387b46e7adb6f6b3976c937cf5ea7d287c9e52696534679f1d8da4eecb7c0279

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 5.7MB
Sample260731-refrasvamh
SHA256 387b46e7adb6f6b3976c937cf5ea7d287c9e52696534679f1d8da4eecb7c0279
MD5 8fcb054d172f589354148766c3c4e9c7
SHA1 ade4e4552f8992427200380c3e21db2cdbfc1ed1
SHA512 d00939e36ffb1fa60264c06d9ea3da1de622ac6ac318353af5f780d5233c53b77da059d6af759571aa5b4f4d969a2aa9bc7cddf17664722a1cfde0754845ed18
SSDEEP 98304:otSuMOINjO91x364DT+Tx4NVMFb/55PU/yOR0xTQWj:7MJtM9/5RwF0RQk
TLSH
T13E56C001BB85C5F1E5D201B0597AAB7A983DBE28573088C7A7D11D2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5376	elevation_service.exe
2600	elevation_service.exe
4444	maintenanceservice.exe
2872	OSE.EXE
2500	PerceptionSimulationService.exe
3060	perfhost.exe
4228	ReFsDedupSvc.exe
4332	SensorDataService.exe
1376	ssh-agent.exe
1136	AgentService.exe
1780	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3b10f3b6238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000098896fcef520dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000030728ccf520dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033ff9fd0f520dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002416400cf620dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb5e68cef520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081bf4f0cf620dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeBackupPrivilege	4228	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4228	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4228	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4228	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4228	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4228	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4228	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4228	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4228	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4228	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1136	AgentService.exe
Token: 33	1780	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeDebugPrivilege	3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	3440	2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeDebugPrivilege	5376	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1200	1780	SearchIndexer.exe	100
PID 1780 wrote to memory of 5080	1780	SearchIndexer.exe	101
PID 1780 wrote to memory of 5192	1780	SearchIndexer.exe	102
PID 1780 wrote to memory of 4312	1780	SearchIndexer.exe	103
PID 1780 wrote to memory of 1180	1780	SearchIndexer.exe	105
PID 1780 wrote to memory of 5768	1780	SearchIndexer.exe	106
PID 1780 wrote to memory of 1620	1780	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_8fcb054d172f589354148766c3c4e9c7_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2600

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4444

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2872

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2500

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3060

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4332

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1376

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d39106060f40104d4678f7f54a7461dc27935a17024022842710e6b498fbb3aa
MD5 7cedad127818ea15e757d0f5c904fd18
SHA1 ca770862d7e5c70d400abd901a3ff0930c9d456d
SHA512 d76ea845e9602a3a6699a0bcd3474a3245d0f3342918957881f1679ad36e323bd1b56245c2c22e21cca8cf65baa694af078f5c0c95af7e9cec40528310d7b4fb
SSDEEP 49152:lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn495MdTAcQQfjP+:73q6HjBB0xTQWj
TLSH
T1A8D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9e22313306472d8ea08f8c226bb55ed5fb1caadb1c97b8c1b55b52ba34c3dc31
MD5 bb40d7ebc0556df021a53c41c7ec1928
SHA1 7f4b0f25be8ef54f6299bced2f0986fe99fc1779
SHA512 2f93a95dd080c497458d515c5e8da037dc8a2eba3cc4de42a82e5f8f8e192ad9d3de4b4b768ca7f36bcb51ebd23bed1beeebaa0ad14b5bf65ab84af4a168d8ce
SSDEEP 24576:LXYfDtczAPN94AMdTEvcQFuOjOP95Xdt5c:OtcO95MdTAcQQfjP+
TLSH
T12D65F12877D508F9EDA78278CCA18115EA33BC514760E78B03E48A6A1F337D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2432f1fc5930ed960824aae2397b7e7e0bb84d7e8ac569a5f4da10c2011e0c40
MD5 80012aecddbac38063d4334dd4c563b8
SHA1 0d20be732ccc92d8ac6491dc453b8f9ce7470fc1
SHA512 21969d2672bf3da87d2d9d9816f96cbaceaad57e4ebc94e020b345ba82962a8efdbc5902fbaaa5d96d506524798f9ecad63f7dd94a91bc409e0e83875f024bdd
SSDEEP 24576:P0Le5ji0hmxirMAN94AMdTEvcQFuOjOP95Xdt5c:PPji0AcX95MdTAcQQfjP+
TLSH
T114859E15F6788335D073C0B9C5D2A69EED7230825B308ACB4286D77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fe65d646361886e5ea56b6b184c107473260dd160a5624dd4e6f08a6c23e4859
MD5 e036dc8a6cbc07ad57598917b9163253
SHA1 0aeb43c8ecdd1490704985df645711f49219bf69
SHA512 d14e093032e14aef426da4f5e8172a5834da35dd447ae74965a4059c89e17b64ff04c49e15613d9653101c2525f7a42c1becfd526a8e6750c660eef240d7564c
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWE6q8wyu2N94AMdTEvcQFuOjOP95Xdt5c:j/ezSC6vUzPvxHjyr95MdTAcQQfjP+
TLSH
T11B755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 81193558c9c58794b1f83200758c16bcad2e5b41ee49015beff2a947f4173938
MD5 743abb7f163b083bb12d797188289b64
SHA1 f9ab85d78b22a35b629787b91d3fc71da8fde20e
SHA512 388aff6c9f7418071729396c17970d5bbd6fd393539314e789e9ebe0bc3535900e64fda3d257f6551b8703c489e8c0e42cc704c7d406e6a27dfa68c8ac3ddb9f
SSDEEP 24576:nVbqPb88hv/l+6zN94AMdTEvcQFuOjOP95Xdt5c:nVO88hXl+k95MdTAcQQfjP+
TLSH
T1FF559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4f4a2714f59509534b62e1dae7274503c14249a1d125bc30b0b5ac56673eb2be
MD5 55ce4f4b4c1d612942817c6c4b1ae718
SHA1 d25cb3e7fb950c0ea4cd0834cebefad7050e3c19
SHA512 d167324553cb95cee514d5d14f1f45359a4e6dcb0a76bb950f27957a5a9513846b6f2995231aa651b66f1c8edf65f4c9aa247da1fad1eda8ac00d3b17986f823
SSDEEP 12288:wRUqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:wRUN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T15A4523653F8DD0BAF3D719B05CF880686D0B9F518E41964F53E25FAE89389C2D6E102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 15cc56b08c2214bbc4af5b2d4b0677e22c0ca2dc19dec02a3579d6d582976293
MD5 211f448705b8a481ec4e61a63db9691f
SHA1 7912b725b1f7f87262810731688a94b78177c24d
SHA512 508156139cce9e7c903f592cac2278256a00b42df04adc3f334fcc9fb05198e1805ccf72c10df71f977ea7f6066f6efeed63154b6760d319f1053f56aa91163d
SSDEEP 12288:4eBNUbTVO86UbqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:4JIUbN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T16265CF3BAE28FCE2C27A5DB85A91C240E77278704F52A3CBD165830EDE235E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0a977d95ebe80255355e9b5089136bd5784cb2d49c121460d88fef7c632856a3
MD5 e3bb2e8287c4e8cbe25a26c48c63c92a
SHA1 82e3bce68607cec9cd1ccdad30e35e78d5d19c15
SHA512 85ef7a70691f6d6bef4969b1d2933165072c553ae4f5aeb6b31a0a47f87d0f0f742430172dfbcc717cacf6df904d58d0a1c9514c405a872b4dd29a29ca72dbac
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:AQvGAdlCEL8c/yRNw5Cu0xTQWj
TLSH
T152266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a119d45a93864f37687f338f6665aa3e89341ea5fb9d410923362629bddd36ef
MD5 70625e33d6121144cd0ed81b6c247296
SHA1 621c3b13b7afd6c94fb4fe2f512460392558ecd4
SHA512 526afa62616006330410d0c4f8573fa5d2d50d0de3696645a40dcf2b036ef8851aa35c02d3b79f47fb9a16641a6fa40265efe27602b11f8d37a2f30bb35e6257
SSDEEP 24576:VdewsAjhN94AMdTEvcQFuOjOP95Xdt5c:bljn95MdTAcQQfjP+
TLSH
T1EC75E031FE75E036C2BB0DB21B75C716182D7A204F511AC3E3E84E9E59342D267B6A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7dfd01bc08e93e74cf1e8a215fae94cfb10443291dac664f158a0b52fb65c0e9
MD5 8464a16d8a01b82ccb2a849e4f739e1e
SHA1 6f60f01eee4be941fbc3e50d4d24889be6b64460
SHA512 67e91cdb19c6b7914a3f4d92008f436f57b7a6a4db48fecf5351ac866d9c037d7d642cbd86e2f32d9210ac63f9299b402b13d50fac9c48e2c9c7d65a0e467358
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHP0RQk:gUEtQevvqc2W1cpV2EI32P0d
TLSH
T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8e337a4d9f9b5645b4f8f019f8f08b4006c1acd7c8c24e0578a96fcf7808e7c3
MD5 1e2b6ea13061c9ee8c983bc2c75c40b8
SHA1 3048e4feeb71e183bca1d09550f39dea4dbe06cb
SHA512 9bbff5c9fe377192c2e241e2d471cef044fe6ca9ca677e39e46281374be404cc47d021abcd3a25bd2781a559aab389903160e36e9d699d03a7e155cda622adc6
SSDEEP 49152:sCbRquA/m2yL5zTfFiV+XenmE3/zH95MdTAcQQfjP+:FoquVjnmy0xTQWj
TLSH
T1DFD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a5b1ca35111b53f42a08d5c86732e0f9992d5e6c57e3cbbe3e66baa12e33c917
MD5 f7a2c48d9e1480f9d7e3baa5c2e14f60
SHA1 6503cae9371f77a4df00820d9bdd8b63791b2bdc
SHA512 76dde9e5b928e0876cff63f4432b9f8e2eeaea400d81a360168f0b4b89ad6c27b320361be6ef41bf08a5be7c4cadd7f9ede8064b7cdca1c7a11184d98c1fde97
SSDEEP 24576:2AhGLJIFoiwtA5l7S53iN94AMdTEvcQFuOjOP95Xdt5c:2AMyFoiq5C95MdTAcQQfjP+
TLSH
T1E3359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2250D11F0E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 57769808ac7e463621ca59bf79c4f885b4447ed8728ac77d48bdd31b74f970de
MD5 7aaba5c27f99489482939208aeadeb13
SHA1 a87e19b10159648a2ee3e12b90d2089c2315eeaf
SHA512 2c2f65c391e22fb6a7a0556be2b11bcdbfd47ad0d9b46df9a38f0646d7495ad68ca3af44484b313fc36cb3b1919fc2e2311a36c4a50b8f89f789db6f6ad8fc2c
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+CWqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:7wuoOWdN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17B65F14537990CF9E9A786388597C136FBB2BC022A21D71F17A0CA5F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 24e673c1824bf1c67110e66590a7491e70fd7b7ad1f6349b010e22f7c91c2575
MD5 7e3e9edc47b0ce5aaf9a22ec8ac7777a
SHA1 47e93211d9fb58675308f210256b02a78349aaa8
SHA512 70832114826757addcb0bef47ebf148d8d3395bbfdcfb6d401c349ddff4bd788f4e0d1fa5720d63bba25f75a4fa3b42b18667718b4f27b64464c27d468b3923b
SSDEEP 12288:xBZ1IyRqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moaS:fZuoN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B45512593BD860FAE1A35278CCF48115EB727D525B3243CF13614AAE5F32AC29E75322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8f7686bbc6abb3d3acb562a66f6b2ed8ba5e78631747fae35f97a7c2d3b5d98a
MD5 fc063a57d2ad3a37a4652cf8c0fdc312
SHA1 f8ca50e00b880e84a44d8b69b0b0977842790ef8
SHA512 3b22c43bc43a15681d930da594b779b952c6049ccd8f1582adfb76ee54c8c629de38115304bdafe848cfc6c2e86bbe3dd869bfe5befe84c957c173a4e457048e
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:GQRQyi36YOcPQLvw2gAf+PN390xTQWj
TLSH
T151667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3eb260a7a963949d2cbe669fc164bd92a404a8dde79394705443f07eae835f15
MD5 fce388b71c4bea0434dddcc2d307c176
SHA1 16ed27be72290be1db1b4b2fb309c5ef9666f4d1
SHA512 9c66356bc83b0daf87929723a2da27767818235f60dabff58c1598954a843f3d608c60a0a33538738ce15a76f25bacf1ff575a42924bbe40da6df56f43c8ac98
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:RQRQyi36YOcPQLvw2gAf+PN390xTQWj
TLSH
T104667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b87c4549e119cee4d53cd98462127dbf123178b1cbc849fa2abadf3644a5e269
MD5 0538f33861be057721e7161df1fd9329
SHA1 31bc647a88a49035330a7c345705615f7656fe16
SHA512 92f49d0aa933f6e8b964038454899528fa52f1613edbc8ea8ec752cac336343931622639f298c998f8dde8743bb5f87931e6c9447d17221f3ff04da65ab575e6
SSDEEP 49152:r68Qg55nhheWu7PNU3/X95MdTAcQQfjP+:1thWRc/X0xTQWj
TLSH
T194B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 61d510698875071f062fb780cf7da79f764fc3573e0356c6cb0b7b929fe76f96
MD5 6cafcb6b2649da491a3ff2656e1f9c45
SHA1 f04f581975ce59aa85eb6369f9ddaa993d449631
SHA512 7280264d1b10355d1139246befafb2b70c7d52e743b09f411bc14fdcf9b9bb7f724adefee547e7aa527b4e419873240aad26422005823f2602608df0772b125d
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Z:Xy5112gYy5azzVvL69nLKnhZs0xTQWj
TLSH
T167167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 021af6ff1541b503224b1635741166ac5c8e14410ec0a86049d25a3b916336e7
MD5 b3b8f546b3637047a5f9ae7760f2c426
SHA1 1ae72f447351a0f48ba7f963684075c95015c97a
SHA512 b802c80b75f53e1bcb7aad3e5c70ae76f4f234e8bcc58da49953041866c590b8e3ab96d7b763b5ef305439bc3bc3c71a024d315868b3709dc529807b8b851a5e
SSDEEP 49152:7B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glV95MdTAcQQfjP+:tu6JmVxd2dV0xTQWj
TLSH
T1CFD59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d4ef521527875cbd86ef6261fc9e63003d1f3f9d965d626d3952d4e410ea0980
MD5 b3f362bd2f373f14143e135640090611
SHA1 128e39ac9230c534a21da32db43277ed03eb3cb7
SHA512 6bf3d86be5e4842d20ad01a1250f3b057294b90f3968881f836a0275c5ee53a8f998b1ffd1c182aa974ec3e03f1a19c69ae48b33f1ea4f5ab86ac9e9f4559278
SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4xp95MdTAcQQfjP+:9mifPbRy0xTQWj
TLSH
T15EB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 eab0b2031cd1799d57283fe23bbcfd55a6b3a2e7fe3c813c1189f7a7069925f5
MD5 d0d0df62e059a131f681fa0fff01fe12
SHA1 228e759df9f7b3e7dd17a51437afc38eeae162cf
SHA512 34a3e81bbeca03917494f0d8decceffe083bb7edabfd676070e85d751c9be44a02e811ce4f86093ef75b733ea6374c6e43133bf37a1656b335d54660bd7c2b06
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqI95MdTAcQQfjP+:H5dKTi61I0xTQWj
TLSH
T1F0C5BF13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3986f9322b6fd08fad1d56bf581cc1da1a5e714aedbd51b83a034535aeb87349
MD5 a1b5bbc4eb4e0b6609f21b9c1110a4bc
SHA1 4eaad3d2c5948381999c057e1ced190c1b92f952
SHA512 3fb3c50aad5e2b0080ae85faa723178b3a90c9c871290a48d408fec8c46556e3fba97fcdeca9b3ba2fabd0234540d31370d96d593971200ee403cc415573cf1a
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wl95MdTAcQQfjP+:PX2iyph20xTQWj
TLSH
T13A95BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ace0965ec34e8052751f12ad177e4e5732d76b5240342e68b271553826c940e8
MD5 b647d2aaaa368cd10cdf6ee67c9b7063
SHA1 97cc8c0123db938a94cb4496ae2cb2b825dbc87a
SHA512 d46bb1d7623ca33a5912d83f80f84106f5f8a98cc6c901ee501d2d4abf44942ff7551122af7652898ad6c8f9ab02a5d0142bf838d772083c1f279a8d17ffc664
SSDEEP 12288:wcqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:wcN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B74523643F8EC1BFF18615B088E48168AC0E5F57DF42528F63974E6E8A35AC2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 54d9954a3103df88d655e68b5df00939203a69f8b7fe555388305dadde87fefc
MD5 799724e6e6f46676023634f740086fd7
SHA1 43e03b0e7031c52bb13ecff4e2442fb5bdde4c65
SHA512 7139c0d87d08d5136164a612bb358b08ab2f9cbaffc44bd09af4e2bbc1e26eacc504298b5e7797605e89add41f93c533482384dac3564f4e9278c95515649eb2
SSDEEP 12288:oVqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:oVN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B54523643F8EC1BFF18615B08CE48068AC0E5F57DF42528F67974E6E8A34AD2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4c880fa76e8c2e57b31af73e8a43ee6570793868d5e50a61d5886a7a4e2d733e
MD5 0d73b277453f219e115d686e491408bd
SHA1 408f0e1937fef7126f849f8c9e7e14a0e52ed6d9
SHA512 9d9cf366d8f8fe6235b47842e79a69ebca74503b6fe8d0525e0635a1beba54652d58484f7e4500c3f7497db82bf76864c098f58d328ec69b03fec8cf9e7375d7
SSDEEP 12288:MDqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:MDN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1434523643F8EC1BFF18615B088E48168AC0E5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 249c3b24513dc3834c517ceca5912f48be6d3cd6326fec8d9e98dc5d475de6a9
MD5 50968f2edcfdcf606518d91dcea5322c
SHA1 73df86bba53faaa2343f77b3d60a1458d911ef52
SHA512 e7d2c639dee8a9c8abde6d50a9ab2d36fbefa6d60fe5d80cdc171b17866600ab24b25d7b5a0c2372ca42095b53a9270e635d7a5562b74593606e611a3eccca7a
SSDEEP 12288:BVCqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:mN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1234523553F8E81EAF49796B0C8F48064ED6ABF929F12938F57420E6E4E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 eed9b137c10c9f51029f79b361d37f461adfd6bbec85c95721ac90c9bd0b3896
MD5 13392d2ec9bd002429da4f3e1692a0cb
SHA1 3d039025ace1d1558a0866488409ad6f5ee8df90
SHA512 ed7c3999862a4051609f63c389dba809e73861d83da1159f91bca60e8406f45587589a8abd6529e8d396c936f3580c888493bcd55afe292d334eef52f36b5191
SSDEEP 12288:s6qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:s6N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1C84523643F8EC1BFF18615B08CE48168AC0E5F579F42528F67D74E6E8A34AC2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6be3cfc49bfdea7a846234087997787aade15ce10dd8f6e1157ad00f8fd6ba76
MD5 bd2e22e6c59ce72347fc24a6f20d0f7d
SHA1 890037ad5032ea3b57b94af6abc635cda58ca5b9
SHA512 28299fcaa5744420cd4cdecad93636c6252ef181a6be54779522750a236307f8c3c06bfcdd2572a7f79ee13c95c80c336862f97ec112ca77de9c779d239b6197
SSDEEP 12288:PpqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:PpN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17C4523643F8EC1BFF18715B08CE48068AC0E5F579F42528F67974E6E8A34AD2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5e9992f1bcb43e11425313a52bfa1bcc4119600eeefb6cbef226dd909a2952f4
MD5 6c759e57f2834cd227426615fb9393b9
SHA1 6112f29ee3ad24651786bf28b8c0bb194fab828c
SHA512 8c24d2574a0b9668f9cfe456cb14bf4c8263e82f33e1b1100fa7c6ad148fa5febb5457c0af1592cae676bb7d2d55517df41a06e9bfae497397a28abad20c08c3
SSDEEP 12288:jtqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:jtN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1CF4523643F8E81BFF18715B08CE88068AC0E5F57DF42528F67974E6E8A349D2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8b109f069b02982046d0ef5fde8eb379e82e5f6cafb9df37998aae59658f380b
MD5 0b207370658c758ea832c1329ae780c4
SHA1 7b1680d07255d78bde5447977d092631790fa4f9
SHA512 c2930b8e29b13abb2b1dfffe04e57219e82b7ca44dc0224f0c00981e1309521f1fc82ae83af604ce593a943f4358656f0655c1d0cc60600ea922b67d7cb26848
SSDEEP 24576:yZMSzFVSO1N94AMdTEvcQFuOjOP95Xdt5c:yZMSzfv95MdTAcQQfjP+
TLSH
T13B650294779418F8ECA3813ACC658915D6B27C5A0B60C60F03E4366B5F333E15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 069ae4770e0903d6f6576d81c215ac6b8dfa9defa30bec58d942f48020d61096
MD5 a91b0228f7c96c27108c8fe998cc4236
SHA1 605130ec802d3d79bed7e91fe5cebeaf36e46ee3
SHA512 8bfc748701e6028e4e69528f0683e6768cb8f41a92b2f39e60654bf2b5be180614eb98f0ca00563cd290af92055275ed5b7120dff0d779f5ab403616d37beb1b
SSDEEP 12288:xYqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:xYN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DD4523643F8EC1BFF18615B08CE88168AC0E5F579F42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6e1a3c22e742a54f930c7514c334252518d0a29f9f50585cf0efe31125063cf8
MD5 677258c8981e98425931c8084bec98db
SHA1 611b7c19a20935b2ac398b2d24abf97a942c14a7
SHA512 17a47c4307aa0c487e0146fb3765d3bcab21653eb02915a6988de4d9ab72955b918e97dae2393f93c4e164b4b0ae70a4d326fd585c7405302ab9289f7a36f3c3
SSDEEP 12288:PEqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:PEN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A84523643F8EC1BFF18615B08CE48168AC0E5F57DF42528F67974E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 8498877970b9d25b0bd4cc488ac1d67d4a40e9896a6646a426c92cfffe8d43ae
MD5 ec8f10ca6ad2843670c68d841fb9788d
SHA1 b5e93ab0ea7c98dee14c0df7b8e2e7a5500dbbf2
SHA512 4878a54715f87a78be1694dff0f0d5daf745a090ffe0dce3a591686d088c3673dc578d923b00d45326469da30410aea18cfe23c3382acff83a85689e721762dd
SSDEEP 12288:QyPz5L8RqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:hzyRN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A7550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f00d2fd65c6de90ac7d16b27d785bfad2b8674646aa653ad90f92c36fee430f7
MD5 a5349d0d72222811f0e821888f76c605
SHA1 9430a3158d323a619076b0d8b85643c2b0604992
SHA512 d34727cd7b4d853076623a84c37ebceddaa1dc9141972d9a417716363c8b57f8d7e00d0528f19d5d84337359b64e934bccd6257d565adfa128fe6ba87905ea96
SSDEEP 12288:+YqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:+YN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1274523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4bb019c9a1655e1ab774c8a23a6d1bd3edb0bf29ddc1fc2770b21d3e0de98a2c
MD5 1db38f2358b881d5c2bc44ff43cade49
SHA1 692b09af697b79bd52c16411c97b906b2cff47ef
SHA512 c079322d4a33e8e6c8ad4f74e7ff8bbd55f571b8918130013c11e05c7391b95664b53b98868e177a84c813634284d6b27fcf693c013d46010f08ae5ff8711bc5
SSDEEP 12288:SYqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:SYN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D64523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b78e989cb859ce603986e1c06c276c0df32cc6e22055e8494e105db502d3fbda
MD5 fab3d3b6fe367731b532ba17a3deca53
SHA1 9d6a8f30298a6b9f39fb9acdf03e072957bac153
SHA512 dbeda7e80baec126ff40507f57bff3335450c658e2d64de8410a6e230b48039a63fa717cb026eda0c12dcf9f042b4e65ccb0d20c2652083c00418f08780ae7ba
SSDEEP 12288:xyPz5L8RqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:gzyRN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T110550217379930FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 14812b86e17a8ad51d37d39a3efbbfca6888a89ec0c65c82c2170b8b03cbdc28
MD5 fa9819720baf758a5fb20898c876ac93
SHA1 3a150f69b29844dce38d9b72eaaf8a777f19fb2d
SHA512 9a935d1c81446d74baeb8d317c31fc7a94f9b40561e8854f0b789b8f18fd5e4cce3b75718ec1c655574f3c2a2e653c85935db2280673e6ecb1e495bb18caf4fd
SSDEEP 24576:jTHaLl3z0zDTN94AMdTEvcQFuOjOP95Xdt5c:jT6Llje95MdTAcQQfjP+
TLSH
T1436502A4739418F8ECA7813ACC658516D6B27C5A0B60C60F03F4366B5F333A15D7DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 026d841df1faf760ff5c5c4e4378bfe9b43db68c79c13ab59d5aeb99a25fd406
MD5 e718329821a73e6c09b7ee41bbe7ee41
SHA1 a7760db7df2dc14f0be23e92afabf5e70ed1b3d7
SHA512 ad691373de73df8dd1c389922109de39729fbdc6569080a479b5caae33baef80ad20d8dbe3ade7f609c38c6f27443a827ac530640ca062ade76eb5742ffa7960
SSDEEP 24576:n37d9CHKy7GZXN94AMdTEvcQFuOjOP95Xdt5c:37d9CHKyav95MdTAcQQfjP+
TLSH
T1A975CF90F7E810E8F0B79A35CD768511DA767C5A1B21DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c858c5731570aaef3fbd69c3e707ec25caa79053e61929371224778fd9d2f2db
MD5 f0749f4fe58bae21ba86785bf7734eb3
SHA1 5a8231f80a57ad0b25b9377c31e3d7d063e30456
SHA512 db2b4a333301001642540f09926bf2c2d45fed4864962bf98165c9d5e1af9ca5ca197a2b2b37afd01ecdef2d801e0769ad9c19c933f56fd487685637de1b5fb7
SSDEEP 12288:NjqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:NjN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1424523643F8EC1BFF18615B08CE88168AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 76167140ee19fda2766469753b5e7327ec394e23fe9234126e48f35a09ea1574
MD5 f44aa5d8888ca71f0b6d56589c081090
SHA1 d3c697cfa7ff7605407d474b328ceec4e4dcb635
SHA512 02f95a008bd7f70205dab1c78860a9d136dc6be86f98438efc33ccb53f200f14880fb93852c19e4d5b2fa8e835c56fb52f71511c7c72fa7a51e0d8c805f5f9f0
SSDEEP 12288:sxqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:sxN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D84523643F8EC1BFF19615B088F48168AC0E5F52DF42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fbbdb695565ac7aa143260f06c158ff1eea837f6ea05e94dce1139f966a1bb79
MD5 6e2bf6e416a813df4613dbff31a68b6c
SHA1 3983f01c91cd7148d87c7cd50f5be170452518f3
SHA512 e76a498229ccb4f550356515a3c0d5346c1aef0dfc5917a4b2c83dc47b3478858d175f0008fe5f70b04af0f1f7891fbd4279263b06159b1f171acacacc830a2a
SSDEEP 12288:6OqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:6ON94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1344523643F8EC1BFF18615B088E48168AC0E5F57DF42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ae98690fd5141a7e451319b34b92b8dbe83bb18da45009737b674476103f554f
MD5 ca0dc2e27a31178b9b9e8d8760ddb65f
SHA1 dc5fd4c8c065c8c735e125ab18be367568a56a96
SHA512 6e151b8b1b3bf57b53ca8cae09e0940d698511056e145b985c11339c80d1d5059e36a1e1a1d40bac7b72ff43d9e781098727cad8f005ddf67913537e4438e225
SSDEEP 12288:TYqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:TYN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D74523643F8EC1BFF18615B088E48168AC0E5F57DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7a4a3cfec4cf10a49b2ced4becc2239cfbdd9e562c53607aa33c6e9c454e6cc8
MD5 9ab48ca59d8a09fcb68f68137b66bf4b
SHA1 7b99a3d043553d263a71a80fea87a2f6c15b4eb0
SHA512 f70ad35d2e0461ea30202bee6642c2a68c7000f3de27f7ac4b5c43593ac8fafea52153a0da7dcb9e764ddd3741c4d905e73fbe329535d9e9d747000caeec86f7
SSDEEP 12288:IjqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:IjN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T13A4523643F8EC1BFF18615B08CE88168AC0E5F579F42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 08248ac664534994d16a661236c2e14692ccc6bc6be6a6eba3548f7522970edf
MD5 3e07056eb970e160e9ad9a77936275ce
SHA1 ba95a11ed8c48c9653a26cc9ad0a5a07561a5754
SHA512 8d2c6f992280cf225b6bbf71384f6811ee6304dbea79ca8fadf3d36086d1046ddd0dc50015cea3a46968028d82e980335ed8bf6e03722115f9c814d3ca7e880b
SSDEEP 12288:2QqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:2QN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T10C4523643F8E81BFF18615B08CE88178AC0E5F57DF42528F67974E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1c07860b54f1284ab7a19fee95e2dc6b40d4b7518e11b251f60cf3ac8fc6bdc5
MD5 2886273f65b4545e388cb87c8a597d41
SHA1 20963480b261cb46f0b7a46fc97c4adae8a68cb4
SHA512 335c65727413421b2dbe1f1663e5457a997943ee157de666bca3e119c411e5e458cdb6cc6c669ede08de7087d0518c36a1fa2ecca3f4842e928044ea01273ce3
SSDEEP 12288:M6qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:M6N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B44523643F8EC1BFF18615B08CE48168AC0E5F579F42528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 0dd8f569b57a7a2fdbde719f9e1d6f60ef7514884b4ae52d27b4e2f9145f321b
MD5 a2bbda0302248baaf07ef44194abcce8
SHA1 c6844f358e1700fc684ba822e44edb5fc96152d0
SHA512 a12c2a6ff8e30659af6b8e4c51c23b393442ab8f2bb3f9fb5ba1f37dd79cfd885773d6261a03f9b27494e84f2faebf0a90c8548af9ee2ffceb89bae0f1364c6a
SSDEEP 24576:Vfwvok9RX6wkyAI0N94AMdTEvcQFuOjOP95Xdt5c:TMnYIM95MdTAcQQfjP+
TLSH
T17485CF29EFDC44E5E1B7923889B7460AF6B178591B31C2CF129A53AD0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 70274eef7a2cfa5d66c8c60c741c7dc53f9185d4c52127cad715546d1b6f5944
MD5 345febf0e6d0855eabd19f789a31328b
SHA1 56ebc5cf7d69727e369a7a41a1f7ddf3dfe82af8
SHA512 505c2190eaa2e38cba537693867b42b13a64bc241494a99f17714718e93371f9b4b2c1f3178ae694f65afb173327712b24f73e39d98e813041209916328c8766
SSDEEP 49152:KYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0F95MdTAcQQfjG:kySzPd0xTQWj
TLSH
T1CD066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5af4ad995f68943e7da4eebe13180c60d340e99751cc7d0550ac67a9fc46fa26
MD5 d9cc8849ae6f4363ec5a740e0cc48f87
SHA1 ba85f66385171218233570847629bf107a64005b
SHA512 321797ceb9a851d67781471c8dbcf8b2784453e3a2936f517600927284ac2d9a31f665c786ade18fd3c24dc1bb796c9b0b58693c647a51abfb47d864146de823
SSDEEP 24576:b47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYlN94AMdTEvcQFuOjOP95Xdt5c:b47JUQj1irIhCnDHUPfF/V95MdTAcQQq
TLSH
T1DB65AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 249204e5426ba0d4c1b2ae15c76b8839394ff0ea52f70e0131fd4ba3719ce488
MD5 88b992c631e0da58f4adef62fe723fc0
SHA1 ed9b6fca57b01f73402fde5e6cb9279339ba577c
SHA512 d7891d3f2b7a2c8f9580624559056686a27dc10995341b0116b7c3c1cc3f9650affe8432b6ccdb955a9d6d4e0ff2349f19d40c7ee2980861456d44063805ce31
SSDEEP 12288:1NsfoqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:KoN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T15355F119E68842E9D0AE6270CB958640B7277D258BE1D3CF53D0F93E0F366D09EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 be7c3124c111884f3a5124c4b9c1994d8a1c69f0b5aec78a207dabf7e075b0fe
MD5 1cecaaeb7db9ee029c12b3f39f558269
SHA1 83550d97b302071919fc7b8be4c9ff79e776b145
SHA512 b4906b184d08f3897919ed136efd756aae50ef948e0838b92c0002e63830a8f9cdae1acdf262be5819274c19f129bca40fdf8ec0645ab9cebf2766e38dec3dec
SSDEEP 12288:YjKdty5Wz1jI15GCsW+wjLPIcYebhOYfsFYT:Y2t7JI4E7IcxbhOCi0
TLSH
T1BC453950762BD75FC6A940325E33D6CCA7707D05EE456B0372C88B3FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 453fb9d5fc09772bf39c61bbee98bdad572459ae0c10751b440d5cf9c654a16d
MD5 5788bfd359fb1cd72cbdc27f532cb92e
SHA1 6b1c07f90e72a3b8415e2d666fa5f57e2072a865
SHA512 a179772bf223f63ab8ad09c44ae8ef180c14890fb9bf873bbcdd534631e7de44dfabd082bf640d01817de6b1abd9b73913d930bd20039f7489920c3fcf9b738e
SSDEEP 12288:Pv478FPeOAi+BO+H56/sBrKXoGetF1E2M72/Nu:4ggM+
TLSH
T18965E8819537A38FD1FA6072033A9B4CA764EC0677056F26B3C8053AD86A725B4FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3226449294f931e345251345f9e8717ab26102389ad20d6d71b2d895109b1139
MD5 f9621216edee562d9cb6cb32547cdea0
SHA1 ecce012a57a268ba6d1fd165ac9ba15f60e862b1
SHA512 86ea151405604905628c0f7176e39f1c015a22b5520ed1ff26c2ec6bf64af22c737a92409ed645c56622dd4cca038280d16963b9ea2a40bd3f14ea7cbfebe2ee
SSDEEP 12288:k07gqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:ZgN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T14A4523253F8DD56AF5B616B058E8C1386D0FBF658F0191CFA7824AAE89349C1DEF101E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 23ec8fce214f181379a3270ca6b368d49cf1ce6f733f28cb2b4a264b97cb2baf
MD5 925610252d763b11530399f2816997ec
SHA1 e5034cdeab981bb326502ffcfde2d28c8fbb4bc5
SHA512 be3c6fd994434a691a52c5888b60924d353599dabc0d11f2ecb0f906595dd056f668929935cfa08cc07f27aaacf33782383b592a9677d13457815183a6ae31fb
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bY2N94AMdTEvcQFuOjOP95Xdt5c:Ygb4mBIBhGFD95MdTAcQQfjP+
TLSH
T108659E1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 fac92c0e4cf209d9971b7f09d67c5cb17fb1a36ec5d8a5ad8eecb0f98d8f6ebc
MD5 0753933251a0965d85ef6b9a0f8b0b19
SHA1 652a07c38791e5d834f707349f36ac6613df1d3d
SHA512 412e8d60773b14e6a7ca43e507d2d4fe8049949eb5ec18b74ed12d0ab27811663995ee475343e38a37bf3b9ab417640ad915dc4738b25421d88feac88448eaa7
SSDEEP 24576:yG88u8FpJqH1bzria7/m1N94AMdTEvcQFuOjOP95Xdt5c:p7ZFPqVea7/m95MdTAcQQfjP+
TLSH
T1D185016577E501F1D47BD13889864663FAB2B8210360EBDF07A88B551F23BE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b753d95d91fff2eea03265e1ebc9a8e24b2e62c9d102743d8487b4ac90969dd9
MD5 faf3dfe639f4048352ebde1280e1af57
SHA1 a45aa98e7a51e5d85addca3b39f567c124cd4ba8
SHA512 51c4fba47ef544e4e906502e2001d9b1648bf0762d78b30a8bbae3bb034aa5da45a08813798befc5ae024a6568be8f9ae58a040d7e1f3485dff7d0deae328f3d
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjf95MdTAcQQfjP+:lG05lO43b00xTQWj
TLSH
T14AD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 07fea46262e9fbb108e8a11ce707505bb34a8565fcdd23c1bae5f88ddfbac180
MD5 7c2b3fbc0bb11ee315f08698272730ea
SHA1 aa4db5145c1d766df46bfbc551afd9e5ee053be0
SHA512 948bd144ee78f499763345186ad2019ed16793b4354751aabf496c83b401d9f26c7478438194b663c9bd1353fd428725363c2ce08e960d583d7cf1183c6905a4
SSDEEP 24576:nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnvN94AMdTEvcQFuOjOP95Xdt5c:fa5POZ3+Jt2pasx2+mX95MdTAcQQfjP+
TLSH
T10465AF5EA6EC01D5D5B9D17DC583861AF5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2f8698a31ea0eebac8487a7fe6aded451449838dd1b79eda2ab88bb01728ee54
MD5 c300b6e1042fbc1ba9476bbe656f1df1
SHA1 0877b5c84bbb268f09306df0b9dad61e59a8338c
SHA512 68b4b5d9d133ed8a9a2bceab4d52447b4281ee055ecbf3d74ad6c7e871c3b070881d7a59461811e99b41b0eacc50d37d82a3b92c37f6757743b19c6009274683
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7Fk9N94AMdTEvcQFuOjOP95Xdt5c:vNc/zEOVHFG95MdTAcQQfjP+
TLSH
T10B857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f58cc3cc31ff189b7599aa17ce584c060ea1294c1823db51ed72681abadddc93
MD5 cd3a0995f3a963336fa251503b4066d2
SHA1 ef701f949aa1993efab48fb73ec45aba23399469
SHA512 3defa29e9fab33cc1c5102a801f6b79a1964699928e763c3ec8954d36131e501f736e119abb1a2e2c83d77e2f2e0cd31f36126a671afa7df6a3fcddffdf66247
SSDEEP 24576:48kNvNnaFeYhJNtmZBmLN94AMdTEvcQFuOjOP95Xdt5c:48MwBtOmZ95MdTAcQQfjP+
TLSH
T12255AF6E7AA846E4D1FAC6B4CD238512EA727861073293CF5390C13F4E279D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f20529dff31ddaa5f0f7cb1f72f2a1b7482e90f6b5260d6ca672fca57c96f89e
MD5 006f53ff47e40b38870966eda0187062
SHA1 81b6b902c3efcfe1dd072624e939912a6c49b64a
SHA512 f0ee2b5bcdb1d253109446d4a2a8cdc7c569fd1d0c4599d2ba8fe69f7bb1f9047fca9d4075599f7d4d52c642f9321b3fdfbc16cca07a9aa4f5de914216078f47
SSDEEP 24576:sPUr+NQZN94AMdTEvcQFuOjOP95Xdt5c:sJQv95MdTAcQQfjP+
TLSH
T1D465E12F36DD18E5F676A17C89868219F772B8620712D2CF02E1817E4F27ED4BD39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3b192cf6252254787a02b0650191b4d799d4bb35f7e191cac2a5aed22f9ef59f
MD5 6da36ce3cd3e155edf4f1c0e954bf9a1
SHA1 2418b41c9666b9f0d2b9eafebe6b9dffb058b41b
SHA512 19f4eca2fdf7247bce868d206a52279922cf5452988084a789528524b3d8ff88df962a543d36c48ba335394b30c71de3d295cb79c2489aad5fcbaf8e45fdcbf6
SSDEEP 24576:iD3FHshBIYQgA8N94AMdTEvcQFuOjOP95Xdt5c:iDVHeBIAAE95MdTAcQQfjP+
TLSH
T17475E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-128-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1136-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1136-122-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1136-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1136-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1376-117-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1376-297-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1376-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1376-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1780-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1780-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1780-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1780-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2500-70-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2500-239-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2500-76-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2500-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2600-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2600-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2600-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2600-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2600-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2872-60-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2872-54-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2872-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2872-207-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3060-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3060-266-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3440-0-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3440-1-0x0000000000E10000-0x0000000000E77000-memory.dmp

Download

memory/3440-6-0x0000000000E10000-0x0000000000E77000-memory.dmp

Download

memory/3440-7-0x0000000000E10000-0x0000000000E77000-memory.dmp

Download

memory/3440-83-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4228-85-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4228-91-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4228-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4228-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4228-323-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4228-278-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4332-97-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4332-103-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4332-285-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4332-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4332-288-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4444-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4444-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4444-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4444-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4444-66-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5376-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5376-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5376-23-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5376-16-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5376-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download