8e620a54c673911dc895515d8dcf9dde8f4feb8b93396caac245e2a089e6c211

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Size 2.8MB
Sample261003-2s5mpaydnf
SHA256 8e620a54c673911dc895515d8dcf9dde8f4feb8b93396caac245e2a089e6c211
MD5 facad586ac8a8acbfd758e7482e0fc62
SHA1 95f8f39299e330d14708359e6054d46d49ecbd4c
SHA512 be991a20bb330128a047a64695c25445665afab04d0dfa8676aee0a8e9e6ef7249fc7f44847042f0645503bc069799c2e19974c132c3cc90573d33d86ca22967
SSDEEP 49152:aLU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp/o+QY8cdH0y8:aLU/jIEeQfoR/IuOFVjUu5cY8WUl
TLSH
T1CBD5AE12BAD58432F1B316319DB8C2695674B8A6873685EFB3CC561E4F309C1CA32F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3388	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
1716	elevation_service.exe
4788	elevation_service.exe
4744	maintenanceservice.exe
6120	OSE.EXE
2796	PerceptionSimulationService.exe
1252	perfhost.exe
2380	ReFsDedupSvc.exe
540	SensorDataService.exe
2416	ssh-agent.exe
5016	AgentService.exe
4456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5f2b27e25f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d3546d48953dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000069b19d48953dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
1716	elevation_service.exe
1716	elevation_service.exe
1716	elevation_service.exe
1716	elevation_service.exe
1716	elevation_service.exe
1716	elevation_service.exe
1716	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeBackupPrivilege	2380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2380	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5016	AgentService.exe
Token: 33	4456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4456	SearchIndexer.exe
Token: SeDebugPrivilege	4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	1716	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3388	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
3388	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3388	4180	2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe	89
PID 4456 wrote to memory of 3352	4456	SearchIndexer.exe	101
PID 4456 wrote to memory of 3088	4456	SearchIndexer.exe	102
PID 4456 wrote to memory of 2012	4456	SearchIndexer.exe	103
PID 4456 wrote to memory of 2932	4456	SearchIndexer.exe	104
PID 4456 wrote to memory of 1432	4456	SearchIndexer.exe	106
PID 4456 wrote to memory of 3060	4456	SearchIndexer.exe	107
PID 4456 wrote to memory of 3224	4456	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\jds240730765.tmp\2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
  "C:\Users\Admin\AppData\Local\Temp\jds240730765.tmp\2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4788

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6120

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1252

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2416

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c6579da6f72b6ab1803c02b8d7341a61cd55a3abdff5fbf4724e87f929fa4aa7
MD5 b53636ddbb2ae32df9676fbca27d2e0b
SHA1 f81bb1c37020365b9ce2760f349531cbb5608c2a
SHA512 9b78676a5e049d5c48dac09a46dee62980a10590e05a92cddad32789f534efbf4af95aefc019f006d3d14ffec1d5f692cbabb54003d6d89ed9afa2fe3aebe102
SSDEEP 49152:ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnT+QY8cdH0y8:w3q6mjBGY8WUl
TLSH
T167D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 0afa2cc841dc1fd0b47f9187371e2b85480b4e0a14a7bb597f58d22e56c1aead
MD5 2ba6619117c215eabd9464aa3f0a1d22
SHA1 6d44ac1855e91e3b954112241d66bd38ee401d56
SHA512 dade238b706468ec620d468a010c9759dc49252190ab6e7b784b7f59d9649f0b5957e1de308cf240347b80c86c51a23664786cc4192279d2ad0dda796da7a13f
SSDEEP 12288:H1XLsswWkxy2lRq2czAu3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPOK:VXYfDtczAB5bi9VUQ8D8UNQCgWH0V48
TLSH
T1CB85012873A509FAEC67823CCCA18512EB73B8558764E78F03A495691F333D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 db1566d95f0ed476e3b31190e368727b658f950e4dc83c73cbd2de80a2cc9ce0
MD5 adf310f651d74f46c057b082a6cf4f32
SHA1 3b4fdba018620b6224ea47e14d3e1d3e50cbc676
SHA512 8aae3e8ec7a1630a0ce01065d90b9471a4b070ec6a93b397654ba921f0c546394af55dee1c7587502a15d0fbca43f0bf9388f9da4192a0ae2110b93c5111248f
SSDEEP 24576:d0Le5ji0hmxfrMk5bi9VUQ8D8UNQCgWH0V48:dPji0AlW+QY8cdH0y8
TLSH
T18595AE16F6748331D073C0B9C5D2A69AED7230865B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 80e1a7f1fdb2531f1fcebb7a6e34826d0849a82f2be3cfc0bef99c2f62095b08
MD5 aab3ecb073f196cd8090abf94306bde4
SHA1 169111a68a75364999223e986d020d83372113f8
SHA512 6866cd4bc2d9b5de31b70d7f715d6f815198666f8ee1433cc3e7cdf81a6e39be2c76522bee1a3961fecb0524e3d73c762a5cfe082abcaae941b2e9b008a8a3ab
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWj6q8wyuq5bi9VUQ8D8UNQCgWH0V48:i/ezSC6vUzPv+Hjyy+QY8cdH0y8
TLSH
T164755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 97486bc8b3e58e2f111d8d326da129b3b5f290df73695e7339e165ce9777d84d
MD5 cde342ad7aaaafc213a93648d5d99f59
SHA1 cb8c34a6bd375bda385c94d50330162a7cf91056
SHA512 73dd959497ccd7357b43a76301ea2bacaa6ce8662dddfe4a8e54ed1d63322ab71d3bb428f388327da334f6542d561865b600d37afd73d20cb05ec3533df4fb5b
SSDEEP 24576:AVbqPb88hv/l+BV5bi9VUQ8D8UNQCgWH0V48:AVO88hXl+2+QY8cdH0y8
TLSH
T11C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 539ec888446155c946a622e278f9a8512f7e0660cbd7fa33f9f47fe40ee09e4a
MD5 82da9cdd500d25147b00cd5bca614a99
SHA1 8f9c2800e4d40b47576a7524a25b3e07a1371eb8
SHA512 ffdd3a7f12ca7aa8d183fdfe70d6575c66cd46cf81f1094c790683e22550411c8fe5896056bd812a82a6c75b31c0bbf4d0ae42f4b2f88d8099835dfcd89bf0ee
SSDEEP 12288:W033I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:W0o5bi9VUQ8D8UNQCgWH0V48
TLSH
T1CA652341671BAAF3D22B8B398CB069323E52DC96FD6D8A0F901771DC643D1E6C4A2707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 68a1384daaa16ec3ea026abc930b69ac0746f08f7abef8525b7128a57386a945
MD5 4eb34d04e95ddd2746b508e39dcc5d5f
SHA1 e3ad50ff8b630b4ed029acdb7d108014bbb9447d
SHA512 9ca3039d5316117a6d42242761a5ecc229a7eb96c88ef35c834171503e6daeb4f3b8cae0992b65119b903b1409533a7e68965cbcac27584414cef7e7ac831e2e
SSDEEP 12288:deBNUbTVO86UC3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:dJIUd5bi9VUQ8D8UNQCgWH0V48
TLSH
T11085D03BEE28FCE2C27E8DB85A918600E77278314F6293CBD125824DDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fbc127b632eb47c4c35c043afd29b1f6a56e104659968ddbc27b783261dfa55a
MD5 45b47b8ba956f3b439d68ebc5f01d622
SHA1 685b327ae360843349734d70e864fd968e372807
SHA512 d170e5e63c11bd9fc0af80813759892fbaa78c6a483aab3a6a94220f9f8797b4ecea2cda0ee442f65b92563619caa7a3e03636bc3768d3d2cd8026ba5258cef6
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THo:pQvGAdlCEL8c/WRNw5CpY8WUl
TLSH
T1D7267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 9cc251c6475d7a8575f5319471977d1c114ee1500cfe7cd5c12e54e8ebd4723a
MD5 39accd7100c77cd15a98e1289f1a5ba5
SHA1 0264ec4b65f249a14d61f253fae6064153926f55
SHA512 607e3a3c34caa7f748a7526e0e9e122aa4764fa548c25bddc2cdecdd96e0c091e7e48af68a8cd95e0b587300eeb0a329e7b700071d3c2a99ec64a790ef2d6168
SSDEEP 12288:AAwSfxL/2Dc3oDLLmt0LDQewsAjw3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyN:VNewsAjr5bi9VUQ8D8UNQCgWH0V48
TLSH
T16E85E031FE75E432C27F0DB61B35D716282DB9204F621AC3E3A88A9D59342D26376B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c4dbd016c7a1733557d585746a23b6b1640ca5f2f48d98f82b968a49a4764473
MD5 3b6d304acf99a605fd7c6b68f2c87e77
SHA1 91efeae98db476875f6253e8379415d5ed004959
SHA512 dc88665087bc0db5c27427add617e3e23952cec6a3e4cc3ebaf551bc1f0290d281ab5994eb76e7ef76186946bcd4797cc6241503a8acfcac56adab41491e0ba4
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHP8tl:bUEtQevvqc2W1cpV20I32y
TLSH
T15A474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2fd1167fbc72d46d25e5352cbc613e3ee4e0ffdefc1facb99d85ef9004a83e51
MD5 9e329e9cf02997864031996f97f535c3
SHA1 26fa5bcc8dfcffbe9e207e0e44180a43e40a8cf4
SHA512 bb61db3a30cbd291575c9c4f3e44b86552ecbc475d0d2e2e26c2384b9c981efc1e7c042e58fb4812e068333e48f86ffa16888724c8721be417d0b408e9161f3f
SSDEEP 49152:QCbRquA/m2yL5zQfFiV+XenmE3/zm+QY8cdH0y8:5oqtVjnmtY8WUl
TLSH
T1A3D58D0976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 469df00fa01eb4d4aeb6bf95db545b89c62dd003d0b17c93404fc1088ffce92a
MD5 08b45e0393a27f2f146582032a1bfa14
SHA1 61959b202cdddf6ab039ed494c7d549fc0fee3ef
SHA512 1be3c461eac3b90b4411b9b1e2f4622a3e18ef258ba2033935460c5633dcee7649bf0b65805cdc5754bab6c7e4b4be1e58cc32ec80bdfbc693e8d636ec680c3e
SSDEEP 24576:eAhGL6IFoiwtA5l7S5325bi9VUQ8D8UNQCgWH0V48:eAM5Foiq5F+QY8cdH0y8
TLSH
T13135AD80E7F955D4F5B3ABB899B69171EA72BCA65E31C20F2110D11F1E33A909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 1903207b8f5d24d542bef6f529ba3ee4acdfa86db9c23dc4b5594f9ea545f8c8
MD5 085521bc163911ad2ce141009ab0f7a4
SHA1 9d8f33bc8d7979854ee3adc8476dd61e3d2ddc6f
SHA512 7bc3a6cc19d2bdfa33622001527e0e53bccaa9c1062d883f098c42c6245faa21457e55f28c19311a0953a7376ec2282a29ab98ffcffc0b9d49fb8e6a7b2b89e6
SSDEEP 12288:tmw5HEjsChNWBFgl0WDm+CR3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6Z:Iwu/OWH5bi9VUQ8D8UNQCgWH0V48
TLSH
T1A085F14633A51CFAE5678639C597C536F7F3B8022A25CB1F1360C25A6F37361AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 c71e18919a09260e72535ca2c30da1b274fe946f634e0912fd716e7a342be942
MD5 6db618503ac9ec6f68aec258fba0c398
SHA1 d5df6e6bcebae5c8bda45678c0fba4a2913ea1ed
SHA512 46f012714e5d23508c4ae0c3ce8b8b95723b55bac0e89f466d78e1c8f9b17bbcb83516e6e6065ca0586272690f578c14477aa0daba0d7054e3a95360eaced7ec
SSDEEP 12288:lIZ1IyA3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:2ZuM5bi9VUQ8D8UNQCgWH0V48
TLSH
T1D875124633A961F6D167873CCCE05A16AB72B463A73A43CF112542AC2F376D29D36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 256c834b5b964b32cee17055ea8473434add8e6032fdd9db80c8b5bea9163d53
MD5 1566e8559f5e85926e0d307eea993f29
SHA1 9b76a11baee03ab83667e8a2f573c620f9b6fc19
SHA512 f50eb41228702beb91e6d8df808aaf623caf033400b0b796aacad496d20279411f07b6f52ab94f15e0088d283b2d4582f5e0a0e500c966cb02b14fe9f0131b20
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UU:yQRQyi36YOcPDLvw2gAf+PN3SY8WUl
TLSH
T1BB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b6e18456e77c034d5ce7baa661b5f0fca23cc51d44ba738a5c63d31b42b6d542
MD5 6afa3a587d553cb24bdc0db8ceb173fe
SHA1 1cc526d0681faeb6d1dbf47d9f0919a8c3a1d146
SHA512 05d68259673673a7e262d9b817ca61aaaa9d752a604b19eda2948e10ec05b70a68b47cc3cf7388d4633d7c7b5302da94d585003bd3d52a67368c7764c2b076c3
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UU:nQRQyi36YOcPDLvw2gAf+PN3SY8WUl
TLSH
T111667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3f63b8b1728745d148070b1279838b8760150691f5b33e5126a3ed07a6c88a03
MD5 7160ce7d4b6e7efd414e865d991492ad
SHA1 7cb3aa5b937c35ed3673806c72a59e9966c65180
SHA512 acdfae6b7fa5d3078efa157f15cd9e8835a3bb64c6f9c355461624328938698c14d2c7f8ab36d0ed3faa665e7feb1219009f8991ecdb081bcd67ee7e693286b3
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL085bi9VUQ8D8UNQJ:G68Qg55nhkeWu7PNU3/W+QY8cdH0y8
TLSH
T1C7B54933B2F600A9C04DE1769F46973196D27C758FE0E3DB8511724A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c329892fda2851d54ae63f3c061a9d1e4567889f1fd0ad2c7b6fb26c473c96e6
MD5 c98543917f29583416a7828f5c972464
SHA1 5de340fcbc50f0d94e4e62d7ab3e90042802c834
SHA512 971333ef41b132612eca63c15009bab089e4258e33fcc68a6eda15759848861b2e3b4d439262ff3f90db0f78892b4a8dc831fefa920d4740d30f2055bdf8506c
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99q:Ly5112gYy5azzVvU69nLKnhZvY8WUl
TLSH
T115168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f0c07178de102808f33068acdc6f35fdb2bf78a7d7beaf7eb82d98348c181e98
MD5 3441ca0f9933bb482b65d5c1030879cc
SHA1 e579fb62cbff80f2dbb2b57ae2f2bbc3436e5a8b
SHA512 db0fadd7f29973acb54f510e92cffe76cc3534c92c82202e50d0ac0741982a91e3e4719602158879c500308b281d12e93a4db0af502cc2271711ef4388d32393
SSDEEP 49152:UB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl8+QY8cdH0y8:Ou6JmIxd2dqY8WUl
TLSH
T164D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073552A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e6a3094f5164536929d5febc4469904035fadf6b81c1779375b454a4a2da2419
MD5 bdb01c1fbcf46cb3a011af618802ba0b
SHA1 30a32044cd050185655b9100e4647c698ac30a2e
SHA512 51d4d41b646cbc6241735970bbe44d397096954b7a8e67cb795153971b73ff8b282dda6afbba45442234169db18d84f7ef0798767d1e8fe06720cee12b22b6c4
SSDEEP 49152:41hpsNoJpF1A67U44CwH7R4xo+QY8cdH0y8:4mifPqRtY8WUl
TLSH
T1E8B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c73ad2729883916ed02857fb4f85c9879906b9c1fea5e1cefc3860d9bb1fa98f
MD5 0d07afa267809991729428b71af1be7a
SHA1 ef43150c0209b4c7b5663ffdb10a172cf1cb9c02
SHA512 41fcbafa1476a27fef6f785268846ae8789c174afecb462b834191e46c42d5ec4ab25b1d4d4f0535246ba3463c889e0a86f3a648dfc1a103b20a85907a08a945
SSDEEP 49152:ZSuZQIY0Be2KkRVtOnks6NMHqD+QY8cdH0y8:35dKqi61rY8WUl
TLSH
T19DC5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 43f77775a875d5e39db7020821b8d69cf141fa9a4fd2d29fa7884d8721c7c27f
MD5 e6832c14413ee4825627e979e1048167
SHA1 68671d8f4f87918fc01c1d86bb4360cefed65dfa
SHA512 1224f794c6adfb0707ffec94450496ff7e5c97fe834dd8933c46b130fc443749196569f5c288b1dab4e05c82f8eaf195d72032398eed654a92dd002d9bcadbd5
SSDEEP 49152:KhtSn8EApI0figjgiDn0AP5ws+QY8cdH0y8:rX2iWphRY8WUl
TLSH
T17295BF13F2D900E8D05ED178C7568632EA62BC160B39AAEF0A50B7551F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 69efed2996da550c3fb5dfff724e37ad54352251b664d027061a8e0a25735e21
MD5 884880cfb3996c8835eae41fcb87d9a3
SHA1 e8c9a1740367df8f8e99b3a3718d0cce3a3688a7
SHA512 4da8934ccebfbb7a6f860fd0675852ca07ad6fae232e1f831b57f92acfea7ceae17276b4a96d3df78d35cea30bd4a10a0f8c08be5b5dbd45e73d070b25b2d4a1
SSDEEP 12288:a/3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:aw5bi9VUQ8D8UNQCgWH0V48
TLSH
T1D1652341761B9AF3D017CB798CA065323E52D897FE6E460FA10F60DCB53E1E684A274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f80d630866686b7ea8d42f4a52d02417566f3b7ae7a9c75b83c13c1ed8eab35d
MD5 eaf1fa3c7e09268a7a45b36aae29918e
SHA1 901e7cb21a761d9d19c353a83ba9750df4fa7195
SHA512 c1a8b84808ce2cf5151aa8521f97bb142dbdbf15a9f772f77186e3f414a0656c84c132fb8e4482e09789b8037b6ec28f310068ba200a90102ef5c8f6b5aee051
SSDEEP 12288:Vs3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:Vf5bi9VUQ8D8UNQCgWH0V48
TLSH
T1FE652351761B9AE3D017CB798CA065323E52D897FE6E460FA10F60CCB53E1F68462B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 280fa335ccbfcfb05c22a445575cc21151b01f6da08600b9d99c2871256580a6
MD5 73570314bf15441293067645b32b7589
SHA1 f0c07fe15db4fba780e7dea71a166fe4f783a379
SHA512 42713eab58eea50d0d776f4b272556e477a449f1d4db999804ece6c8a1c3cf8aedd1ee2f885dc185657fadd45ad597f8a6625cae170d6f854c5a129375459c4a
SSDEEP 12288:Qq3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:QF5bi9VUQ8D8UNQCgWH0V48
TLSH
T134652341761B9AE3D017CB798CA065323E52D897FE6E460FA50F60CCB53E1E6847278B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 b0a73caf0db2c0e6b5b7aad657f8a9c7d0cc87970b004b86ed9dd21e3641b11b
MD5 bcf22d6487db53e630de1af00a2094f6
SHA1 7eceac17a5197204b06be99d2e5a3f4e6492fe5c
SHA512 6d3de03cc3e16e07ac111516cb605984b4655d5a385ce5ba9fb5302e162ab2d481b8047f058511567e704c443dfbd40b73329423eb8e6e6b707ff0f0222d8a01
SSDEEP 12288:jV13I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:k5bi9VUQ8D8UNQCgWH0V48
TLSH
T181652351272B56E3D027C779CCB06522BBB2F896FB3A474F960610CC2D3A2E59871B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 61177e7e6f24214f82990a4f2e2019546183610dd942ca580748f5899db01a89
MD5 57ef3d8c61b62894685ae27cede8922e
SHA1 891dd0cfc754896bdfc8049e3bc0855b3ccb21b9
SHA512 aa9b2623a656b77fb0f4bb37cd60b91d848a7f731849766ec2a79c278f3ac95c5e65c1a3a58093dbb89a2a5c3ed5d64ad54665de1dbb84bdaaf980e497dbe46d
SSDEEP 12288:fN3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:fO5bi9VUQ8D8UNQCgWH0V48
TLSH
T118652341761B9AE3D0178B798CA065323E52D897FE6E460FA50F60CCB53E1F6847278B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e278470db5be3c5b97bdd2715089c2a68594d834f2718ccd8d2ab6b13ebbb0af
MD5 55e3653aa48de269b12aa7e81a0bc1e4
SHA1 f69f5bbd52efe34f23623af9c6c299fb14a3ed30
SHA512 2030e9a90b859008d95ccd4c8e89dc12997ba6a8395f6bf7d3ff8ed567b010f2fe7d2459ee418cb66b2c548b212b6d1c66b90affbdea88d3e3bcccc37327278c
SSDEEP 12288:WY3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:WT5bi9VUQ8D8UNQCgWH0V48
TLSH
T16A652341761B9AE3D01BCB798CA065323E52D897FE6E460FA50F60CCB53E1F6846274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 04471231be1f3f5adb001d1162409f846a8d3d3bf15a0b366d40121772a7f4d9
MD5 42267967de5800d2bc8c7b5526df43f1
SHA1 9f8b7aca0d3a026f28e8e1410c9f3edf20d7e54e
SHA512 0dbc682cae2d1beddc18472f4ec81f509dd1d362476d23d040ec4d6bf2294cad0e7dc329dc07f3486c6a3e4e0b66ecb651511773fdd9303a8e0019ac0fec2f45
SSDEEP 12288:Uk3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:U35bi9VUQ8D8UNQCgWH0V48
TLSH
T1A8652341761B9AE3D0178B798CA065323E52D897FE6E470FA50F60CCB53E1F68462B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f1c32d8f267e3b0c29f8851e71a05fb7e6dee687fc0e9b8bb5164856094fb31d
MD5 f5f5f99cef82275b9bfcfa11d869371f
SHA1 ad403990bfbc2a277f36b2f41159b7aa00e46282
SHA512 efdce31e2d88898eb791603e0a3bf18b7fb495216d9044a09cdf38ad184a5d4db47087593918825a784b2f2cabe00ef97df74c8315ee961526ce427026e63404
SSDEEP 12288:PiZwb5zzFEoS2cPvyM3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:qZM9zFVSO/5bi9VUQ8D8UNQCgWH0V48
TLSH
T183850295B3511CF5EC67823ECC618916E6B2BC5A5B70C60F03A4326A5F373A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 2f48a18fb0ca45ae3b67308c968ae3d2e8aa13905906c022ef3a2853baa54284
MD5 8fd21a1bad28ff1dfc02a5cfd94427d2
SHA1 a0d681ced34174886d8d6eefa86015656b30b3b5
SHA512 d6d99270e12fcf2a669ba2f8ed89e8483b2c82b7d8113ac50a9fbeb175c903bc2c7cb314fffd9351ec8296fbd8564e0084b44be5bd6b9e53301c0f687d652388
SSDEEP 12288:/T3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:/c5bi9VUQ8D8UNQCgWH0V48
TLSH
T16A652341761B9AE3D0178B7D8CA065323E52D89BFE6E470FA50F60CCB53E1E6846274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 a05fc42c50cfbf21c91f2ba656b3bcbe228f948c83073072f7feb025e9cfb409
MD5 74398bc8056a06468f2a3a3421620fe6
SHA1 aebc104a7d9555a3fab6b07ae1e8332300fc545a
SHA512 a654f58a9d8aa5f2ebcf890554075390ec6e47ea823bca87f21d783651b0737d3e36a5053ea362100ec3b8d2edbd2e88f4e0f4635a702a2ca6378745ee4a5d60
SSDEEP 12288:eH3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:e45bi9VUQ8D8UNQCgWH0V48
TLSH
T18D652341761B9AE3D0178B798CA065323E52D897FE6E470FA50F60CCB53E1F68462B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a55078c283f308586ba8760ae7a05426896ad547c3d8f6a5c28c952aaa62da4a
MD5 cb8deae246a26a9285361af1f8f710cb
SHA1 0dde229e8fca7762510f43d131a8f224fa60656c
SHA512 8b87a996758680cfd633a2c5a15972301804fa3f4408d7eaac0a256e508317f7c4b4f6f01c537a1611a913fac821dd6170b5ff81e12d98f40713239d8ae47cb0
SSDEEP 12288:EyPz5L8A3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:dzy75bi9VUQ8D8UNQCgWH0V48
TLSH
T1FB750243736631FAD1378339CCA11A12F772B8365B248B5F536442B92E372E19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 eea64465b8fc06bea0fb9aa35cfb748b526c896b818e313d7261cf197f5e28e3
MD5 d403a8503509adc5352d79c56912a189
SHA1 17fa79f3e0ccc616e38b3456094feb9b297a30a3
SHA512 5cadee33a85c8b243ab23dd0e708d4a11b17659c877510af2f3418b7e14a2b63692beaaf960652c1a8dede536faff373ca53bc818bc867a417b9ff00a0ba45c1
SSDEEP 12288:+T3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:+c5bi9VUQ8D8UNQCgWH0V48
TLSH
T17C652341761B9AF3D0178B798CA065323E52D897FE6E4B0FA50F60CCB53E1E6846274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 5d6a95217bcb38abee30e6be79f604f8cd9b5b28d98d5e5069d37320024d64ef
MD5 8095045e29d28929f4f78c21b5af0afe
SHA1 31fcc19f895f650b88bd98ed33b639f105293305
SHA512 d5c8e6701c50e88197e204be24731951e8349562f273e198d6160c473d98c3caf667f33c85e3cd2504ff15c7ab522d52b6b2b31a7435148d13d122bc8e7fe420
SSDEEP 12288:cT3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:cc5bi9VUQ8D8UNQCgWH0V48
TLSH
T123652341761B9AF3D0178B798CA065323E52D897FE6E460FA50F60CCB53E1E6846278B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 ef1024c5ca4a546e158b472895ed74f335178a3af99cabcde949b867867a8dbc
MD5 28412c33099302870e2c0994f4ff21e7
SHA1 ec0f22b77449dd2cf8d61f8d0f983f8358710137
SHA512 609eb257a376fef8df058db7f48081798046953c9d09fcf6243b251d0912fa73318971f3233afaf87ef0f4ab5b60265e224db7fad64fcc88816c6725d119d5aa
SSDEEP 12288:PyPz5L8A3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:izy75bi9VUQ8D8UNQCgWH0V48
TLSH
T19D750243736631FAD1378339CCA11A12F772B8365B248B5F536442B92E372E19D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 438bad0e4d88701318103c54681dcc7b8ebcc9ef2646023cfb4f7e635704f4c5
MD5 ea21b2cedc1dbfe8dc281bdf6e6beb02
SHA1 fa46decbce2a7313547b49faff64a0a426b34fb1
SHA512 aaf412265d99f440aa419bed4e06ddccf5fc1e85fff36c1cddf071e0027926de47e5073be27f7f4491725be55a8c5d4d0231f907c62aae136a9bf9ab9e86ed0f
SSDEEP 24576:VTqaLl3z0zD15bi9VUQ8D8UNQCgWH0V48:VTxLljZ+QY8cdH0y8
TLSH
T1DB850294B3511CF9DC67823ECC614916E6B2BC5A4B74C60F03A8326A5F373A15C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 88139d355b61ffc1d29c42d1b452316e49cfc1b6ab417957751320dc472fff6f
MD5 91e2835f463e0fd4be1d18f5681dfadc
SHA1 e3637fa547f80e71d9ea008ec5c26b13a03fc55b
SHA512 e1ac8df712cd23b2338badeb66357e92f87dc2c11af465bd41842a12808d59e95264f5ae3c204ba2ca41979118453835c2a5320d0c4660a5678dd075648c6253
SSDEEP 24576:Z3Bd9CHKy7GZp5bi9VUQ8D8UNQCgWH0V48:pBd9CHKya++QY8cdH0y8
TLSH
T1C895CF90F3E414E9F0B78A358C755512DAB67C9A5B31CE8F03A8265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 dd516865c20e70ba009e4baf08a90cf57eb3e3798a83891cced8d5ab8dbb9263
MD5 a884e655b1f7830f262d409e50ed1dd1
SHA1 68fba77e0b896a0a37705f4cdce82ed6f595abcc
SHA512 251ea8531f5d6076cfe4a00745514a0fb7b4f094024d3562ca7a322925ca54c9adc2d6065303b419ecdf94d6a8a4800e9cb61264cc479e9d919eab93c23d9b26
SSDEEP 12288:EK3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:El5bi9VUQ8D8UNQCgWH0V48
TLSH
T127652341761B9AE3D0178B798CA065323E52D897FE6E460FA50F60CCB53E1F6847278B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 688529a90bc3a14f45bf266d2b866523a9f1c41d2feb2ed0ca5a1495a3428de5
MD5 ba8673b3cd0077d8d1ac246d83182b50
SHA1 ea544013686f032b2f57a18618ef3d8bbc9b7465
SHA512 a8f83e1e5f26af84c2b1ea6af8e5d234066fae3a2dc8247a94c428870e612bf4df8ae50119d1e5be87a5359f105a054c0501b43650918c9bf6ee8b8cfc1f2fbe
SSDEEP 12288:xg3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:xb5bi9VUQ8D8UNQCgWH0V48
TLSH
T1B2652351761B9AF3D01B8BB98CA065323E52D897FD6E4B0FA10B60CC753E1E6846274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 a6723df84be4547fd580747f7b0ef8c638159a11151e20325cec22c0de9f630d
MD5 0eba293b122024deae57e24f3d1512f6
SHA1 cd434747b610c84489eca9135d99099f7dcaf2c6
SHA512 d7ec76f1014256bddcb5d3a5f9d84345780cbf6ef4633c807fd59a79d85a96b02e1d82862f98fad05a63d7dcbb636175fe7cd91cf2390183e6a53b03dba856d2
SSDEEP 12288:sp3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:si5bi9VUQ8D8UNQCgWH0V48
TLSH
T104652341761B9AF3D0178B798CA065323E52D897FE6E460FA50F60CCB53E1FA846274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 27976ce6ce1b940192dfb92ce31f6619b21a75d319ea56f640db59a6f230251c
MD5 19577fd79432fbc1d2dc469001b539e4
SHA1 be06604f07a908bf4d003af1e55c3b23cbc8f7cf
SHA512 fbd61d01b06a2cabab7e87d27b38827efac90c56f8fd2f9040625bee893506d01f4dc21e09d5b0b09a8619a3f1d602e47f1cbfb1ce921c81b3ca2f968dcf7f02
SSDEEP 12288:FT3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:Fc5bi9VUQ8D8UNQCgWH0V48
TLSH
T10E652341761B9AF3D0178B798CA065323E52D897FE6E470FA50F60CCB53E1EA846274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 8784d15aba0ac1770655bb95bff69565715de9ebc4de9a2a2377a7a6e26d768a
MD5 be76776eabbfecee30809b1cf79c7284
SHA1 e9a78678d9121c37d908580e9ea9a56d5f7c8d12
SHA512 0dda6ae7e844af40cc8540b51be31bf64fa4d9040816095d63bf8e8c1a79b551c1670c84b27aa500dd00b43026ca500de7ad9307f31866a6d08f8cf7f575f134
SSDEEP 24576:jfwvRk9RX6wkyAII5bi9VUQ8D8UNQCgWH0V48:AMnYI/+QY8cdH0y8
TLSH
T1E595DF29EBDC44E6E177923C88B3460AF6B178691B31C6CF025A53AD0E37ED49D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 531503fdd83a9122616c93929f7baa2a12348a4fcba2fb31924bd814e5faf356
MD5 dabf1acd3e14dea8626698e0f2ac2a42
SHA1 7c72111695e84447f425f2ad1efcfb924aa55577
SHA512 e6720bb435a6e845c74b410bd0b3fe1d32f67704898fb44e47f60ce891a28fa2db12eb3e4be31fcf16dd1215463f36c81ff48d7b017ab3fa0d3b4a79afc09b3b
SSDEEP 49152:RYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0M+QY8cdH0y8:oySzPyY8WUl
TLSH
T128066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8e4ceed11ec6d732d95a11dcbc9acc96b913313969d97e5a9055efbaa396f8c3
MD5 d28bb34c314ff11cf5daa17849a7001f
SHA1 63e83323c60ca93d30adcaec545eeb278f05a825
SHA512 1d92dc5775d72ac9566ba63755caa77ea908c8b3b810ba31dce6f02afbf1989b26b449d0eb9ca7d9a9ac401a7c3728f175170b045415443b32f8ca16a4cbcc54
SSDEEP 24576:v47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYP5bi9VUQ8D8UNQCgWH0V48:v47JUQjqirIhCnDHUPfF/8+QY8cdH0y8
TLSH
T17665AE1EA3EC01E5E1BA827885154A1AEA71742E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 c051fbe4654301c8684e1bc1024e19e8c32a224a2476ed4e2c1997c875e3e4c9
MD5 725eb6108c22439379b92b9ba1c2e243
SHA1 842de75963312683f1411fabb1b2fcd2d593c372
SHA512 926da1f0ea901046f1ee0ae57c283cf6cdf8628b33684e16e76ab34a5d1bc510ead8f879e0aa30c5896e3df975f422b74178c5249a19e4c6bf67d46203a0737b
SSDEEP 12288:+DsfD3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:pM5bi9VUQ8D8UNQCgWH0V48
TLSH
T1D875F00AD25942E9C06E9279CB515A01B723BC6697E5C3CF62C1F17D1F3A2D09DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 0135e22b738e2c83297abcbb5f814d997b319cb0004bc980ae62c47e6019b574
MD5 b6e59ee7c27abcafdc4857de228f50a5
SHA1 a49167087c45766fcbbdb3330631fc759783f657
SHA512 4563f02a262a3b6834418cd2051bb47c8cd73ad5d13148603477eee148257f93053151311671c6fe45e97c63fa2bb661c36f5545716ad6ccfa570d42dfccc964
SSDEEP 12288:e1G2U3f6EBuRfXEKKVIhwECT+Qd4WWZ3KxeMaRM9HlTeuJmzqh:e19UPr+XEKKLEW+u4WW0xDaRM9F61z
TLSH
T130352811766ACB4FC66940321E32D2CCA7707D15EE05AF0373C99B3F9576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 9ca28ea9e7ade7dca1192f5b8d0ccc3f734c6fe3106ffc3b7857f301faf75990
MD5 ba4579504a70127ba2d0937b6f7130a3
SHA1 449a610a4dbb6802616f46bba4a6c0af38a90521
SHA512 7755d0917a97457fc77a8be8bd534857aa4f3294fb0e07238d6ba094ca9758f84d270dcc0ff42d0006f0e924d0fff05d1721923fdb2a5c46d589a9fceb8284ec
SSDEEP 6144:md6DOdU2X0XcUaUaU5br6mb1oLUFMMyNtMxgyNtMx1nQTaXBi:M9X0XcVlebrlaIFMTi
TLSH
T1F145D8815037E78FD1BB6032032A5B8C77A4EC06B7496F26B3C9453AD81AB55A0F97C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

au.msi

Path C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_381\au.msi
Size 853KB
SHA256 9d4d672be69c91207923ef3540af4750322c43e0a3440126fbf5b4962c8c3052
MD5 b1a4cf35bc6913071ee217125bcc6788
SHA1 4818a036d75aa943e92353b638ffd1636ba46c49
SHA512 5bfde958292748f666d61b72401426bc5ab4bd564299e806d9c05722812156d6f7742bd2482fca308fc10cc27747a1f0b216a4a2596540cc987b5402c4fcea04
SSDEEP 24576:le/bE//5CbZtbotwXYMNMUEcF72VUnVMM:o/4n5mbbX3MFcF72GnuM
TLSH
T15B0533D266E539100CD0E7B0A253A67C90FE774A3460996044637675CB0FBCB67ABB3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe

Path C:\Users\Admin\AppData\Local\Temp\jds240730765.tmp\2026-10-03_facad586ac8a8acbfd758e7482e0fc62_amadey_avoslocker_elex_glassworm_hijackloader_luca-steal.exe
Size 1.9MB
SHA256 8b73184c395fac04d2dcb40244430a9b9d4e3094a06d8a4d129435e00f147171
MD5 a05dbfbe3a88017f1ec5b2abf96ed0ad
SHA1 7ee98080fe870e6be5828ab4d82982367532ddb3
SHA512 5a600c2984c761b34e1aacaa73c8e6848bdc488a9582c8f30076f883644a93455fc9f57a9bb142ae8607df2e2ef02522e797712ab35a957238865820a115457a
SSDEEP 49152:2XNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxpk:KIEeQfoR/IuOFVjUu5y
TLSH
T1C7958D12BAD58432F1B316319DB9C2695674B9A6873685EFB2CC561E4F309C18F32F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 9dc33f9c8a89c84e25382e48a6c39de69938998def8892b30d001b5b482fc94a
MD5 d377e8b0776fe055b93329a3906b7bba
SHA1 e539c9cb1ba315988ab06a1caf68127687e79469
SHA512 d32615e4e813e06f5b52651707deaa0948a78fe8bfc22ec55594f1d5760a58e01cb99b25cfadd83999323250e99f6c17c2b871b6ea0ba248f6d58e737bf0defa
SSDEEP 3072:Isn5U1t+kTcr43uBACl1YrAGqDBGGM/h1AJBZfIAkD7:+iTI
TLSH
T1D0F38587896E45BB30130BE7C3695C649422272E535F9A1D31EF86CFA445A03C67F8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 194KB
SHA256 95c7f06817c8dc3872e9f02d27decb27fa4a79879ede480bc87afd4a4a8024fe
MD5 f0aaf32e9c70eb64afa0edc2df2919eb
SHA1 e45bc7763a645238d8e4c7404a61d109c18da708
SHA512 0bbf5faa5a4ecbccfc1ba65299d54ef5a5c15b5f1c995cc2621d54bbba52b2fbb212d006f1ae06dd253fe0d645e0f84b144793a90bc68cead92b252e06650975
SSDEEP 3072:Isn5U1t+kTcr43uBACl1YrAGqDBGGM/h1AJBZfIAkD8IJ:+iTU
TLSH
T17114A647896D48BB34130BE7C3699C649862272E935F5A1D31EF86CFA049D03C66F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d62a8466063bc6b0dac7e65961d7b9de85452a0e22785c59c8a0328a8c4ac493
MD5 cadf03a591a89cff7d1f8b4a0feac004
SHA1 7a7b1b76136401b8abd31f052e78d552ff95dbfb
SHA512 687cad8acde96abfda5064255918515f636b174f67c57f47520489c04a1147b11590b3a6b9482231e68ebc0ff3cfc05e178c225fbe06c384401aaa380b299491
SSDEEP 12288:5+773I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:8E5bi9VUQ8D8UNQCgWH0V48
TLSH
T190652351671B9EE3E03B8B7848A4A5313A17E466EF29858FF40A61DC743E1E5CC7170B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f5907a638ddafc28a135807063f817d1845602265c6885c07455e8a72da1c593
MD5 d13fee40f3e46836b9b485ac4fb4e50b
SHA1 3c7d9652b600e7fc9ad6c5cf6ece3673cdea80f4
SHA512 6103a1f8f6ec42da062123e5f3fe2ca153ec808612edfba00ea5c451f96a2eb2065af957a7d4e5049935cf9ee0e4d7dc9ac39edef6a1c560dc980c03859cc20a
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYq5bi9VUQ8D8UNQCgWH0V48:kgb4mBIBhGFa+QY8cdH0y8
TLSH
T1A265AE1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 f29e04cffa3099221ad52f4c2d54e61c0f013ff9d79e63cc17d24829cc1cbb9b
MD5 36c2445f9d9efffd6bdf44fac05f764f
SHA1 eb55240ccc21de39caed470c490e12ad027826c5
SHA512 4ca4821a8d60ad6fd7874a91dd081c2091b0784872213469a2451c9fee5d95c1a988f9f3d675f0c0fcf619426da4dbb4c9113b8ec9e6f2fe935ce25a224490e3
SSDEEP 24576:tG88u8FpJqH19zria7/m/5bi9VUQ8D8UNQCgWH0V48:g7ZFPqVka7/x+QY8cdH0y8
TLSH
T16195F16177E102F1D07BD13889824663F6B2B4261364EFDF07AC8A951F236E54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b376521cfcb4751fa856c78de48f52df1bf52545dbd4e3c4cefcd9577651d025
MD5 40d2f1a0e1fd5d73fbd5fa0761971983
SHA1 4c5cbe4deb7268de3ddbeaf01e06520993a784fd
SHA512 0e018cb8ecdff67484259c5021762e0d134a64c70263708a0ad27b5165ba3fc808f76fb6e98c0c8e89a8a2d51300bccd24ea1b733e5ce8934875e21fe204f6b2
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjO+QY8cdH0y8:EG05lO43bXY8WUl
TLSH
T16CD5CF6A62EC11F9D1BBC17CD9C64A0BEBB23415033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d90df2c6998ff85d420b2c2f99a10c871ce120d22e6e743159c37685693c3268
MD5 71861f9577bc1d581aef5d51d9f8cce9
SHA1 e3092c11aa7f0a6c2ba18a0731f068bed5edb98f
SHA512 168a8dc3e5ca3bc6a05de965c1daded9a8ced328b298e6316f1dab453b775bd0a1ddcf0d68eabf50b09c1cfdf91f5196ebd7c663edba91e423135943e8950d66
SSDEEP 24576:1fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnh5bi9VUQ8D8UNQCgWH0V48:Va5POZ3lJt2pasx2+mW+QY8cdH0y8
TLSH
T11565AE5EA6F801D5D179D17DC583861AF5B1342253329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 55117f6f4813cd815df3f0646f1a02c14c535fee92ec55908ae01cc55f917267
MD5 b9919717568baf5bc0782bfb65beda19
SHA1 140cc631609cd995bea9302801a2fe876f0f3377
SHA512 e53e9771353f950d9574e7a07c2a5329c7634d83c6fb6786103cb4b5f2e7d9f0280840375252f19a4c032926868129e228118cac174c52277bf4d29182ac09bf
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7Fkn5bi9VUQ8D8UNQCgWH0V48:ENc/zEOVHFR+QY8cdH0y8
TLSH
T1B7858B1623E901E4E1BBE1BE89779546FAB1786553348ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f98827daf7d6598522c16bbf3447b9a5611d741cbce0fddfd87f9697e3e5cc80
MD5 effcc715b5dde6a62bffd8dd46694272
SHA1 50ba3118cb16510d7a30b007603dfe9d949a1262
SHA512 7afe20a75ca17dd7e8215aa09ffff483d3c5c2e8911bcf268c9b6fe8d8dc9c660e64f665034094121a0780a903dff9c2f6665b652f308eb9b68415b7529d724d
SSDEEP 24576:tzkNvNnaFeYhJNtmZBmt5bi9VUQ8D8UNQCgWH0V48:tzMwBtOm4+QY8cdH0y8
TLSH
T1DE55AF2EB6B846E4D1FAC6B4CD238512FA727461173293CF5290C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 5c7016d89b4ea6ce01f15affaefd51d11679e2f9642acec98d6d4a5534ba6233
MD5 ccd5ccb33a64a4f897e9145133693df1
SHA1 5833d678469b90d6107e8433716baa06c0684fd3
SHA512 209bd82b5e99315b548065d8dd0526b178070bc7cc71d0138b79b6159d107c1830b59ce3507929ec53e64bcb4b42d9f2fce6d9880c1792fbc690a04e0054e5c2
SSDEEP 12288:BHvUrBFrEjwaQo3I5+kPLCRgOei9VUQ8gq8UNQaSuokL822wyC03g6lPO8t:BPUr+NQj5bi9VUQ8D8UNQCgWH0V48
TLSH
T1BC85F12F22AD1CE5E676E17C89818719F772B4621712D2CF0291817E5F37AE8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 0ef5d6aea259dcf9c1a8de465f043db4309a2728cfa005f7918d112d50fd3b0a
MD5 cf2c6e42213f137bb7ce979ac089890b
SHA1 7e00c37ed3059335c308390153c85a30f1714f32
SHA512 252f75333066e81dc8a338894a0648641e94708c80d12d65e6f3005fcb9f1cfc7df1d119028fa9e8da9f1120a7404d6a12ce8f3659d620f6e444a1d7fad8a7e3
SSDEEP 24576:uD3FHshBIYQgAQ5bi9VUQ8D8UNQCgWH0V48:uDVHeBIAAn+QY8cdH0y8
TLSH
T1FC95E17EE75D04E5E47BC2BCC9638A06E77178A9033256CB029481B95F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-383-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/540-385-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/540-250-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/540-256-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/540-249-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1252-472-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1252-232-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/1252-227-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/1252-226-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1716-41-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1716-30-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1716-261-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1716-32-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2380-492-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2380-238-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2380-244-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2380-237-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2380-487-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2380-494-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2416-264-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2416-270-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2416-262-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2416-488-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2796-222-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2796-457-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2796-211-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2796-216-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4180-236-0x0000000000400000-0x00000000006C8000-memory.dmp

Download

memory/4180-1-0x0000000000C90000-0x0000000000CF7000-memory.dmp

Download

memory/4180-6-0x0000000000C90000-0x0000000000CF7000-memory.dmp

Download

memory/4180-7-0x0000000000C90000-0x0000000000CF7000-memory.dmp

Download

memory/4180-0-0x0000000000400000-0x00000000006C8000-memory.dmp

Download

memory/4456-298-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4456-489-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4456-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4456-292-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4744-194-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4744-180-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4744-181-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4744-192-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4744-187-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4788-142-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4788-148-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4788-149-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4788-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4788-320-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5016-274-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5016-280-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5016-283-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5016-319-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6120-197-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6120-203-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6120-196-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/6120-432-0x0000000140000000-0x00000001401AF000-memory.dmp

Download