8e620a54c673911dc895515d8dcf9dde8f4feb8b93396caac245e2a089e6c211

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Size 2.8MB
Sample261003-2s5mpaydnf
SHA256 8e620a54c673911dc895515d8dcf9dde8f4feb8b93396caac245e2a089e6c211
MD5 facad586ac8a8acbfd758e7482e0fc62
SHA1 95f8f39299e330d14708359e6054d46d49ecbd4c
SHA512 be991a20bb330128a047a64695c25445665afab04d0dfa8676aee0a8e9e6ef7249fc7f44847042f0645503bc069799c2e19974c132c3cc90573d33d86ca22967
SSDEEP 49152:aLU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/o+QY8cdH0y8:aLU/jIEeQfoR/IuOFVjUu5cY8WUl
TLSH
T1CBD5AE12BAD58432F1B316319DB8C2695674B8A6873685EFB3CC561E4F309C1CA32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
2904	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
3520	alg.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
2128	fxssvc.exe
5740	elevation_service.exe
5408	elevation_service.exe
4036	maintenanceservice.exe
1620	msdtc.exe
5860	OSE.EXE
2884	PerceptionSimulationService.exe
556	perfhost.exe
4880	locator.exe
5468	SensorDataService.exe
3892	snmptrap.exe
4836	spectrum.exe
4812	ssh-agent.exe
6104	TieringEngineService.exe
212	AgentService.exe
3532	vds.exe
3052	vssvc.exe
5452	wbengine.exe
3144	WmiApSrv.exe
4336	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d7b29334227ba850.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b385d4d08953dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077a098d38953dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005437e5d08953dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcdab2d38953dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d563bcd38953dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2f6ecd28953dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbbfeed08953dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000294bd9d08953dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeAuditPrivilege	2128	fxssvc.exe
Token: SeRestorePrivilege	6104	TieringEngineService.exe
Token: SeManageVolumePrivilege	6104	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	212	AgentService.exe
Token: SeBackupPrivilege	3052	vssvc.exe
Token: SeRestorePrivilege	3052	vssvc.exe
Token: SeAuditPrivilege	3052	vssvc.exe
Token: SeBackupPrivilege	5452	wbengine.exe
Token: SeRestorePrivilege	5452	wbengine.exe
Token: SeSecurityPrivilege	5452	wbengine.exe
Token: 33	4336	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeDebugPrivilege	4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4524	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2904	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
2904	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 2904	4620	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe	87
PID 4336 wrote to memory of 212	4336	SearchIndexer.exe	114
PID 4336 wrote to memory of 5016	4336	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Users\Admin\AppData\Local\Temp\jds240683953.tmp\2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\jds240683953.tmp\2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2904

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3520

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:6028

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4036

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5860

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:556

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5468

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3892

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1468

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5452

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3144

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:212
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 929bbbc84762846f45c907f68ac99ce2ed8944da2d8f3c30015373e222fc3ef7
MD5 cc78d71ff58e60331a2fa67f0549085d
SHA1 dc1f485e6455c3f39a4b21777f954ffaface3273
SHA512 ee08dfa3765051803768db9a2c32fa069a45ee1070eaac032d38cefb4a195defbdad03a9c189195e0cb71c7c437dcf9534df8d1a309dae4bd1045fdcba46f141
SSDEEP 49152:Ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnd+QY8cdH0y8:Q3q6mjBQY8WUl
TLSH
T18FD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 df4409d22ca6ec868af8c9064cacaf6501b65da1a356e1197c3a794ef174b527
MD5 26ae93fc9980a4607c836e2386d28a4b
SHA1 55f0918eaad9bc73dc6e29e8c799570fbb6fa6bb
SHA512 f3423a767d0a13d86acc78b34e9e49339057406e559b7c8aae5ef0eb086d04a32b778fa2e706ed51d6fe521575b9dc45bd7dd5f597cb427e9971307b8b7b32d8
SSDEEP 12288:61XLsswWkxy2lRq2czAA3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPOK:QXYfDtczA75bi9VUQ8D8UNQCgWH0V48
TLSH
T18485012873A509FAEC67823CCCA18512EB33B8558764E78F03A495691F373D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 a7291fda6163b8db114896465c0501d31b7d58a093720038dd893aefcf92a87f
MD5 0e6d49b2eeb55577aea2d72c0f8cf841
SHA1 33c06a05bf23d52631a50c099fbee5aa892afefe
SHA512 a33a95e52c129a542c31da6e3dc81a3f28c3c4f2f3909bc0e02601e014f5b4d59d304ac308bfa4f7c3b20a27cc5062c9070787c08410556ddbacfefb75991616
SSDEEP 24576:y0Le5ji0hmxfrMm5bi9VUQ8D8UNQCgWH0V48:yPji0Al0+QY8cdH0y8
TLSH
T12695AE16F6748731D073C0B9C5D2A69AED7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3a8d6d3bcd94d299a007a88411fc90f1c1328bebe65dc4df6d7e2eab5eb691b0
MD5 7be53ab6a6ef909b8c14a5f586dd4a11
SHA1 da8874f71635db62370c4ae269b5e0f052e2d441
SHA512 24f104c5e245447a85bd43b36effbd9a368c853726fcc40469cbe8ad49002ec43773755051c89f53978be7d6910a9b9510b8da05fe66371e26f7267421b22779
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWj6q8wyu45bi9VUQ8D8UNQCgWH0V48:x/ezSC6vUzPv+HjyY+QY8cdH0y8
TLSH
T14E755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a1ac06c3fdf94f3207422155fee6fd52c1fc28b1d5ea6f78f18a1b6e56fedde4
MD5 e5801dc4d2b1717eda0d7be47b8dbc6a
SHA1 b64ca07e468f9aa3acb68b2b31a2def81dac00eb
SHA512 cdd83dce47054a58f3cc7036e1f75eacc8525f5536c0bbc391a8bbfdfc7598576b8165ea6c7e9274924deb25fa67ca0db53e395c9330a9621222d236faf4af3f
SSDEEP 24576:TVbqPb88hv/l+Bn5bi9VUQ8D8UNQCgWH0V48:TVO88hXl+U+QY8cdH0y8
TLSH
T1BF559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 dc2b4f3a5c707cc7e776dbea468620e705e646dd5d4985ad6afcdfe76d385833
MD5 02025b382ad89be968326ea2b6b61bcb
SHA1 8e302f9927ebfef8b328b82455763cc6611a3e2f
SHA512 47f29a15225a8b03bb15ff8f6d124ae1da006f03b455198beb0f307130e4de6449fdf3538e879bddb6aec7e2685b76e7ea7bc7e9f1386ea9f6af91261360ece4
SSDEEP 12288:60Z3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:60S5bi9VUQ8D8UNQCgWH0V48
TLSH
T1FF652341671BAAF3D22B8B398CB069323E52CC96F96D8E0F941771DC643D1E6C4A2707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c383eeddd2050b42e34c784ad91b42613733889262e34dd2e183ea736b844839
MD5 319d314f60f846ad5612164afd8d0962
SHA1 01a608f2d1c0543fd6f4d73077c55ec1386348bb
SHA512 10d0e4dd084b6ec2073b506b15a84ed65c3cb388f5a4b6f95eeb66a76dcfc6d7d72f809dbc16c06949711194e869c4e93639e4dc2d5db82bb235b73fbbabd251
SSDEEP 12288:feBNUbTVO86U83I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:fJIUv5bi9VUQ8D8UNQCgWH0V48
TLSH
T10385DF3BEE28FCE2C27E8DB85A918600E77278314F6293CBD125824DDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 073921f3a867a46c70e03350040dc62593160f8356ad0d3769aec8196e913d62
MD5 0522c3eab575147809bcb9fde403bb64
SHA1 283b97e4634b7ce7ac5ec2b0ad0462de1dd8fa98
SHA512 62559ba348d8a63d5c3cf1b0dadc6215d293c9ad463ab7276cec60318bbe66caa84bb960495000140b2a6b1b310214fcded8d4396d8b700036115b9dd3ca3efd
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THG:qQvGAdlCEL8c/WRNw5CvY8WUl
TLSH
T18C267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 25720c676ed2d1994f6a57d6c0ab1fb0fffd81e9a369e8a0929d4fffaff10245
MD5 8be366e00f76fcaa0ed53a799ca06f00
SHA1 69044c9a23d7f1b710f28c6d235c718ed16404a7
SHA512 596118554d87a5dd7d6496ba3a4ca309044384c505d243b66af015ba779436116cd09a6001dd6bb1ebb062aa63ec24f0219df7fe23302392b84a96520ee2fa9a
SSDEEP 12288:zAwSfxL/2Dc3oDLLmt0LDQewsAjm3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyN:sNewsAjZ5bi9VUQ8D8UNQCgWH0V48
TLSH
T11C85E031FE75E432C2BF0DB61B35D716282DB9204F611AC3E3A88A9D59342D26376B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 91f0940e6cb5754ea9e7666a49a13438d872ada9edb82252e5cf53fcc1621eea
MD5 f33e4ea05187fc4c8355e5dfe0398a5a
SHA1 dedbd482f8c54576ea843a36670e33fa7acefdac
SHA512 f6e962adc1c2ba37765037cb71aff286ad8f2da3439f1b223e5b06e831075ae6236f5ac2fb00885a375f45ec8812f73ae9f717358c91f74f2e4ae8750931f9ce
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHJ8tl:5UEtQevvqc2W1cpV20I32g
TLSH
T153474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 27a088f27be41c8231cebaa0f3bc366ed7b3ba8f3f6771274b2d1f647bab11f2
MD5 1a39b8cff194f563dcb2c0e4cd505fca
SHA1 d50847f79b6ca61b5aaf99fa59d1908d18ba80f2
SHA512 89f6f8fab16c1a38399d24b493c3f0244f1749a6a796ff2c60cca0e721d3e4ae06d38a367a273e2e02cca0326a5d0ce9c367c4c3ee3d60a9189fab02c1ddbd86
SSDEEP 49152:BCbRquA/m2yL5zQfFiV+XenmE3/zk+QY8cdH0y8:uoqtVjnm7Y8WUl
TLSH
T1AFD58D0976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f9a617fd4d9d8c5c00b0e51ffcf3af93665bc029fa707ad8011d3e0d7e1737d5
MD5 d13abc1f43f22e1182f19cbed5300cb0
SHA1 8337389164a5095f30bd3c2313d3745cf7ac78a5
SHA512 dde77f3af70633ad9f124944221d263e51bc8f8b2b6c9f8d7a204590eda56a1640b0cfdad82368ef7f8d36664d3b3f083281d40d745a06d83a50bbd24681493c
SSDEEP 24576:EAhGL6IFoiwtA5l7S53c5bi9VUQ8D8UNQCgWH0V48:EAM5Foiq5j+QY8cdH0y8
TLSH
T1CA35AD80E7F955D4F5B3ABB899B69171EA72BCA65E31C20F2110D11F1E33A909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 0c95887f0178639095b0d35ff7171741170c64a40d4ea000fee17da96199077d
MD5 db43b242bef8c7ba1fe011322432721d
SHA1 82f4873903ab1adc0f5a8006dbb2a81a9bfb5901
SHA512 e41f3ae5c431303fbeb208984b85020065b5a3be85b9740228d319a43e80dc458ab40b59b787e5e4a7f09590d025c4ec8e6004cdfd733e6c4074dd85f7b8dc66
SSDEEP 12288:Bmw5HEjsChNWBFgl0WDm+Cn3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6Z:cwu/OWt5bi9VUQ8D8UNQCgWH0V48
TLSH
T1BF85F14633A51CFAE5678638C597C536F7F3B8023A25CB1F1360C25A6F37261AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 caab9b916221bf1aa70115ed3cf8e16994e8817319f59424d8087a26ee64f3d5
MD5 f4336a3f53d9b7f7989ef3f19f7b4835
SHA1 0ebf62612f304057c5d5ddf72b390ca831285126
SHA512 222317171c6e4d5676807f96dc36a87bddd240d0ca9a6052cc4808fd0925ec321794752fbb4420757fe7c7456241cf11227e5aeb10e9e7b92db52ac8535ae27c
SSDEEP 12288:qIZ1IyW3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:xZuu5bi9VUQ8D8UNQCgWH0V48
TLSH
T1D075124633A961F6D167873CCCE05A16AB72B453A73A43CF122542AC2F376D29D36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 220cf1e592326ed90353cc8709ee5c68fa7e86f3b1000e8b66fb8c6ca06e22a0
MD5 58cd8994635f80e65538377c8c8b97eb
SHA1 aa27206babc253296b5b914b515ff67ecdefbf8e
SHA512 c4258103c0ab2b9efa8be8c2615cb403977f5210062d78d570331fdfd9678ac462d149e2e275562c256e1e8bd8b9eb4cbef68c3829300db38ddc760f34cc1756
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ua:RQRQyi36YOcPDLvw2gAf+PN3EY8WUl
TLSH
T1D0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7f044f03e4d621a7cd0932f0d579e034a081b5b9d5013d190439b3e09c6a513a
MD5 6da0429c89581c4ba930fa9911d2ba67
SHA1 cf7e556e55d39f0d3ca9ebbc73a993da8cd31134
SHA512 8718f5de089fcd974840dd4430b8194160807af0ed0112922411216611b18a3ef089a2382b5ed0710480579ee18012f3ce5e0190fbbd1f96b810e1a723201fd7
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ua:6QRQyi36YOcPDLvw2gAf+PN3EY8WUl
TLSH
T1ED667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c796ae70b6c2e39b0601cf3baa13ec4c46dde0bb3c4e86250cd45285d2b559ff
MD5 a3d24b30b8c763bbdfd5532b0727b358
SHA1 89ae9379889613710df4a9ca30997c93dad06962
SHA512 88470583818a2fdf6b0c29cec427ada949d7d7c94d2c69384166263154115e833186835f323733499b531b0d028f11b00593d555d0109974307400e6682c7e28
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0+5bi9VUQ8D8UNQJ:H68Qg55nhkeWu7PNU3/0+QY8cdH0y8
TLSH
T1CDB54933B2F600A9C04DE1769F46973196D27C758FE0E3DB8511724A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 abbdf51dc5791a174102244ef725fabf6481becf0241c053e1de718ff8ba37a5
MD5 66ce8d6d6691453deee670e521d33b43
SHA1 86abd2cf49c87608b2509f252cddf916414350f4
SHA512 742df65cdaf66b255f6fba06848be519f7d8c18b3fadc7fa460d47ad51ccc88135096dd8a1ee66e73333c2d1553e51aff84b81587d1369434dd01f89ff4346f8
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99c:5y5112gYy5azzVvU69nLKnhZRY8WUl
TLSH
T1E2168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 724c141e63d02744c94eeb1e05ce9e057b2c72370a78d688b2f31b6940981303
MD5 849aa3468491cc70396ab976f960562f
SHA1 872083297bb4ff96a190317cdabcc448f76b22b4
SHA512 65c75f7e68b400a7a9866f989ba3a8a212739d35a92ceea57b365bbb7baa0f44016f08cffb9166fc7f5c5bd69f6e69a5f36da507bb69f435a37db3160005f83b
SSDEEP 49152:vB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glm+QY8cdH0y8:Ru6JmIxd2dcY8WUl
TLSH
T1CDD59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073552A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f0a8cf00baee325fc50701802462b0c0f47e404e7cdf044bf8218cdace5e72eb
MD5 a12ef4f7828c4da78f685453c01150e8
SHA1 955baff9f52cd794a574c93edfc2c559f9838ca9
SHA512 98d5b06f6f264e9a32461fd046181a5f0bd63440926287a8e64ea50baa40f754c7f2a121514166ccfcb2cc4b0f1d1ed0206b0bd7bab0501bd389daf8698b62fd
SSDEEP 49152:y1hpsNoJpF1A67U44CwH7R4xa+QY8cdH0y8:ymifPqR7Y8WUl
TLSH
T1EEB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 faace473db62ff9b4f1835208dd361d71783e27d16d9d2b84d543c7f1eea6330
MD5 cc82aa125a41a87bb110fe39ea8eca00
SHA1 8131bb8bf724d49be17a7944ebde2ec84ae8b21b
SHA512 fad7b2f8bcc5af122efb4b25617036ee94cad8679062ae6aaba248b4ddb9d6f7b6310b12942eac25236c42284457c7409f1dd085c0335385f6cd2183f108bd69
SSDEEP 49152:+SuZQIY0Be2KkRVtOnks6NMHqt+QY8cdH0y8:Q5dKqi611Y8WUl
TLSH
T181C5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5172f05c57683b7addeab2e2d5d927318c19cc856d7e926423f2120ccac62d7f
MD5 d1a670c6d6f1c884c3ae0d5e17499c8d
SHA1 7323f1b0db696dd70b655c8cf69c8fdb7d23e3cf
SHA512 e2bd09be12422f16502e5b4283010e6722631baf29309c4f99b9a393757ae7e137617c706405a0de22fdacdecdf54636294ad2777bbdc3f724b38e276780bd4e
SSDEEP 49152:IhtSn8EApI0figjgiDn0AP5w2+QY8cdH0y8:ZX2iWphXY8WUl
TLSH
T15095BF13F2D900E8D05ED178C7568632EA62BC160B39AAEF0A50B7551F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 1c39234ace738cd439436b04b5c8644a1c614be9a5fceb48160bfe44eb89607c
MD5 26db8e044578aa9d303a02fe935aae52
SHA1 42243a28e66cce8fcdb4ccdd8b50c5797e9703b8
SHA512 c9b47bcbbdd52377961dbb969602835b139f141fac7cc5f104688b5acb70718c7d058366e9561833284346f3127e86f9888e3d27c8113c4835ab970392784f7c
SSDEEP 12288:5B3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:565bi9VUQ8D8UNQCgWH0V48
TLSH
T18A652341761B9AF3D017CB798CA065223E52D897FE6E460FA50F60CCB53E1E684B274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 8e0af19d3f2e94db15a56dd5510e13075d346ffb838a66d5bf589ed1d566c0e0
MD5 549afc671ba21d6de8df5eb101a961f2
SHA1 f210e170924e9021675ee00e9c0a1465be270446
SHA512 542af8d8c73cd754e5bbfd7e5d7d0275b1c78109342d2f507b72ed33d00b563f67194a2f105bdb37c51e12a167998e3ce1090d5427a2b010d2c5c73b411fa13c
SSDEEP 12288:yK3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:yl5bi9VUQ8D8UNQCgWH0V48
TLSH
T111652341761B9AF3D0178B798CA065323E52D897FE6E460FA50F60CCB53E1F68462B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 fff9fb272ca6fc61062477202e23474c134d6be432b84aabe79f80cff38ef4b4
MD5 07d7edaefe5a0b1c8968e4ac0004cea2
SHA1 1a3ee9cd313ca62d77ec7d6789c89ab6d1db47cf
SHA512 b911399c90f626670c712007ddb3ea3a34590b8c31ec333785c50a9ded7d23fc5412eb74b17a86b348d11c4f22e1a08b86112884a2bb15b7697e952fb09bebcd
SSDEEP 12288:rk3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:r35bi9VUQ8D8UNQCgWH0V48
TLSH
T167652341761B9AE3D0178B7D8CA065323E52D897FE6E460FA50F60CCB53E1E6847278B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e39ecef1d0d3a17dba97da575eb10250d9dd6c704919e7bce679973f8cc2304b
MD5 777b8b1be25927fa4171436cdcfb4509
SHA1 1d9ee2328c4f946a52bc0a1b595b34afe8a6dfc8
SHA512 01ca29ca3fa6a4eb6556038ddf025c3c356ef401d50fc168e207bc2c817f351f2eb3e8b286c0888b9872f1d64c22e06376fdb49d3df9d39c29b1420e257ec9b3
SSDEEP 12288:IVz3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:X5bi9VUQ8D8UNQCgWH0V48
TLSH
T1F9652351372B56E3D027C779CCB06522BBB2F896FB3A474F960610CC2D3A2E59871B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 0f20695d5cf8c366f3d921264a25aa6bfb56b3fa9caf55b2c1eea3f964317bef
MD5 ec98099c2e83ccdda9f7ec1d60b889e8
SHA1 cb29db5697e6b25ff0acf5245ec1ac3956a6a4f4
SHA512 19ac7fe9998de08e47e854aea624d7f1b3a8a8b6cdb515ffad06ff7fcccda287812b975f01c34ab54978dcb9d4e9ccaaa5d9da4c779935a47a90f0aab229da82
SSDEEP 12288:dr3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:d05bi9VUQ8D8UNQCgWH0V48
TLSH
T131652341761B9AE3D01B8B798CA065323E52D897FE6E460FA50F60CC753E1E6847278B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 9f9ebf8fae5606cd7cac03102f039c4490729042cd0b02a98d0e2bccda2af9ae
MD5 8d17efe19da34521acd984b17cb2c316
SHA1 9cfc2cb62fd9489623a4989f6011933f97908d9b
SHA512 7cab5f85e955d2f54aac872e31b9542f315503a281ca613deba20d8a2bbf23d487007f223ad46948754a1f8a91f8f112ad297ee0322f84861d0298875d7afffa
SSDEEP 12288:pu3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:pB5bi9VUQ8D8UNQCgWH0V48
TLSH
T105652341761B9AF3D0178B798CA065323E52D897FE6E460FA50F60CCB53E1F6846274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 8cd6769236e0241fcc085e8cf4b4a923779de818640579d86d3820c78f788ac7
MD5 9feff9306f77a40ced418a36d629befc
SHA1 573ce492101155270e8d85c4d043d5c5aebd4e9a
SHA512 e8a7a278980a19579a5d6720233ac008a45fc67e0ca142dedff882fbd9b493be9a392db5e69a46afcf628709d098f95acdc2b0755c3dfa7ba1315ff2348e8e07
SSDEEP 12288:wi3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:w95bi9VUQ8D8UNQCgWH0V48
TLSH
T1F2652341761B9AF3D0178B798CA065323E52D897FE6E460FA50F60CC753E1F68462B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f707965b111efe5dd911a28302ba055eb11cd55280b30dc6546e9f7fd3f9a3c5
MD5 f81e0e2b975a582be9280edb1efaa91a
SHA1 8728c74d3ed835cfeff68f6775deb75d3cdf47ec
SHA512 6619aff1ab47aefa68c9beacfffca29da92e3d46b960ea553d87513f27a59ec6f575ecd1e336db86e7fa839b15544a3c2a6855eefc74a0faa0a280a830296ea1
SSDEEP 12288:IiZwb5zzFEoS2cPvyq3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:LZM9zFVSOF5bi9VUQ8D8UNQCgWH0V48
TLSH
T100850295B3511CF5EC67823ECC618916E6B2BC5A5B70C60F03A4326A5F373A10C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 314634a6391a4dcef7c02bc3203ce765e948e2f946feb245cef1f464af05d987
MD5 305363fdf2edb6d969c7fba49ef495b2
SHA1 d9e2e3011b37872ab127ed87d737b8d871a121e6
SHA512 0c04905b192348464c68ad8e798926c066c5593c6d616a6efd30e12c3a684ec9320464d67c9d082e6a69d245265aee2efd7347dd8a8f4569fc6955a50a2bf53e
SSDEEP 12288:Cd3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:Ce5bi9VUQ8D8UNQCgWH0V48
TLSH
T166652341761B9AF3D0178B7D8CA069323E52D897FE6E460FA50F60CCB53E1E6846274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c542df7b0ec756fe4bb485a3f47c33818b041b6068e69a5686eb4f2dc6be62e1
MD5 f4560dffc3a3cb3528184efbf6be7862
SHA1 4f3c31465a77706337fc47e6a44cf4ad2638e68c
SHA512 dbca81d9c8bb856370d4d5e987806fa6442593fd6924e904aacc78ffc1f4cf38fc552821719e9987db6338c2434ca8fbc39ef73f8117efbd4f106b2676cb8eed
SSDEEP 12288:0J3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t1:0C5bi9VUQ8D8UNQCgWH0V48P
TLSH
T105652341761B9AF3D0178B798CA069323E52D897FE6E460FA50F60CCB53E1F6846274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 f46976cface3d6bcde9e748b575ee2b76625caaa1d7d5d71eb560586648b281e
MD5 977998b5f35bff5664525ccaaf3c7e35
SHA1 4e645ac34fe11d23ac944da3a2dda3394362930d
SHA512 f560c4ee0b605a943f8f432b1c52fe8fb2648f9306fb917fa8c7e737956086fc60b94f3788325a813e4e84e718b9af580ddb24d1c19f96d3882486e92e517f21
SSDEEP 12288:XyPz5L8W3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:azyJ5bi9VUQ8D8UNQCgWH0V48
TLSH
T181750203736631FAD1378339CCA11A12F772B8365B248B5F536442B92E372E19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 06146ec2ea6529c4783ef73fa2057861c65f744bba5f120758f8dab32595ab96
MD5 e8817c894783176f6a4835be7b76f7f4
SHA1 5d428a4e11f45a3ceaf60a006a937bf41e959047
SHA512 7ba8e28138cdfbd6479a0831a4ad09ae479e8501c32afbd56202ac9360dda2d4d2c7aa9f7d2b86a021714da6dd8fae754f93c8371dcd5f209d2d729162e9c36d
SSDEEP 24576:icP4mcvIjkGOxhKP2l71nNKbrh/8KB25bi9VUQ8D8UNQCgWH0V48:NP4m4IpOO67W8Kf+QY8cdH0y8
TLSH
T1C765BE2DABDC0096D0BB917885658A49FAB1742A2F3286CF1160937C3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 6a6ced0c795d01f0956da366e6867c67e6c3a8cda81494774f21a7b87654e693
MD5 2340a57a71aa9e41c3e7bc5a10042a3e
SHA1 f536b6be6a222fb7f6d85305c096200c93afd690
SHA512 214a004688d35d00d726ae18588d0e4aa4af0e1ff69ef91bda3748903b9dfc86d4711e39f88c07ecfa99d778b7798acfdac0fbb9e3c826e308c8c2d6c8db4d75
SSDEEP 12288:zDsft3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:Ou5bi9VUQ8D8UNQCgWH0V48
TLSH
T1F575F01AD25902E9C06E9279CB515A01B723BC6697E5C3CF62C1F17D1F3A2D09DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

au.msi

Path C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_381\au.msi
Size 853KB
SHA256 9d4d672be69c91207923ef3540af4750322c43e0a3440126fbf5b4962c8c3052
MD5 b1a4cf35bc6913071ee217125bcc6788
SHA1 4818a036d75aa943e92353b638ffd1636ba46c49
SHA512 5bfde958292748f666d61b72401426bc5ab4bd564299e806d9c05722812156d6f7742bd2482fca308fc10cc27747a1f0b216a4a2596540cc987b5402c4fcea04
SSDEEP 24576:le/bE//5CbZtbotwXYMNMUEcF72VUnVMM:o/4n5mbbX3MFcF72GnuM
TLSH
T15B0533D266E539100CD0E7B0A253A67C90FE774A3460996044637675CB0FBCB67ABB3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240683953.tmp\2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 2aee6e1f68e960972f61988ae521f686f0b219c1ea1867e6a9f7818f86be9717
MD5 31ce575d88afd3b04c45f30a64a619f5
SHA1 3c4eaa13c9891a307270d00691adb67897745d2b
SHA512 71280a3f20ce26a1582215a074779f2be4230f7e091191925ab3af272434f70b0d7385d0aaf888d1cd5bc91c0540096039db2443d51c8c61fa79d4866d3a8329
SSDEEP 3072:zrXswyhNcDEi0iKok1hxpViXtP9sT1aak7TAVk+qz6mf6V:lBTs
TLSH
T197F375C7896D44FB34130BE7C3A96C5416632A2D536E4A1D31EF96CEE444E03C66E8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 194KB
SHA256 69693d9d1687ab32362c4956e0c53db327ec26093f0af4a4a6697a7c3c1ec180
MD5 b8f94479730afb1ebd1ba8f6f591658b
SHA1 68cef1bde949952326682584b10c745874fed61e
SHA512 9658be8c45d0032da9d46794a4e13c593f968650d2d3a047f1775992956e8d4fa9058c20948dbe06296275be1badc8d19c7c806da29a508724f228b897fb73d6
SSDEEP 3072:zrXswyhNcDEi0iKok1hxpViXtP9sT1aak7TAVk+qz6mf6qMo:lBTd
TLSH
T13D14A787892D48FA34234BD7C3A97C6415A22F2D535E4A1D31EF96CEE444D03C96E8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 5edbe0da4c93877c19c94ddd1aebc1d27dd2a6e3df42899ac7b1117cf50c6523
MD5 396cc8c177a4c3fed505001ef9c977b3
SHA1 b5ea09e67d718f85fd4018adadb3552245eb5194
SHA512 7462fec06fce29eda5f7766a070fe85d7b24d2ba16618306b92c9c431a4be84bacddcddf635436a0105fce3e2d482a85debe6cb7b8056fb839469b00f353070a
SSDEEP 12288:yN3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:yO5bi9VUQ8D8UNQCgWH0V48
TLSH
T14F652352A71F9AE3D07B8B784860A5323A17E466FF29860FB40A61DC743D1E6DC7170B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d185796cf39dc43b975de7347efb07b61d8def5c4cb498658bfdbae0544f7e63
MD5 dd8cb6682ba9cf5cea791abed1de921d
SHA1 0b3c78cb916e5ad65a6306bc4d516e42c2b23410
SHA512 12e2706aa661fa3c737bd21a5c1c34b1b176acf58592da4d0e42589de40556b348a5fd4f4f9d37d8ae45fbbf55bc1c34e6698a35234b7da480f2ddde858f64c9
SSDEEP 49152:Xa0h2GEkuAe73q3pp46zwwQL+QY8cdH0y8:Xa0hNYG4JwKY8WUl
TLSH
T1F585AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1151813D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 ac59249e2e01f478d2862f5d6e26c9119ad03ed65a1ef74e7da4dd034c506730
MD5 d3767f33a482c130fb070c555ac572d4
SHA1 359f0d7cfa6abc06abdf80a422ed2c5a733da3e6
SHA512 1b649c5ab39ba223c5ac464a5d5628ac0a73aa57977500da1b036b013f9107109fb328412a975a2244ff431becbe8477a46944f8829d63ab0ae0e76cbdb0feb1
SSDEEP 12288:lhbHjfXa3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:lhbHjP15bi9VUQ8D8UNQCgWH0V48
TLSH
T18675127E27AD21D6E172D27D88918507E731F8262B2593DF228281BC5F3BAE54C35F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 76386382e6acc5e700e617d571461a3b0a94fa20a68bc8f02fddcf07ce8d1124
MD5 ace34fbde8f9fa12a32be1935419e880
SHA1 85eed84126a7ac5be1ea30b30f8f79b59f939aa6
SHA512 1154f050cdaf39462323d7accac361ec8bc4ac39db8ee53b954d1c5edd3d1012c94552251ef003bcd177ac92e48736ed9ef02a0c77608c0704bd29d94a9d0d20
SSDEEP 24576:W3YgnJcRTk4yti+R5dBR/t5bi9VUQ8D8UNQCgWH0V48:WIgnaTk46pBR/4+QY8cdH0y8
TLSH
T1D845BF2DF2B910B9D4AAD236450147B5FB71782D1F209ACB0170C538AF1AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 bf1d867d1b187bf4f7a5340062d6f61d85dff372eb3cbee3e6c1008caab51000
MD5 c30578130dbd622ccca343676b2d0f70
SHA1 c0a8d6aadea51b695754b4be130d60e262d6aa48
SHA512 2427f62b60e690f87369b869fc5e39db5918f371513571c491fdcef5e30ef921e181924a849583a24693666c29970116d616450631df7c8b34f6ef80b4d62f4e
SSDEEP 12288:a53I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:ay5bi9VUQ8D8UNQCgWH0V48
TLSH
T12A652341621B9AE3C0278B7D8CA069363A52E457FB2E4B8FA41B60DC753E1FA8471747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 14413f7622c7205aa6335518d064c3994fa79a18f029b3d46cd3f5a31e74e4d7
MD5 930866998f7c41d7482e980a7e3daf48
SHA1 0c968a89b602e2c56b27986dfe6e53f83b37e623
SHA512 ff9ef45081c35297cf1baf11839f4373722c5eb05cab94f6999db73500923205d363caf15868a311ba466a88e5790c8ff62f32c80f6e1aefc288c9d4603e41ec
SSDEEP 12288:wObeA4LWOsvAYFTA3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:tuL3UT75bi9VUQ8D8UNQCgWH0V48
TLSH
T115950155F79500F5E87BC23CC8A29912E672B45D1764E7DF03684AA91F233E28E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3117f6f784ba6ba76e603646d26bda76a0598ff25a01370fcdc89c7251d9fc0e
MD5 3b22fc1bfb4d753e8cf522c7239b1127
SHA1 5a0940b9dcc1512abb02fb68a3c5b7e3a4840af0
SHA512 4f411947dfee0a0cc5c079739e918058d7af2adb543b22640dfe42aa9e1bd885200adc576fdbaf6ca1bb9ccbcea2f4c8e7777facb5100af4d685ccf9a3a7e9e0
SSDEEP 12288:OpFtBOc3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:0OP5bi9VUQ8D8UNQCgWH0V48
TLSH
T14375121933AE10F6D036923C88929319E772F8665B2647DF029081BD5F77BF89C36B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cfb02e5fe186c84fd065017769d72b2fd0f67f8afecfc1bc13cb575a3b8af485
MD5 74c706003a994a1c7a7a54ecac25f111
SHA1 14884f1644e42e3b19047b86fe95c86744f7f880
SHA512 1f8927b049e97902444ff5d303adfcc16b29b9b90fd76d9f525953c6134203a0a0b40c50e04efa9b6ace7426d00c1ed38c09c44a43ff46facc0157b4be716edd
SSDEEP 24576:57NM9YqZqmWMUkPjZM48Mv6bEhse5bi9VUQ8D8UNQCgWH0V48:57cBWMpPjN8DbEhA+QY8cdH0y8
TLSH
T106659E2E6BAC81E5D477D13DC9A28206F6B2B4611B318ACF5152833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8e6886ab2821c0a937539fee2e47f49ca4fbf9ff198af47b0b191964ad2c1af3
MD5 6b29898e345b93074ad251555f7358e5
SHA1 1f549cb6fe9462faabfd82cb7651babea64d0dd8
SHA512 366aafbd6e2d808812e4805384ccb7134989191fe8bf80f65efabccbcd846dc09a6e96a14d5e9bc7e915081a8bf2177e83541d9817abddcc1a3a9d84971ea1d5
SSDEEP 24576:yW6BApg2YuyuNDYTabvcdvNYf8km1Q5bi9VUQ8D8UNQCgWH0V48:yF2YuHNETovAvNYf8kmd+QY8cdH0y8
TLSH
T1FD858E2927EDC0A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2b6a746541539685d699704eb6efdd49b25aff39404d0a5d53da6e7afa730f80
MD5 ebd76e4c5e27a5b10264e07fc3b36e0f
SHA1 34dee6f243e100f68c29887e98766dee3591c70d
SHA512 536b4c5e0363cc4b00ed697e77376ddcbcd989540d1a5b6a79104b8fac5f792a69c1a4fc128829342717bc1c5071157bfde05523d8c717e7e17ddafbd93d1be5
SSDEEP 24576:5AFs06+Omlf8NXEbToD5bi9VUQ8D8UNQCgWH0V48:+Fs060loXur+QY8cdH0y8
TLSH
T1D765BF2F62AC00D5D07ED17E8997C91AF6B1746307255ACF0260827E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 c3f1813143648b0d51f6fdc94001291c9e06691a48608d0cabc2c0182f86d20b
MD5 abc9a2e38695d05d0437c716d9848edb
SHA1 bc68fc9b46549a0719280081341575793eb1268c
SHA512 ec4b3e68bad5234b0c9b4a7830fcc05c4f9f9f07be5aa977803f0480f4a0974114d8c643e6e8ca680cc75bc4e3eaf1b32ae139a4999873173be8c19af47d2ec2
SSDEEP 12288:rCJnJ5D3VkrBzx93I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:mJnJ5D3WhU5bi9VUQ8D8UNQCgWH0V48
TLSH
T1C085D02DD2A910E9D0B7C374819A2B56BF72383D2F226ACB2474D5353F12EE09979F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 28471276e258e7fae0ec37403d46bcf504e86f484ce7d0fc64baae95c8eb7e15
MD5 bde87100352f3b1ce0b37b6256e76315
SHA1 dddac8f33e1a9d976fce21873423d3ed6ded1ebb
SHA512 90937f96a0dd646a566a957e14486ed578a102070776b9da4d50bc5382376403c859a73af27a1a48c7a33690e59919dd63c49f3b30f84782680085c4d00a1bfa
SSDEEP 24576:IEPghm6/7IIXdwcXrif7qQncjlP65i3Vut5bi9VUQ8D8UNQCgWH0V48:ng06DIKdwc+eQnSt65aVJ+QY8cdH0y8
TLSH
T15B956C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 3e81309da9b8b1bf84a7bb5c6c7e5d044c82fbb72ef878a264438b910cb8cc94
MD5 0a7c55b55a5b73cd35af69b430f551d0
SHA1 2d7f21cb55ee4870f2c0825c9cb7bb39e682aa6e
SHA512 1c0105c84a2ef21be6c31d284a3dfc4f3dcae8ea51f0172753f3615656999f957c44fe56f41ebd586e38d8a67ebe9a4e5290ed6ad5319f46f1402db40a852eea
SSDEEP 12288:GEP3RFn3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:FFY5bi9VUQ8D8UNQCgWH0V48
TLSH
T1AB75126D276E70E6D02BD23D88A08605E772F0716B2617DF5192C1BC4E3B6FA5D39B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 4aa6a1061810337206fb8f94c062e6150193726e06a56f2a7b1a80ffb9429d99
MD5 01a110e07e53afc80685598fedbc5c42
SHA1 fe3d7f565354df07a5fb1619a0a366806e9c8498
SHA512 e8edfb7ee62783aa20e24aab1a7321feeea921559e52f88164fd2660e94ead6cd41b52618cee8fcb87c23918fa60a8394ec64899af16693b9224c460c77847fd
SSDEEP 12288:4jkyK3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:4Iyl5bi9VUQ8D8UNQCgWH0V48
TLSH
T12A7512006359A5E6D17A473C88B291616F72FC21AF2587CFA041F27D6E3B7E5AC31B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 51207ced2ed9c09d48410ba0f34c3cdafa04c5e4975a53001592b23505cb5ea3
MD5 9b34099c1459f88930630644caa52ffd
SHA1 286a75bcc4f79be745a41e23fb0d7a0e45e392c7
SHA512 70ec87c2fbb20d159acea304d3143da2f87c32609d49c44a50144112e9c249668b86222b354b62b42ebbc7f6c2e8eff063155423f93194506b551adea56401ef
SSDEEP 12288:JQM3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:q/5bi9VUQ8D8UNQCgWH0V48
TLSH
T15D652354231B79E7D0278B7C487069223A62F477BF29069F6016E0FCA63E1E69472F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7c458336b65e04669330a411b1ad4318231106658d1565c4b096ed04ca7f2068
MD5 3ac98f51aecf5b23e19fbfb5f8add926
SHA1 004fef1259b5209327ec99e162b424686036ce8e
SHA512 0bfe57af0061d16f090e0ad5c431cfd4db6b9fbf268178fff54136710e07ce013a4f4712882cdcee81ccfee141374209b7f01d07ca183d126be0eeba332bfa88
SSDEEP 24576:zQ9MxZKdcz9dw3G5bi9VUQ8D8UNQCgWH0V48:zVKZl+QY8cdH0y8
TLSH
T105558C2DABE9059AE177D27994A250C3A633B4311B35C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 3e3239cb900d9dc5a57f493b218c4ac57025a2cb16de7309dbe067a1069a5107
MD5 31d73cd5b4baae06f10b5bd9f4de2c23
SHA1 ccbe13f5c4062c8a3a0b9fd0523e3da45ba70115
SHA512 8b789699ae06368d5a3b51ef5237174757199340165b4928f63dbc465c8925d0cb336719eafbee876683b98e93373a3f778a94361377b9b3943fe1656ade9488
SSDEEP 12288:XyoKo2bRple9pm3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:Xyoc9ApZ5bi9VUQ8D8UNQCgWH0V48
TLSH
T14E85E01FB76E40E2E076823C88858645F773B0716B6257CB6591C33D8E27AE9BD34B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 af830ec61a9f47a024735ed39642e91e41e2c2cb79c830431807677305a5df89
MD5 d49be10a4d87e13738db24d9a1037550
SHA1 974d7fdb74b34158362b16324b336f55450bff38
SHA512 e2626c54955fba0b0215a8f9f94b727d09be2f657c7483c209894567cb4057b61b6f26cc63e7194101f34660c893c1374971dfe13418813eb666d139823b9c03
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKE+QY8cdH0y8:50zuNIsY8WUl
TLSH
T15EA57B3DA2BC00A9D8AAC379C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 46e8576a64a25240a8191f04223618d09ad730c7e177a2e1ce2b25f15faed9dc
MD5 fc0f24c6ec1e49d812df6dc8e6e7f3d3
SHA1 a736dffbb1f9736e40a74e875b208ab5afca3dee
SHA512 423fba6a68f2543e3402b3265a8d797775498bb787e07f79b6ad4321a023ca6a1f4ce956baebdc5b63d987d2562ceecc3f95e0788dcd279e9890a277ac855b1c
SSDEEP 24576:x1QT7EcpfxR+N5AWAz3ooiYzjMqbY5bi9VUQ8D8UNQCgWH0V48:UTDxR+N5YzTBjM6+QY8cdH0y8
TLSH
T10655B02EA7F915E9D17EC6798A23C512FA727821033193CF42A0C17E1E2B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 2b655b8c612694d55382a08a37dbe256e116f9a9983d5e865fdc90f6c3ca3cb5
MD5 353ef500869b41d82721cc795fb7dca3
SHA1 b03dad50b401b474c82ddbffdb7619158075321e
SHA512 9473dab083024fc698fba52b6359ecc95d8b96f3c8431f98fcdbcb752b0bf042524f19e96b5a06e13a96300a5d202d218732b6c76f8313d9be0934530d7aed8d
SSDEEP 24576:eTMdOz0FFS+ymSL85bi9VUQ8D8UNQCgWH0V48:q0K+ymSLT+QY8cdH0y8
TLSH
T1FD85F13EA36D14E5E47BC27DD9538906FA727462032266DB0690C0BD3F5BEE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 855016392095441e1fd7f3dbdb359ac6a435ef9a068f4ff1b379e5df1cd46033
MD5 ced06f40973cb286370eb1a348c4a6ea
SHA1 efbcc148c1d588db8ba04560eabffaa46a92b9ab
SHA512 e3845bcb5dfdf25fcf061f04b4980107daa58075559daa4d830dcf4d8fddb28a97e741db5bb674efb8bf9c125ee4204ddb6d21af6af4ae543e37af2998dd964e
SSDEEP 12288:T40A3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:575bi9VUQ8D8UNQCgWH0V48
TLSH
T12775120923EA34E2E037973888715126AA71F87667294BEF3495D1BC5F3B2E5C835B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-245-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/556-398-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/556-210-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/556-205-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/1620-395-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2128-178-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2128-152-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2884-201-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2884-195-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2884-397-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/3052-408-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3144-411-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3144-524-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3520-523-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3520-23-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3532-407-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3892-402-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4036-164-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4036-170-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4036-174-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4036-176-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4336-280-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4336-264-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4336-413-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4336-525-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4336-529-0x000000000D3A0000-0x000000000D3A8000-memory.dmp

Download

memory/4336-318-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4524-36-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4524-27-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4524-35-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4620-500-0x0000000000400000-0x00000000006C8000-memory.dmp

Download

memory/4620-0-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/4620-12-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/4620-2-0x0000000000400000-0x00000000006C8000-memory.dmp

Download

memory/4812-238-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4812-232-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4812-404-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/4836-221-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4836-403-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4836-227-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4880-399-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5016-549-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-550-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-556-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-557-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-558-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-559-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-561-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-560-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-563-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-564-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-562-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-565-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-567-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-566-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-568-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-571-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-570-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-569-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-573-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-572-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-554-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-555-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-531-0x000001B0B2710000-0x000001B0B45E7000-memory.dmp

Download

memory/5016-535-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-534-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-552-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-551-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-553-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-536-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-545-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-537-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-539-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-538-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-547-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-540-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-548-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-541-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-546-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-543-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-542-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5016-544-0x000001B0B4F10000-0x000001B0B4F20000-memory.dmp

Download

memory/5408-160-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5408-414-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5408-154-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5452-410-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5468-501-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5468-400-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5740-131-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5740-125-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5740-391-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5860-188-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/5860-392-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5860-182-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/6104-405-0x0000000140000000-0x00000001401C2000-memory.dmp

Download