87d2a86e7c93511e953e
MD5 1497e5efd5a1ec031a4f4db6b4925df6
SHA1 1a10de92ca25e2e66cb45ee3b1e42df30e02b3a8
SHA512 01bb40c84de60ceac3be0d665af551de7d59c372f525599c7b5b5efc257c376be6fb7764b9b08063b579bd900667339389b0d8e9225d6b232238f573caef864e
SSDEEP 12288:LEqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:LEN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1E84523643F8EC1BFF18615B088E88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5c917b89d9bcc663c1b57496f2ad7ff5138fe4dcfcb5d47b3c17512073ed1f23
MD5 c966822473cf53b42c8e895ac0a54e6b
SHA1 50940fe508d64c600c797a28a6ec6d9549711c8c
SHA512 bffad541e35d17e742d5c360477089760d19150084ad905328c36c87b0c9ace614a1e76e36211ddcc3c73a948e772d525f9c0ec1c8bfc0b770dc4bba7a181a31
SSDEEP 12288:v6qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:v6N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B44523643F8EC1BFF19615B088F88168AC0E5F56DF02528F67D74E6E8A389C2C5E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 78fd4a791b4d2f778a0bf673288773d088610591f3a48673fb96c7509c34473a
MD5 6c2b01025796018ef723f246da8cf595
SHA1 97b161d2223cddce70f6d81c77a94f8fda8ecaf2
SHA512 866d94270c8f9a7ac6d2c17b4eb8b9a5485a8f92556f17cefd9c7047abf38962ae0c0614f716ec934eda38c8c13963cf8daa4e831a03b52c005cf0cc11a833c7
SSDEEP 12288:YVqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:YVN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T11C4523653F8EC1BFF18615B088E48168AC0E5F47DF42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a60a34127f3e9a8d6b0b878b30d8305b88b202c625e48815b2f9fa2ecb14674d
MD5 0e509df06c306ef1286dceeb51bf8eb1
SHA1 3db84b6ac2916bc5ffdb02c0e732490f7f3bb106
SHA512 446ab93287cbab2e3a8491138c291291d1785c9a118ad6ed715bd282163e15f14f85310f4e9236cc82eba3f525d15c7eee60d63379b9bb5b54848895844b69e9
SSDEEP 12288:cHqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:cHN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1054523643F8EC1BFF18605B08CE48168AC0E5F57DF42528F67974E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d8907cff3d041bc8c7f20ae1b4720bf788150506c9d545e0bd411773fc4e09ee
MD5 06d1c563d92b119e3e6826ba4ed95adc
SHA1 e3e790f1301bcad8437e0d4c947f6faaa9d14bf1
SHA512 55e625ca1dadcd7cdfee69d90fedeb99c90c7f03cd28de678519bc47d8ffdd9f34439857dd75194b9a58e037deb86638852242c97c163041ac6a2c626fbb48a3
SSDEEP 12288:7EqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:7EN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F44523643F8EC1BFF18615B08CE481A8AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 25820ec573b2974c7545b63e210e8bb2f32b79fecaa677e162637a7c23a49617
MD5 df7de823f61373291c014b95da1b9de9
SHA1 396b83f2cec9f2c580edb77dc5b992eca0f5d984
SHA512 a0d4e2d9675ae20bb4396950d43e79d3bb186ffeee6eccb566df8721fccbc8595a430d352aafc787d6a462681614217ddf30dc4f6f90a8747067797853af48d2
SSDEEP 12288:h/qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:h/N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10E4523643F8E81BFF18655F08CE88178AC0E5F56DF42528F67974E6E8A349C2C6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 85813c7807b20687073c64d61435e7f61317c4d4990eba36cf7575f1a114540f
MD5 2a9626857bfb061d83823dad2f854afe
SHA1 e15a33f81c827a8fb5cdee59a4f12904e74d7e9f
SHA512 822965b7f476059e17138d8358d7cbb43e4837047e9e5ac12cdc3f3e29f719bf076bf8031539c482070bd1db324f2264eef80c9c6ee1a94a748b83bfc3e4b33c
SSDEEP 12288:AJqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:AJN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1904523643F8EC1BFF18615B088E48168AC0E5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 57892c30503c4020b33b35d0a8d719881c38397095ebd4fe5e7671d3f4eddbe5
MD5 89edc7e0b4cb1aec3e37b2ed199f38d1
SHA1 97fb45f532815fddc1df4bbed0c3cb2f46c58947
SHA512 66f0c67008035f53aa5c35952cb73fa65080861ec2029f5b7b92b88c2c0a275f23660162533b1a957fbf7f3467f21d9f0676f5dc4fb06f6527eb01e1ea9b8b3d
SSDEEP 24576:bfwvok9RX6wkyAILN94AMdTEvcQFuOjOP95Xdt5c:9MnYIZ95MdTAcQQfjP+
TLSH
T13485CF29EFDC44E5E1B7923889B7460AF6B178591B31C2CF129A53AD0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7a8c457a2fbf05334fa95e46220cf17b96f7b1e7918a061aad0238d2541b052d
MD5 60e91ec026443805326592e7f6e3e869
SHA1 edf4d7f88f1feec901308cb7f247b0ce3e708caa
SHA512 31e32d1f521e057c852994c03dd295f82141518e3dc5015c3e9cb8e9fc47988e022935d7cb85f274919c765b038c63f7ab8e641d14f62f50abf9fb7664b99933
SSDEEP 49152:2YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0495MdTAcQQfjG:oySzPQ0xTQWj
TLSH
T1C0066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4e93f4eb7ba6ef7e5c2e659f873ceaa3c9cc02ea64226ca5d2c5e66b9a51ddef
MD5 455b3c23fa568729d5449bb8d2eeed67
SHA1 3ddbf2e81f85fec45417a294bf47fbb42ef28451
SHA512 7414576d55e9a0e1126e7525a070338f743cd0662670055c0e41231c394e7306f99ceefb09afc307ac090168e2d21539dad0b3bb5d9cf9fce17c54ca86065ee5
SSDEEP 24576:W47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY2N94AMdTEvcQFuOjOP95Xdt5c:W47JUQj1irIhCnDHUPfF/o95MdTAcQQq
TLSH
T1E665AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 fa1133983b3cdb527be24230116c072f7477ea2fb01b4047584dd6ed5cf298fe
MD5 d8a9be47e7117e4e5b18b814eac5adb4
SHA1 f19e99fde2bea296044200872c5742d1a2fd1c60
SHA512 de8a6c8f0b4a7060b688ca838005dc78c55c93203a93af63ce983a4d4c9b76b426f843ed7ec77c9a6ac4a7be86fe1840906f82e3c22b7404b698b66548e43f81
SSDEEP 12288:XNsf3qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:U3N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10C55F119E68842E9D0AE6270CB958640B7277D258BE1D3CF53D0F93E0F366D09DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.ini

Path C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.1.0.28032\office6\addons\karticlewebcloudsummary\mui\dist\run.ini
Size 171B
SHA256 3ab7bb6175885fc6acbf5eed0062b0d00c059cb4c68bd2ef90149b2c8763e658
MD5 b30cb271e143eace0f55ea2e562e1e9f
SHA1 9d97dbf24931cfc114384c3f4dbbae21c9e51be5
SHA512 dc593185fa63b458024c3a913c558e5686806154181dea67eec786ada50595c53bab822833ad1e76c9acdf21be3eba50631391b7e575d7f1f6409ceccf966535
TLSH
T1AAC080D4D0256F97DC31C6B5ED54AF1A7560E700251C1EC3D530DC4E9E9696551C805D
MD5 SHA1 SHA512 TLSH

Submit Download

Qt5CoreKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5bab31\CONTROL\office6\Qt5CoreKso.dll
Size 5.7MB
SHA256 d76ce35aa1a6d2d9ee025bbb2e8743c401039cd4161058dc4f379588057a5b94
MD5 16c3e81f3e45df75d11e28cb07b001c3
SHA1 d4d46eec649ececc72466873d2bb6bbbc4c515c4
SHA512 f7bd1025a66f168f14034726da7bf7369c8c34e53ded56327dbf1ee1a0ef87627910d255487b2ea5ee9e3098a769e367f2e43783b3d7d3aa7223a4300cbda562
SSDEEP 98304:FkAb4j8eO36Z5AKJsv6tWKFdu9C6iPl4rVsca4:Fkg4j8eg6ZZJsv6tWKFdu9C6xVsca4
TLSH
T16C567C47FA964269D8B6C238C9D7C127F673B80247214BDF2258A3496A737F0293F359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5GuiKso.dll

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5bab31\CONTROL\office6\Qt5GuiKso.dll
Size 6.4MB
SHA256 c3a2de3161f7cc03dccd2c375cb10aeda109069c13689c105ba161f39c2a35d4
MD5 569c0bed6125720be6793d7facabb2f0
SHA1 d3ec78f7c465d00544fa2e21b345afb2d60cbb2d
SHA512 755abb42e1c7f1427c55938a611c8e1f8c73c228ae390b4c7f5d252804f06c46e466de30ce948a75670c8e4b7e605339fd41ca346aa2451ece42993259f006df
SSDEEP 49152:8dwe5wpMO4YOd3vBY5atKJmv+X8YXTJTyCIyCjIzjuwIomuyox3GREHckZFUT6YR:Kwe5W4LhPWfr2uyoZGGdBJ4P
TLSH
T11166F886EA556359C972D17987CB042FE1F37C4283524BC36C45AB490E237EA1B7FE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5bab31\CONTROL\pl_PL\style.xml
Size 3KB
SHA256 183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384
MD5 034f37e6536c1430d55f64168b7e9f05
SHA1 dd08c0ef0d086dfbe59797990a74dab14fc850e2
SHA512 0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0
TLSH
T1E381CA80A610BD0AC563F51573AB7509762CB36383ECCFC4F0EE2E698753652644B63E
MD5 SHA1 SHA512 TLSH

Submit Download

product_new.dat

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5bab31\CONTROL\product_new.dat
Size 83KB
SHA256 53a97ea8fd5bde7018db62835a7aaf4ec5689e175224e7cdb18bf070357de113
MD5 b58e647aabdee999ac048482ce15ff98
SHA1 4c8d0c481563b187cf00d1de36ae65ce6b2b7cb5
SHA512 b885fd8be8f72caf0eef8d4439b234035c1e71eefa5b69efe7adba2943de872c0bfce1cf06e06a41e3b8de6f776e07da283f75974171e34e6442176ed79355e0
SSDEEP 1536:I3CcyHhFmk6ebivjsUd1YXpFgnkJWvxh3/hICzQgKBVkeUzEy7n:2GHDW1ITZKkEh5zPKBtc
TLSH
T17E832C18ECE16EAD685052791D376D8227B7DD9160DD30AC4B12AA4CFC3CF887F72A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.xml

Path C:\Users\Admin\AppData\Local\Temp\wps\~e5bab31\CONTROL\vi_VN\style.xml
Size 4KB
SHA256 0f95b878d7afb96e1ab1372b61b83b3c51c0aaad4c2c5af0ffe894845fe020b6
MD5 394488b30107bcebb84a97ed5d754cee
SHA1 69ebe17f7d577e9bf69c87cff45c3251f0bbc86e
SHA512 24a6bc7debbf7030c1261c69cb4ae7bf3cbb5c7fac315188163c6001e58dfbe2e634925cb767044da7ea0e6d08c709b2ade02f6e43930819e1bef6f7569cad5a
SSDEEP 96:gd6SmSZcFe9gSs8TcySCSi58VS5eQJ/gQkgQ0/Mw8CclQgYzdr/PwiCSeDeR3ciw:gdAh8Ax
TLSH
T13FA17780A610BD0AC563A51977AB7909B62C736383ECCFC4F0EE3E658753692644B63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempinstall.ini

Path C:\Users\Admin\AppData\Local\tempinstall.ini
Size 387B
SHA256 d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2
MD5 c38481658f9149eba0b9b8fcbcb16708
SHA1 f16a40af74c0a04a331f7833251e3958d033d4da
SHA512 8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce
TLSH
T1D4E09B1BA8D1B0ABDEB302E988979D54BAC03D9A066D23147762540D3D32918FB41D65
MD5 SHA1 SHA512 TLSH

Submit Download

wpssetup.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log
Size 10KB
SHA256 ada1fb4df4a5d58bf4c514963d13f54182aedc5c9bbcc1ce7cb53d707840d4ea
MD5 e42d221527c922806cd5702d084cac3d
SHA1 7e24f0a751bed045ac6f31287d26f903738ee746
SHA512 9737ee4dcae53e39b9a2229e5f99ebca0d3f9134fb5e55f89df21dd8aeb3b0247abe526c7243b6267e12df1861e21f6f72db6c641fc27ca50351be6fd87f49fe
SSDEEP 96:9AHQblADCUe6HHdKB5sSNPfqUONJr60/14UZBoMMtcK4FSVvO7VMCMtx6rBf4:9jBBPqLHTk4N4
TLSH
T11F228AB740BF095C477E0F7963A18D882BAA1DE8374564A83F37DE924FCF410829E55A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8693f0e465d0338278b11ecb56cde809d66cc3961473c3574e2622e2d018713d
MD5 5e526071cf32cde2edcfe34f664ecb1b
SHA1 61165fed9719dde78e91c75e9cb238e6870b2ea3
SHA512 ddd4203fb9923d35a6f7b40a38091fcdffb1544bd9bb2201b8fda2f9e488d19f670d29b2dc08adb80ac2cb727178ce3f2dceaf3930e015d167df1a258f7cef31
SSDEEP 12288:707vqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:wvN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1954523253F8DD56AF5B616B058E8C1386D0FBF658F0191CFA7824AAE89349C1DEF101E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8890fd2354bdecae4f47f5434321c2e50cef0a69ba6ab288d636a218835a4258
MD5 02c90c3c7976a9552bee3d21ab50f96e
SHA1 272b57444d8bb481e2b5717a43d2cc2f26a7b3f9
SHA512 afb5f9566b76557c98629e3ee9129908552d4deade33eb9fe4d4b79cd8e7fe7f1d7c7ac52f19b483f34803173531b96a0dbd2f2a63b5546fb1790d5ef53ce9ad
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bY9N94AMdTEvcQFuOjOP95Xdt5c:Bgb4mBIBhGFe95MdTAcQQfjP+
TLSH
T102659E1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9b1272130c9120b7ecd9490054323f19610b4ee22d497ac04b8b8ea63313d6cc
MD5 2d0f91d20ac3aefca1c821dce8a60b5f
SHA1 aee53555c694628ca05fd61462e92c01587caa72
SHA512 110a36615f8ce33abfba7a516367472afbe2df8b755e3e1eb3c185562b2a155d3fb2294e58fc92f08b45439b4e5adead15f21810d5661dd6bdd3cccc67dd59c8
SSDEEP 24576:sG88u8FpJqH1bzria7/mmN94AMdTEvcQFuOjOP95Xdt5c:P7ZFPqVea7/z95MdTAcQQfjP+
TLSH
T11285016577E501F1D47BD13889864663FAB2B8210360EBDF07A88B551F23AE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 570788213cbe12948fda4c72b36d3b38e4cb9b38343fb7fba9c80e3caedde5c1
MD5 e3b1df7d353e22996918df56a29ba009
SHA1 7dbdd37df073a498e957822ca044384758d6c1c5
SHA512 8d15731519334a9385e5c5493e7fc0c8e7e5cbb1e6614492f18a725d68a3a225a1e295763d3b2c2d3fc0912c8d46534b3687321ade5212d4e8656c7ae783205e
SSDEEP 24576:rPUr+NQCN94AMdTEvcQFuOjOP95Xdt5c:rJQy95MdTAcQQfjP+
TLSH
T1DB65E12F36DD18E5F676A17C89868219F772B8620712D2CF02E1817E4F27ED4BD39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 95700e4e0e308a4def1ffdb2e37622e1881817756bd7bbefe60b0017df89a272
MD5 f733714d54a4c2cb25f133d07e187622
SHA1 8f5e9371fe1e6a47f83e3bd0f13af619d9f97090
SHA512 7e800dde6738b9ba6b32309bc57207de2cad137ba7af188d919d671950c204421c0ab369c579fb0d1f9daf4f0af1735241e8a8e0ddb294b7ecabda12524a00e5
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjC95MdTAcQQfjP+:yG05lO43bh0xTQWj
TLSH
T172D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ce05aca158da9d77e3651702f92eb8e5b6e6a071bf1550ccf66a8c072cb902c6
MD5 7f63ddea922c4e10ca32a0a3878b4b75
SHA1 591476c462f3efb7ddc9a0075797d06a2d4f658e
SHA512 028c94adc8c7090766fa5127fa1cd03e192150d5659978b7ed4a2415a5211f90df9e16c18a385fac06672288d9270b8891697e8f3c05ccbc68d944d77fb3137f
SSDEEP 24576:qfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn4N94AMdTEvcQFuOjOP95Xdt5c:ia5POZ3+Jt2pasx2+m695MdTAcQQfjP+
TLSH
T1F265AF5EA6EC01D5D5B9D17DC583861AF5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 71056ee053a1e1dd673beee7a8bc412d04a122045e772ddf22d129f1baed946c
MD5 03be3f31210ff90293317b1ca26da2a0
SHA1 3c35b10d4ea188c4d83bb3c44b53f03862cfc91f
SHA512 c9bd108340fd1256aefcf19d775461c33d57d460989b092de7675eb8cf01f055d1730cde13a4a2fb605a9d20bb4fd0691a9ef048ea3b517561d3988e4f413043
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkuN94AMdTEvcQFuOjOP95Xdt5c:5Nc/zEOVHFT95MdTAcQQfjP+
TLSH
T17C857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 205a845bbb706123965052ba4b360eef8f08829313dfcc3ca9ce71bf996183c6
MD5 b55c20c763420846a62aa105118020a4
SHA1 473cff81f7415602ac6d45aa0f9ecdeee5c4fdce
SHA512 d4590a950b6b8811ed44c224f225582e437a9e13090f2b0b1971caa18202bc4bb8949aa86ce32ae2b00832b14c83d2db1eee276385fa9212cc1805d8234e37a3
SSDEEP 24576:V8kNvNnaFeYhJNtmZBmsN94AMdTEvcQFuOjOP95Xdt5c:V8MwBtOmU95MdTAcQQfjP+
TLSH
T1A255AF6E7AA846E4D1FAC6B4CD238512EA727861073293CF5390C13F4E279D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6ced383b8aaf4a86a8f8af93ef6f61c74c6664a716cf34762e5c2ee547867d98
MD5 6a8c15ea306df31e88847fe365365559
SHA1 6b8fb872ecc3a00818d2bb971fdb8ae8edae56d7
SHA512 c7ae1bc6068c176ca37bbecc7feca85c9a6b2d9df12c3e8ad73deb1ef335c1e5ae9dc9ae319ba186a128e01af42515a657fbc1c4d086f5cdd4bbec2c45d4a48d
SSDEEP 24576:tD3FHshBIYQgAzN94AMdTEvcQFuOjOP95Xdt5c:tDVHeBIAAR95MdTAcQQfjP+
TLSH
T11D75E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2864-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2864-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2864-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2864-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2912-297-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2912-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2912-117-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2912-111-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3080-80-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3080-7-0x0000000000C20000-0x0000000000C87000-memory.dmp

Download

memory/3080-6-0x0000000000C20000-0x0000000000C87000-memory.dmp

Download

memory/3080-0-0x0000000000C20000-0x0000000000C87000-memory.dmp

Download

memory/3080-5-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3240-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3240-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3240-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3240-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3240-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3332-843-0x00007FFDE68F0000-0x00007FFDE6E7E000-memory.dmp

Download

memory/3736-211-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3736-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3736-76-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4124-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4124-241-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5132-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-91-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5132-85-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5132-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-267-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-323-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5716-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5716-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5716-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5716-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5736-280-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5736-278-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5736-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5736-97-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5736-103-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5964-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5964-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5964-130-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5964-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5964-124-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6080-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6080-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6080-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6080-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6088-64-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/6088-58-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/6088-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6088-187-0x0000000140000000-0x000000014020E000-memory.dmp

Download