6aee7f93e4424f4744311401ded4cd074d6a580acd05b6e428f87790302b8b06

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 5.7MB
Sample260730-wgbbtadb86
SHA256 6aee7f93e4424f4744311401ded4cd074d6a580acd05b6e428f87790302b8b06
MD5 3ad9882a1dd8d95a0b22425bb4a296f4
SHA1 227809d0a6d22ada5f5e4078eef9699469e296d7
SHA512 167815902ba064682ddc5dfdda6551396bdcf44104af93f45899970804a8443d0fdffff65f4562d880fecc62f5317bf56327cce506b82b9dd291c6a3de7d9e43
SSDEEP 98304:/tSuMOINjO91x364DT+Tx4NVMFb/55PU/yOQ0xTQWj:cMJtM9/5Rw00RQk
TLSH
T18156C001BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2660	elevation_service.exe
240	elevation_service.exe
3356	maintenanceservice.exe
2464	OSE.EXE
5048	PerceptionSimulationService.exe
5636	perfhost.exe
5116	ReFsDedupSvc.exe
6000	SensorDataService.exe
4956	ssh-agent.exe
4892	AgentService.exe
2532	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\395224cf83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044c9186a4c20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000472c2fa34c20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021736d694c20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
2660	elevation_service.exe
2660	elevation_service.exe
2660	elevation_service.exe
2660	elevation_service.exe
2660	elevation_service.exe
2660	elevation_service.exe
2660	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeAssignPrimaryTokenPrivilege	4892	AgentService.exe
Token: SeBackupPrivilege	5116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5116	ReFsDedupSvc.exe
Token: 33	2532	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2532	SearchIndexer.exe
Token: SeDebugPrivilege	3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3280	2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	2660	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1756	2532	SearchIndexer.exe	100
PID 2532 wrote to memory of 4780	2532	SearchIndexer.exe	101
PID 2532 wrote to memory of 2436	2532	SearchIndexer.exe	103
PID 2532 wrote to memory of 5220	2532	SearchIndexer.exe	104
PID 2532 wrote to memory of 4092	2532	SearchIndexer.exe	105
PID 2532 wrote to memory of 3084	2532	SearchIndexer.exe	106
PID 2532 wrote to memory of 2316	2532	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_3ad9882a1dd8d95a0b22425bb4a296f4_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:240

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3356

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5636

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6000

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4956

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e73a51c979def022ba9c49f76b5430d6f497859bfabef17267151f49dc99a980
MD5 2410b586cd45f16e517f19ea473d6cf2
SHA1 361a39c858eb6b9b62a0de3ada5b9e3042df0d32
SHA512 0d2aa8125d87b41a0fc3b4bce3c0dd4c0b9145fa28486c7a4166182024829ecb8df5413910c6530dff108ab32205709de34aab9ca2047b0ee5215fff37c1803d
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnH95MdTAcQQfjP+:/3q6HjBG0xTQWj
TLSH
T1D0D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e0aeb6345f8cb88c61810fc3b3817720b541ef46f1f290727d386bdb11eebcc5
MD5 9e124f1825a0a241a3da45326fe43841
SHA1 86a6f03288982185c6221a06b0271c243cb23c66
SHA512 985a52f22b7fe12a91ad4f8f13861743985a1fe6339ac83c3121fe5c55776461c6d43435f862e59e57646d94cc85a7fb9797577cabaa2fbc963b04edf7af28d8
SSDEEP 24576:PXYfDtczAqN94AMdTEvcQFuOjOP95Xdt5c:6tcp95MdTAcQQfjP+
TLSH
T1F865F12877D908F9ED678278CCA18115EA33BC514760E78B03E48A6A1F337D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9bd8474be969539ecd41dcbad12a0f60f71719a80bdfa9c09f7d4a85959e91b1
MD5 4bcfb604c0412434c8b084d4b2af5178
SHA1 ad4a4cd2c011bb97e0071fe4b9c45e2c036bce5c
SHA512 1773bf0436e9729cb049441c4773749d60a6fa6e2e0bcc09f0b1c1ef25d34a6c21f03e8e1260bd03022869140d2cee9dbb9dcfe424947e98338307d30f79ac8e
SSDEEP 24576:t0Le5ji0hmxirMZN94AMdTEvcQFuOjOP95Xdt5c:tPji0AcY95MdTAcQQfjP+
TLSH
T19A859E15F6788335D073C0B9C5D2A69EED7230825B308ACB4286D77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a14435a9fc0c2722cb0e52879f92f7ef0eb5e7ef115f7dbce0aeb70e9b8c1b24
MD5 6b1979a7a38a6c00494c422c7943a856
SHA1 cc61500e15fb22a4a839550f27133f408a3df1e3
SHA512 9b81d1ab28be28a31c1347ab14a51993906d0f36995e9a2746411a0302a7dc90808297867e3da2da472f57ede514d6bd5a4d311a3a8c0b848a79bd43a014595d
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyurN94AMdTEvcQFuOjOP95Xdt5c:m/ezSC6vUzPvxHjys95MdTAcQQfjP+
TLSH
T1BA755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2f85a473ba199a1d85780bdf35d8fbf51e2d88bd7e10d3d6dd8f56174a282be1
MD5 9336a20e3613df54d12f0bb2e3c0c7f4
SHA1 6b47443bd06c4d0112bddf0c16be80fe0ce8c283
SHA512 46e6c3fe00013344441dfc8028128f2e606f0870aee5cf2afcc8810b94cff827a70e5e86cb86cdeda6a61786d601505414af14f314650c001a95bc0a6f6215af
SSDEEP 24576:/VbqPb88hv/l+6+N94AMdTEvcQFuOjOP95Xdt5c:/VO88hXl+z95MdTAcQQfjP+
TLSH
T130559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a795de1128c0462f75ae0593534843e613d0886dab0d96dda9b8fc35613ad37f
MD5 787b0081ef75b21d85dbc3e4693b7a99
SHA1 92bc03e93ccee8c605ab52603293b5da4d62609f
SHA512 c9826118cbd62a220f83967df3034a0129f83775deaba083590022c0fbf1a6fca3a213f47fe556425657ce823590b64039e7ab529d9602f75bc72d578fc6da0a
SSDEEP 12288:NR9qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:NR9N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1964523653F8DD0BAF3D719B05CF880686D0B5F518E41964F53E25FAE89389C2D6E102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 cc423d73fff790c717ca41c184e3a000b19651fe3983bf9d9b15eab6ee182596
MD5 d54a6a9983d59dd857f2c7add8759d1d
SHA1 ed75c000241a1fc262438f29341eec72905b50d9
SHA512 c2e38bdd128020ff58842f7e7a07cc42838344f7d97f3f2fab2ae8af399ffc23cae4438debfb3c7c06cff2ea651182e5aa57b722def1f0c4961612c26633acad
SSDEEP 12288:aeBNUbTVO86U2qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:aJIU2N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T14565CF3BAE28FCE2C27A4DB85A91C240E77278714F52A3CBD165830EDE235E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0e4e4f6080a9990b0f5e8c854c983f0f8ca8874a8205f7873aed7ce37e852ab0
MD5 89a0caee0df24cfa09fa3f0a0e563d60
SHA1 666aebbd29475ada3c80b151b768beb53da1908a
SHA512 b330cbbfa64122f63a96ac206ba406ad7f797263d556d314fa5224bd08c0debe2ee6bcc7ae3f5f795c10414a7aa91da001b513014ad4ca06e3ae05ee3c7ff6aa
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:wQvGAdlCEL8c/yRNw5CJ0xTQWj
TLSH
T1E7266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3a9ca98061bd8e61a8927f0df6cdf4156ea23fdfe7bc3c47c3fe9556976c9a70
MD5 1814f1f2c442135fd4f2684c0e83b955
SHA1 d1a39a88a2a0de4649ba341b4f403d74e728c458
SHA512 d59851b8cb0d8b85ff19a2906f1275d4b9ac5f4b41a30f4e341055944825579f9b7baa599d74228680843a6ecaea0e5815d10e9c102a4c9806e0d8aadfc6c830
SSDEEP 24576:0dewsAjIN94AMdTEvcQFuOjOP95Xdt5c:sljo95MdTAcQQfjP+
TLSH
T19275E031FE74E036C2BB0DB21B75C716582D7A204F511AC3E3E84E9E59342D267B6A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0e6668212916f0754af7364f13086d9684e13298be8dde0d8c7f7ac103e35844
MD5 efa98f5c50ba713644912f873dbd2691
SHA1 f48a8789a60cdd14108cd479f2d7369a4b6b9ad3
SHA512 ee59a860e8f954654d5b90836edce60aff9f04f2bb62644c4eb08735d41dae20c20c097d52020aaa2e54a654cc5e16be348a60606214c8288b99b273c2a15718
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHg0RQk:uUEtQevvqc2W1cpV2EI32g0d
TLSH
T158474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e6157aa2b1ea54d67c00ba44c28d765c0efd6a93f0c28814c91cf43b4eb1bea2
MD5 9b6612c841c5284cd55c914a3c47d638
SHA1 8902b2b453bd4fb61f5e14c3b98fb84da9f52888
SHA512 51d38fa70e25b028ec6b8d54cf6b534f0aa650c9bfaeb10343948494f9893bf3c836b1d1d696754d03b711a96aa723c41afc9ff8a4d9932428de788ecffa83b6
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/zI95MdTAcQQfjP+:woquVjnmt0xTQWj
TLSH
T178D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5d152a39559bed03c10da6fd1fb10bec96bc2677b598c13c4ac1159c2c87a39e
MD5 1a7bec5891b81f6b7af64f051f52d4dc
SHA1 c4b65aaa41b6d37960cad3a6e82c84fac49e7221
SHA512 f9da40e86a0fea9d79cef49bfc2f8052176877986142b506c63734805baf324907d9c0877e139d4553411d8e909b22f70ae7895b9e1cb43e2547780163625acd
SSDEEP 24576:OAhGLJIFoiwtA5l7S53nN94AMdTEvcQFuOjOP95Xdt5c:OAMyFoiq5995MdTAcQQfjP+
TLSH
T1F2359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2250D11F0E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 abefe69e8805ced4d2b646c09ec8c015e34eb13fa48929e9f76196349acadaf4
MD5 93345bed43acd2b18b29ffde80580526
SHA1 4bd8fb151240a030693c6244dbb1a07eca26e754
SHA512 c13f70a6db5f440c5da2e10fd69371aa6b5e950e6511e1cb56027b5470ed444d1ed3439bc6a956d2321e2d380847b5423d091c84062856e8a250848999aa51e8
SSDEEP 12288:nmw5HEjsChNVBFgl0WDm+CLqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:mwuoOW0N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17765F14937990CF9E9A782388597C136FBB2BC022A21D71F17A0C65F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4ae67eb1b57b91388433c62606e03b0d850bb17bc27d7163a543f5332cae326a
MD5 2d44f13db9076f1dda5c8015d4a2705f
SHA1 ecd931d70b72e714d9aaf46f69a80c564090fa6c
SHA512 1c834aca4d81577cf3bb1c18985b93ecba1bcf3e4e9a9c82ac5926f53313c4567b6a2f39f22583a074218a188281490b85b06733c2a96d7665b4ac4b6f2620da
SSDEEP 12288:EBZ1Iy4qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:iZuxN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T12E5512593BD860FAE1A35274CCF48215EB7279525B3243CF13614AAE5F32AC29E75332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2c9c05b2f02a3237147c3d6a058cfe8d261a09d7544bc8943f40f83d091f92c5
MD5 a3910619875b9ce902b353e55c9359b3
SHA1 2216f4e5189d3102a2e90a54bf9b6fd1e981d557
SHA512 444ddc8ce4d5f93f72d38551670bcc53c71bdf04ae7851708010bf653d88df5fe05721249afeff2771fa6a0c2d24cdba49ef0741c7c774a24b3e7acda655cbd0
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U6:zQRQyi36YOcPQLvw2gAf+PN3y0xTQWj
TLSH
T1CA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 289cf6ee0f91b846a075c19463a33c70b9d5f42bed0d5681fa984b4701561c67
MD5 3ab2208db0f32d50de00211dbea4a692
SHA1 94f1accbf8b8fa3367d3d4f73155d7991677341f
SHA512 f13a815e98a9f5b6087a3514105cf45b279d0c7f057eba95f9e20efe8dde3672f647274a7aa863af39d032ae9c3484f02eb5ef5bfd27d422b7536eddfc56689e
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U6:0QRQyi36YOcPQLvw2gAf+PN3y0xTQWj
TLSH
T128667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e68c28b6c5dcc1c9dfe1597d8f9828065316a79cdcd2c41963a530ff913413f9
MD5 9a495a62baa1ebaa37f9cebd03046bbf
SHA1 3316389acc6410b1ce780dcfdaee2a6f304284ab
SHA512 bbc4a6beddcc66828a55e975b8fe50c5fd7da4ea36c6489bbce3f34fd69069a3ee80404c4aca3f643e7e5a428c5e3638a2e2d23b10bd87fd0a4d9043473fec7b
SSDEEP 49152:068Qg55nhheWu7PNU3/Y95MdTAcQQfjP+:ethWRc/Y0xTQWj
TLSH
T183B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 efc7d83525b8010a727ad05bb6dffd146bfa7d6f6e2c0836d55007e1ef2134b1
MD5 12443253069434e26bc843c7f77c69c2
SHA1 7b6cd2c8bd53ce24eab846f2c286227edba73571
SHA512 b5ae74c0d256a079d39f77322d3160243d0175542cf1d0702906b35b194f6f0760a01d9d884a19c091dfe4c0ef13838fdc69a635fc6e50b3d5b6b9550aa2263c
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:gy5112gYy5azzVvL69nLKnhZr0xTQWj
TLSH
T19F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bcd10ecdfcaf838b8bcbbf2247ff937cfac5060110626d299989c670ad689d69
MD5 60394c797b23450dda9bcdb0109cfb0a
SHA1 75c9bff5c1834578df6b3ee54d257f335751b3b6
SHA512 03355863aa9d47c31cfea5b1f4a0a9a2fb62b88806cab82cec568faf7b28c1a25edcc4518089f9961b735798394b6c0cd09b2f8e0118dd16e6c72c05112a5df6
SSDEEP 49152:0B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl695MdTAcQQfjP+:uu6JmVxd2d60xTQWj
TLSH
T16BD59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e942fd4cff63d2b935d1a3f0bca3c2324aca7f3b545d72605c5203bd9b593347
MD5 6153eae6a3c52c473cd6477aa2c63d50
SHA1 7ab901e6a99f6b390f303946661c95c8736e6b0a
SHA512 ccc5adf0dc825621365fe20865aaa0fca8e1159e80c17ad258e24bc1e71e16405d6ccb3390b8108483f5713e826c22f8497e000e81d6ba8fcfbd93ffa969d265
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4x+95MdTAcQQfjP+:VmifPbRt0xTQWj
TLSH
T119B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 765b6696039460291c64203375f211a57449b21b5a751e2642cc1401ad9be265
MD5 5851cfbce17c834c7f449311c9397ada
SHA1 638ed8061607cc74a49b54ed94eb511c93c5f159
SHA512 d61a142833c29ff3428ebbbdab90af1df50de5d007334597e91aa0755d2f6543c63298f6aa342716dcf5114a6e9dfd39eaff8378b0dd9422003d1b9d5c750b9d
SSDEEP 49152:iSuZQIY0Be2KRRVtOnks6NMHqX95MdTAcQQfjP+:85dKTi61X0xTQWj
TLSH
T1DAC5BF13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6f0ecfc39c9b4fd68171c3c6991ecb15c85269e0f7605fa6699f16fcc9e83e43
MD5 a5176dcdeb2cdcba8ee0a3940bc543a4
SHA1 5f5445f1b9a9f5bb9c272fd779577b713fecbcbf
SHA512 8e974f3108534fc0f58f46b3d8b12022bb371fa443079c00ad2ff3c18208a031452c2ee2aa9581ae72933d6b2002371473e0d021b82b71e13ec2353f876a8d75
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wK95MdTAcQQfjP+:PX2iyphB0xTQWj
TLSH
T13495BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6a7db78c9262e303eb8432d14fa1a2a888718a74bc18b9b2d11ed2b288113542
MD5 cda9007c3bf8b710d08da44bfeb3271a
SHA1 6b98ff0476fa78f3f8b312117d9b036d7f410135
SHA512 d86a463e8512751bf9d0c59eb60a5b10e1a41d4850c5267379e4d04457996f8b8fc57114c4e1ba17528d0d646d379d9fa5fe138820c4d91579f20e05dee1e621
SSDEEP 12288:s1qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:s1N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17C4523653F8EC1BFF18615B08CF88168AC0E5F56DF42528F63974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 73a7b71789aaa7fed35bf6096a9b67013cd00f4ac4ef51b0487606d675241d64
MD5 de33ee6303316ea7da87faf5c309c893
SHA1 567eb1a747cc3e84150a68915a0a18e621403fea
SHA512 490aa909be3995a68e1da9cced1fb709516b667aee319d366289dfd8a1d3e73a75d2b077a4f10ddf4857090fb3568d7a7b7843539f6d656605485acd54dea797
SSDEEP 12288:R8qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:R8N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1454523643F8EC1BFF18615B08CE48168AC0E5F579F02528F67D74E6E8A34AD2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 773e5506f888a5f8c2fe13c4247a5b2675744f32047c59645179b98f418bd542
MD5 3ab6aed70437a2d771442c1004d09077
SHA1 ca2821d858ec6cb1e3e0a75c97667bf307e01ea7
SHA512 f6fd153a753cd15bb988a70eb8a4564f55f6c937283822192cc98477ec6827bbf6c4277fb4c4dccbb1e2ebcc79724de803cd7404bbeaa0987ce5f8f7523ec896
SSDEEP 12288:7OqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:7ON94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1204523643F8EC1BFF18615B08CE88168AC0E5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 25200e4b822492a7ad851ad8160c5b170ff86bdc068d7622c6ee01de42afe026
MD5 7f6d727659ac471e9c2dca5ec0ffa87f
SHA1 6d817a708c407f1a5675c50162f93d56215c568f
SHA512 410ecdf30a9e11e2e69f7048272ccf51e2fb0092df6e500960a38f85e02a70c3423f49969dc889563262080938cea27ed187f929ddf37d1bc802802385ca1b85
SSDEEP 12288:WVHqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:QN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1044523553F8E81EAF4A796B0C8F48064ED6ABF929F12938F57410E6E4E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3e8d7218469d203741dc0e53825bc984aeece8414ef2cadddf3a435c7559ea33
MD5 2a6d65f38fd45d9296fe8b6d944b6a4a
SHA1 7d860d2d29664df1751ee06a7ff4266e460ed137
SHA512 887313b27ddbdf0f69041f3d0421ae34c3b940c81026462bf50396e0b857f90ac6cfc33a1967f97322689e7113a7c7702f684db476f9a69314e4fa1b88b3e12f
SSDEEP 12288:FPqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:FPN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1574523643F8EC1BFF18615B08CE48168AC0E5F579F42528F67D74E6E8A34AC2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a3b159b9d43ba637903930852d913f38626cad9c08574bf9cec91ecc84f87028
MD5 420a8ad4933bbb39938d4002133cdd17
SHA1 55042ddba9588aaba9c113f0a1731de107f27554
SHA512 fdfaea10804e9cf009cc2ba7f06ccfe60bf26f56a167a0eab923e2995fa46f4a97e7013ddf524aa2a930343a1340ebf572bb86779281416c8fc2c276afade331
SSDEEP 12288:9AqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:9AN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T18C4523643F8E81BFF18615B08CE48168AC0E5F579F42528F63974E6E8A34AD2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 739dde99f8fde0a09ab3911db76fbec47dcf02ffc119e7433bb2ce58c95eb122
MD5 fd863f927c24530b585d75a16f278f5c
SHA1 36d92178e49a42bec4fa0f0deef1ea2c180498f8
SHA512 32b9e651faf8751880de06de319f1ab970f683e18e7fd71865708508dcfa605da01648e3359e14786e744376794b8062dee0838ffb265dce36d30b0d36a2ec08
SSDEEP 12288:eEqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:eEN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1CB4523643F8E81BFF18605B08CE88178AC0E5F57DF42528F67974E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 55921e8d0c87dedb97eb5539475bf2b2b3483cc7571b5e9dd345f41a5d96fdfe
MD5 a28c33d75004a3d1d1808fdf9edabfae
SHA1 127b7ae42fbd7728a859c453e72aad2a1be240d0
SHA512 23da4c8de227d78066dd64f9904691df03ad7feafaad27d09438d33724fb33dcc252afcd35da27b8c02265ac762c4ddac92229d1c7012e4e0e322c284cd76b79
SSDEEP 24576:3ZMSzFVSOcN94AMdTEvcQFuOjOP95Xdt5c:3ZMSzfA95MdTAcQQfjP+
TLSH
T159650294779418F8ECA3813ACC658915D6B27C1A0B60C60F03E4366B5F333E15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e3d9c1468b9cd25a18e56008b6cf35d9e80cc3bfdb6acbd202a7b82fdae7da27
MD5 f50e10990bd42cd703ea06b19d7011ee
SHA1 69f449929fff068934f391c5fbb492f8cdcaa128
SHA512 58edce2ea8f919207241fdbd1aab19e9921b9f8a49ec30cf64dc113e3748a36e3fc1c10b4f8164aaa034893fbab80d06fbbcc9c990163cf5bedc0ea74bc28b06
SSDEEP 12288:KhqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:KhN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T13E4523653F8EC1BFF18605B08CE88168AC0E5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0f6389d7f20b1274170169a4626de799b63051c725ff1acca3859ceca918d28c
MD5 0dd504179f4bbedf245ffae270694b4e
SHA1 f318a52b1ab57b739b2c9cc59dbc131f13badecd
SHA512 a8a05c30499fb014a5b05fc3d750bcbdc5ab44715e3b2a1fa882e95674ad38d33b74985aa6585faeaa99e9283b7937feb52c88b4a379d0eb48393f6cf0a1390c
SSDEEP 12288:etqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:etN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F44523653F8EC1BFF18605B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 33d03e033ff0a3990366ffd0c065162a2f547d98c45e812049eec06a6006c589
MD5 d871210a7419ab5a49921d1353cecdfa
SHA1 33799f5ac93c2bce3021eefa94617fa30b562dd4
SHA512 9f5f70fb773dff7d5c1bb7e6de12380cb4a2de4806f3597a4eb07ef278e97da3c3b0ffc58d9b6f677333c93915c7bf8414583a430376d949c8e00722bd6a30b2
SSDEEP 12288:CyPz5L84qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:fzy4N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T113550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 dac6321d78747d800e46881314a7bdbb318036a88e28c8d3372b2cd536164f5e
MD5 851bb239b668d3f685d7d68f8e23d246
SHA1 60d67595da33d53c938fbd0e50f01dbb5a6bc08c
SHA512 623de8e4800c33370d2abb43c93daff5de3bfe5a69d40bf25a47e577fe42d6fbbe9d3f1e79b1709fc86b6a9adb6023bcd24ac62b55146b93060c25a7e0a79176
SSDEEP 12288:mhqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:mhN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T16E4523653F8EC1BFF18605B08CE88168AC0E5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 04c28493f6b83786c92a5e5b4b1bbfd3ff5a155fcddbd01e20c48f5517689d29
MD5 7f4da6881893fee289cd1031b71374f7
SHA1 4088fa6984635ac38d7d274a2a4ec7a649653015
SHA512 289e72f7ab292255fd5c5fa084ffb5a1b8b6025f17a9981609c34c90ef9e3d6446417049c45bd48005ea2de4d602410a7f374c085fae34444c7554052d88dbe4
SSDEEP 12288:khqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:khN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1754523653F8E81BFF18605B08CE88168AC0E5F57DF42528F67D74E6D8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 513bb5b984cb2598639c356f0e7717597681daefadc4602a6d34646047acb605
MD5 eb35d6fcfe40348404669489dea79741
SHA1 b66eb55885a21482aedec8c05d9cfc6fcdd469d2
SHA512 fc9b6e8f002647c320680621510980573dd7fc9885564a085275531e206baa6e18c2c26e3b15cea952af0b308d62d3c4e5614871c5e723aed73b5e1bb7c9d569
SSDEEP 12288:MyPz5L84qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:Vzy4N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A5550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b07aec121568ba994b7db6df8d40359fe001010b03ae780e69ab9a4c8162723f
MD5 057e7732d81498810b2424f34eb48763
SHA1 fb1f309efbc3d226a45a8f8541d163390596e4ae
SHA512 1ced6c697822f2c7eea186761c2f89579c8af6006854f9b46c08863fca1fe4caa34c6567a32533ea8a3a590e37396b97d6127f661c6ccd6bf0a716840dd772ea
SSDEEP 24576:qTHaLl3z0zDeN94AMdTEvcQFuOjOP95Xdt5c:qT6Llj595MdTAcQQfjP+
TLSH
T11B6502A4739418F8ECA7813ACC658516D6B27C5A0B60C60F03F4366B5F333A15D7DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0b117bc8beb67792da96e4fa5967d255b49eb87b8d50394b1fd6377040432ac8
MD5 585dd4d6299918bf2f391b5bbe36d039
SHA1 697d41d2040e289abbfe33a5eeba805d1f8a1f25
SHA512 e3d8fdc5223971a3f717c3fac167ce6531e83482025ead878c92801bc3158b497d74ba441baab54a584168c1599adde4f935f0e2f9f2345f8aed4fcebcc259c2
SSDEEP 24576:b37d9CHKy7GZiN94AMdTEvcQFuOjOP95Xdt5c:77d9CHKyaA95MdTAcQQfjP+
TLSH
T17675CF90F7E810E8F0B79A35CD768511DA767C5A1B21DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4fee2a0c153278a41de307b1a7cc020cf7c8f46da7ab335e2f8f6804deea1d42
MD5 c3c5130296c77a3c6525f0247172a9d4
SHA1 fa7b0182f3d0b28c0fd2ffd9bcacc791b20d93d1
SHA512 de8e840e962da13c975df0aa21f884d58fce4a59a77044b8f92404f10ff79176a352283711bc817522a6cdbe9d2cfd07851e1874ebd94af7f7c735cc83737913
SSDEEP 12288:kuqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:kuN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1114523643F8EC1BFF18615B08CE88168AC0E5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fefb473e0a159c6b7dde889acfd9f6d5240506dd8b1a92f3270feb2b912c9b5f
MD5 6eab96ceffdabab6ca2cfabc93d0b110
SHA1 69af1c308a639498d68f4eb9493a33da54ba0526
SHA512 bc1702826abc53fac700e2897575ccdad5468b87f60566c6fa12172b15d42862675264c8db57c2b59ecbc39eddcb203e6b052f309d35dc8b0e4e95525b0b615e
SSDEEP 12288:rYqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:rYN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A34523643F8E81BFF19605B08CF88168AC0A5F56DF42528F67D74E6E8A389C2D5E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b517d769bd9e2c04fd68939bd521ba52b6b7dd56ad965d01ced92a7026a33d6f
MD5 6ca9f9689ff8296523f1caba3cdbfee3
SHA1 14e603d1082f806147145738fd6ffa6b06b9d5ef
SHA512 6fa2d8f2c06f99d2c6cd000c391fb5ed17224a1ff441cc81d77dfcdcedf79ed640e02fa68790ed4fcb1f4c75a030f1db3ac4418aa71c6d78b25429758caac838
SSDEEP 12288:IzqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:IzN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T19D4523653F8EC1BFF18605B08CE88168AC0E5F579F42528F67D74E6D8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b5856bb734aa5d628a4e1991213d348ddb9e3e708fdf103ccd447b2d5cd1daae
MD5 b60ec07c9564bcb9895fe607a6aa21ee
SHA1 b3ef11ea5a1f50eed2171aae183869d087d57e28
SHA512 11ea9829474ac20a38bf69e59c9f2fe8b619d206236dd54e996be56f0c928164f188ee6c012c7a4753de63f41afef7a81bd4c883a10953e9d25a58f102f1ac38
SSDEEP 12288:shqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:shN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1664523653F8EC1BFF18605B08CE88168AC0E5F579F42528F67D74E6D8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9823e6ea0486a0f3d5fb6b9a2b36aa21f83e0e45805dac2518cd51d5edc13f3f
MD5 74ff244c4a1f33e740805393e52ddbb3
SHA1 10e6a1b33a972570e79097cdd3ead7ec0f4c8f95
SHA512 5f47971d52af7ade319bb03886003b7c2518cfb6ee00fe9d5cf95471462818dd8f0ff2843e598c6e3da8d57206c26328694509ae2168152b2fde7f119c4455b1
SSDEEP 12288:kuqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:kuN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D44523643F8EC1BFF18615B08CE88168AC0E5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ce57cc372d32e7dd964395f589e58ee43d1299cf1d3da8b4c224bf5e7ba16cc1
MD5 109e29b387731a998b063890f74ccda6
SHA1 fc3e85ecd2a3595bd60639cbeb00bb4d7c510612
SHA512 fc7c308baeb79a731ff07c2cc46a5a16d05638ca187f9de32e9d6580529cb8d422c86a6de7db46b1ab871b69351ceaf3b2d15261025fd6724580ec5c34785a7d
SSDEEP 12288:IpqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:IpN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1884523643F8E81BFF18645B08CE88178AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d6d9e55994267035815291b197a4cc854163cfe7e8637ed20b1434560bf67ab2
MD5 d9dff326d80262770a7e4ef837c542fe
SHA1 ede7beb858bec9d9c56fc88dbc011ee0aa532874
SHA512 d80870c5117808ed158558d65bf25169f2deabb0f84ca1a9e7a86a5feded25ff25b092a98365d8173322078e5b8185ec6ff99df84f36db47d6ce5d0ca09f7bdf
SSDEEP 12288:1PqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:1PN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F34523643F8EC1BFF18615B08CE48168AC0E5F579F42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6416c63ed71c9564c6cb50e9f1159419e97c46d127b952c720e8381aae927d51
MD5 00fdb31a4da313a713387125c075aa73
SHA1 bdedeebbd2c822efbd3b6a11b74afc37086ae9d9
SHA512 0982bd3f03b3dae1c45bab2c628617aea9b8ff2d3421d81b1e230f01b197c84fbb68f6aaf3e92aab8aa42bf4c04ed6ab83615ffff31576a4c42fe038fb83c510
SSDEEP 24576:ufwvok9RX6wkyAIdN94AMdTEvcQFuOjOP95Xdt5c:yMnYIL95MdTAcQQfjP+
TLSH
T1F485CF29EFDC44E5E1B7923889B7460AF6B178591B31C2CF129A53AD0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d1e81901491b5d9db49779e912f5db2973d33666c003356f528c4b24f28f1a60
MD5 99575ef88c2e72003b6d2ed762cdf685
SHA1 4d1287c2233c1bab2a5ed5c5b15c16dc6c8ccc2b
SHA512 a232230e6b39b2754140d9593cfcb34fa7721bd8b20d4f967b5adbfa35c5cf4ec45ddf0ff7bfc9eff01106676af40d51d7635f3447f2f4d0049d58ccb88a6664
SSDEEP 49152:BYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0q95MdTAcQQfjG:pySzPS0xTQWj
TLSH
T1A1066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 23550d35f46950e18e5aa3f7d8dc882d694a52abd1738baa2ad7d2be61868c7c
MD5 aeca699220afa0c7a8f5ae293e130931
SHA1 3030a6f818727b5b6010f23d67f1d32412c8b67a
SHA512 3a681c48f502b557779dfa9f2fe9d20dc952094e195450f402959ff12a5f65ee8da47171336508315537260fea0db161aaa6244ddf5ff2368a02efaee20fe4e2
SSDEEP 24576:Z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYMN94AMdTEvcQFuOjOP95Xdt5c:Z47JUQj1irIhCnDHUPfF/695MdTAcQQq
TLSH
T16F65AE1DA3EC01E5E1BA927885154A1AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 24719dbf4982c0335484db2962735ab4009f593fce84dc7dc76736e51d4c955e
MD5 7cbd811f38e9ade8a7b9188d6f0744eb
SHA1 fe49b1575ae996597322d7d011fac8d0b795cd53
SHA512 5e50403a239d89567484eb20526d5cef13511bacb4d9813d9dcee3e318bda9ec613b639d88a867abc11e50b8fef49786fee8d8bb3dc41eba1fcff9ec70d6c55d
SSDEEP 12288:jNsfxqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:gxN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T19D55F119E68842E9D0AE6270CB958640F7277D258BE1D3CB53D0F93E0F366D09DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 988KB
SHA256 36226315afa301618bd4fefb82752c78fc4d19efe073eb68930183fc5f1f248b
MD5 bd3770ef92efc5961f4639b477d2991d
SHA1 14e3917f4c279d2251c64bc00ad4d3e03b2a0c21
SHA512 1791f110ab345c1f036d6ebb308c2f2e377865f6da73ef509941f574a205ef58eb368c9485a7a27c813342b0ccb9644d171391b0e96f22ce59d8f0e96e4d8105
SSDEEP 12288:o8qpU3fsi4WgaJwWglGkCB8RLMJFTlmlNrqfsq:o8mUPxfqRLMfpml1qU
TLSH
T1B0250850766AC75FCAAD40321E36D1CCA7707D41EE45AB0372C9873FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 07e0cba329693edbac212fb95b2ea64364b1e017ad43fb5be5a00cbf34cbbdc4
MD5 797d1bd2da4cc24e3dc3c8bf8a63f094
SHA1 35bc44dd8ec99ce27c7a300562d87471d80de03a
SHA512 7c43554c4d3a979bb08963bdb539d524e21355591bc938f8199835f6e10e54595f6f434c9d952e65a36f3eef6dc223870230fbcf1ddfad7d6950dff09d2641b5
SSDEEP 6144:KeVKCl0gF3wHgHfsWgl1Ik09uqIy2F0QNg+s/IXxgNcqjAZtcbVtMx1cbVtMx7KE:LRNegEWglGkJqIbCNcq86wtT
TLSH
T10455E8415537A3CFD1FB7032072A9B4CABA4EC4777456F26B3C8443AD826B25A4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f301e230c08fb81aa31578f32d685e13d5178e21af0f8172904dfb515c71bf15
MD5 3f39c345893e95a05d5de9156f8bb46e
SHA1 2d44234e99bb8364f01d898bd50d423766bc820b
SHA512 7bd017af811456720961e39520de2c67e249d617fc3d89280f76b224183f2b6a9cd1285a030817c7c826fd2b50812cd8a2d9587b64df991da6c0728d227e18eb
SSDEEP 12288:6075qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:75N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1584523253F8D956AF5B616B048E8C1386D0F7F658F0191CFA7824BAE99349C1DEF102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7123dbc8d9e60beb5ab34968a29d46e37615f62ee0a2486a45c5763c17474862
MD5 b01c7b5784c53e819b0f61b4cea01b8f
SHA1 a6888a0f25d39066e8b15f209d789fc5f4e5379e
SHA512 25478ded857292ed8e483890cf306f28b0d267120ee7a3bd2179030925e398d7bdd3d51287e3fb5f24142dca4f841629bf1d3f53cccd47407b8f155a46a52492
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYrN94AMdTEvcQFuOjOP95Xdt5c:jgb4mBIBhGF095MdTAcQQfjP+
TLSH
T145659E1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4ef21e45df7714c7318c32685ccab15fca9bfe988865925bd4abd302b9f5c8fe
MD5 64c5368649c69daaeef2d4a10d87542a
SHA1 9300faca1c547c65a470573714e43eed7c05889a
SHA512 dbcc8aaf245062fe12f02bff3fe719567b4bf1c5d84a6978d25e4716ae348e9ebfb660bedf35aa2a8bc756e8a48f090fb36a08e0da75bbc4b6da9e91be004763
SSDEEP 24576:OG88u8FpJqH1bzria7/mcN94AMdTEvcQFuOjOP95Xdt5c:F7ZFPqVea7/x95MdTAcQQfjP+
TLSH
T1DC85016577E501F1D47BD13889864663FAB2B8210360EBDF07A88B551F23BE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 91628cd79fecd66b172af7fe64e5b3069e1bdb76f2d99ebae5d9ea51a5b6e391
MD5 0cfb7d5ede43ac8fa857b44c9c3589ec
SHA1 27fd3b8ee7a6d10a05061d45122698e6260adf72
SHA512 b5db7ba35bcabfdca985ca5602d2ab2c113c1fbdc729deb1c58ca3b8d87626f893e1d62147dfbd94e307b913c9efe29e6948844559edce8321c225635c36544c
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjw95MdTAcQQfjP+:iG05lO43bD0xTQWj
TLSH
T185D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8e8e00d2bd8dbc0536c6060d19d5c7371263dac0169adbc9d52399e028152af6
MD5 9d6a7e92b3d2868b0596bca06b75201d
SHA1 5350902112e5a692b505d553120a35e1e15c3f52
SHA512 5f69787bc964693dabbc227ba19b56c7e5ef690848d8c4c0b1f88825dcd64f72c2871d651a8eca5579c89bf10b90202914187a86d68a7abc5114fe13b7fda452
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnKN94AMdTEvcQFuOjOP95Xdt5c:Za5POZ3+Jt2pasx2+mY95MdTAcQQfjP+
TLSH
T1E765AF5EA6EC01D5D5B9D17DC583861AF5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 58f39594dc825f77f09d55b780fac0f2c7fee239e2032645c0ecc18b5c3e1b4e
MD5 5210f358cfa8d44d83569cf7ab685005
SHA1 670c19138766022e547c5eeb6e724f890e07bea8
SHA512 e9bf66614aa6005b4750b73834323ad9ae1dd3fb64bc3d9f0e3c7bcd5c486586f66088379b35c025716d256a1ceb508299f328fce3750c5bc8b2d3ab06528b20
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkUN94AMdTEvcQFuOjOP95Xdt5c:INc/zEOVHFR95MdTAcQQfjP+
TLSH
T186857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5a48725e854cf7929869fdeae12be54c3ee137b48d135e5cad3064db2dc71e5f
MD5 8c5f6a53d13e81843084e5116031b924
SHA1 07677aef20528aae961f7c7ba923df975fb5594b
SHA512 1f7abf330ba3360b7d143914899e403748185511882d8cbfad37fd1a1640799654b2d28e843dc1a4fbe592fc28a9d034ed239461196656f7f1c4b13d7c2ed867
SSDEEP 24576:m8kNvNnaFeYhJNtmZBmmN94AMdTEvcQFuOjOP95Xdt5c:m8MwBtOmu95MdTAcQQfjP+
TLSH
T15055AF6E7AA846E4D1FEC6B4CD238512EA727861073293CB5390C13F4E279D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 dc2b8ad4393237606baa449eb49e4dbc5690aa3f07df8dbe8e2b68820193aac7
MD5 976e3976f9ddea769e7f6dd5eb402713
SHA1 f8bebbebbf8bda3b6834252348c59e557ac9ae17
SHA512 95c290b93f11ced4ceec80613693ae35bfa0d8578be85c6159bfca6e397ca1afc96a8ae7e25fb236358b63e41ea68654ec4291253337e975bb156e5252fbcd7f
SSDEEP 24576:APUr+NQwN94AMdTEvcQFuOjOP95Xdt5c:AJQA95MdTAcQQfjP+
TLSH
T1AD65E12F36DD18E5F676A17C89858219F772B8620712D2CF02E1817E4F27ED4BD39A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cdfe97b3b8ee37b63aba11c96d0006ffd9b7077c1cf34017c708e7e2a001a41f
MD5 b986cdb34be875e0023cbc8b3ff83a3a
SHA1 51037706182bec15fa1afafaca59f5f1b2d20546
SHA512 f806464b1e48a2331501d2b46a53b3c086f88072551ad17c03e4a03270f0a01381830c406285cf8e773a15a3f9bc2e6bdb40970285b1d1b2350835f84df7522e
SSDEEP 24576:DD3FHshBIYQgAVN94AMdTEvcQFuOjOP95Xdt5c:DDVHeBIAAT95MdTAcQQfjP+
TLSH
T1B175E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/240-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/240-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/240-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/240-138-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2464-285-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2464-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2464-58-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2464-64-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2532-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2532-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2532-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2532-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2660-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2660-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2660-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2660-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2660-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3280-5-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3280-80-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3280-7-0x0000000000B70000-0x0000000000BD7000-memory.dmp

Download

memory/3280-6-0x0000000000B70000-0x0000000000BD7000-memory.dmp

Download

memory/3280-0-0x0000000000B70000-0x0000000000BD7000-memory.dmp

Download

memory/3356-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3356-43-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/3356-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3356-49-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/3356-53-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4892-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4892-123-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4892-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4892-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4892-129-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4956-117-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4956-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4956-111-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4956-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5048-294-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5048-76-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5048-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5116-85-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5116-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5116-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5116-312-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5116-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5116-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5220-327-0x00000216461B0000-0x000002164637A000-memory.dmp

Download

memory/5636-309-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5636-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6000-286-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6000-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6000-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6000-98-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6000-288-0x0000000140000000-0x00000001401BA000-memory.dmp

Download