4e4c5cb814c40eb6ca7b4c4abb78cd7b27bee5757c9915f7e8e56064c96a981f

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Size 14.9MB
Sample260729-caqndade55
SHA256 4e4c5cb814c40eb6ca7b4c4abb78cd7b27bee5757c9915f7e8e56064c96a981f
MD5 08b3f6060224dda44ae669cc19e112a5
SHA1 9475ee9fad617ef083628bd4b274a7175eeaabce
SHA512 e111e70235ea353988a9a6e920d62dab377f3d4c5153c3162778318ce6c193efec23289043e454718beaafea91ce223f6ce6f2b16a9226e5a5c12e1761328f6d
SSDEEP 196608:r7APUNNECwHrc8u3x3AEcq/fByuKlWH3CTou4Uf:raUvQHrc8u3xXJ/f4uUWHlUf
TLSH
T12AF6AE13B35681E6C02AE2B88A474212E7BA7C440334B7DB16E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c604-127.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c604-127.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c604-127.dat	INDICATOR_EXE_Packed_Yano

Executes dropped EXE 11 IoCs

pid	Process
108	elevation_service.exe
4256	elevation_service.exe
2852	maintenanceservice.exe
1224	OSE.EXE
3636	PerceptionSimulationService.exe
2824	perfhost.exe
1548	ReFsDedupSvc.exe
2692	SensorDataService.exe
4604	ssh-agent.exe
4260	AgentService.exe
3372	SearchIndexer.exe

Loads dropped DLL 7 IoCs

pid	Process
3596	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3596	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3596	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3596	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3596	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3596	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3596	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3d0b369d5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069915d0dfd1edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006734290efd1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c6e300dfd1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
108	elevation_service.exe
108	elevation_service.exe
108	elevation_service.exe
108	elevation_service.exe
108	elevation_service.exe
108	elevation_service.exe
108	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: 33	5760	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: SeIncBasePriorityPrivilege	5760	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: 33	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: SeIncBasePriorityPrivilege	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: 33	3596	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: SeIncBasePriorityPrivilege	3596	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: 33	788	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: SeIncBasePriorityPrivilege	788	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4260	AgentService.exe
Token: 33	3372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3372	SearchIndexer.exe
Token: SeDebugPrivilege	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: SeDebugPrivilege	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: SeDebugPrivilege	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: SeDebugPrivilege	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
Token: SeDebugPrivilege	108	elevation_service.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 5760	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe	89
PID 3104 wrote to memory of 3596	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe	92
PID 3104 wrote to memory of 3596	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe	92
PID 3104 wrote to memory of 788	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe	98
PID 3104 wrote to memory of 788	3104	2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe	98
PID 3372 wrote to memory of 5580	3372	SearchIndexer.exe	103
PID 3372 wrote to memory of 2800	3372	SearchIndexer.exe	104
PID 3372 wrote to memory of 4616	3372	SearchIndexer.exe	106
PID 3372 wrote to memory of 4192	3372	SearchIndexer.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104
- \??\c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2c8,0x2c4,0x2cc,0x308,0x304,0x140325960,0x140325970,0x140325980
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5760
- \??\c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  "c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_3104_MRYOWIOGPMKVJIYS" --sandboxed-process-id=2 --init-done-notifier=904 --sandbox-mojo-pipe-token=12055565548631369650 --mojo-platform-channel-handle=880 --engine=2
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- \??\c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  "c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_3104_MRYOWIOGPMKVJIYS" --sandboxed-process-id=3 --init-done-notifier=1492 --sandbox-mojo-pipe-token=7563786160032115703 --mojo-platform-channel-handle=1488
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2852

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1224

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3636

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2920 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2940 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 514022d6698ce39b0fd1c3f819b123a3e9be2b9c34e145135ab20f035d45bc4d
MD5 59c79101e5916df2403974ff3702041a
SHA1 6a29d196c2e60e2b05477a0a4dc07e50d22b7b73
SHA512 0d0518c512eb2ebd1db1b36368b83695ee08e8755df5bf15a0c9f3b0e089b72480e62e770674c9c0a97b5c65abc15e1a4316b50041884186adf3e91ff660101c
SSDEEP 49152:rb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnTgFIDRRAubt5M:53q6sjBXUf
TLSH
T1D3D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3466557a0db62ddedede0e320d06d8e51e9d79166a3e725de0a0b71e73f7e3ba
MD5 5b85e109d36a94b74a838fc9869b3175
SHA1 f3da4e5fc31d2c12dadabd0a5e56f8808521d2a9
SHA512 2b42e0d2e32dc3947b96d12a3815f4a3be74f887e6dd6ef2ad1a57348524c16632ddff7fe78a489dd34aa5d0023f1e781c5a80a1a9b3081b285b4c7801cd7318
SSDEEP 24576:iXYfDtczAeVg9N9JMlDlfjRiVuVsWt5MJMs:ptc1gFIDRRAubt5M
TLSH
T15985F12873D509F9ED678278C9B28502DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 5b8d46eaef0de50db531b8b57edfa1e7ebf646083867199791e3df25140de715
MD5 04dac40411dd5032a9de29358f407d20
SHA1 5a55578353c9269eb8d33d6fd87048ae7a096f5a
SHA512 4be712e79db6bdaee8a351d3620c8b79ad6cebea0ce4227d496cc5b86153499f6ea371e8409af2a78eeeed29aa6bf51ca5f7d6777d5da112e5bd3d46bc556f82
SSDEEP 24576:R0Le5ji0hmx7rMBVg9N9JMlDlfjRiVuVsWt5MJMs:RPji0A5QgFIDRRAubt5M
TLSH
T15B959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 15cd1ff11c67acf64be2dbbc551c347e80aff296ea2b76602c57b29dd86ed3d7
MD5 42655d02160390df8a16ceec73b272a8
SHA1 773538d8fda4c22106d658595615388dd10c7b09
SHA512 ecec367973020313ce6068fe6d8bb5bdc2d17558e7694bc8376085d6f5982070fcf2bc6981d29a5638341be4909b03193f04e8c6a2165d2fa32655a066321099
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWn6q8wyuXVg9N9JMlDlfjRiVuVsWt5MJMs:R/ezSC6vUzPveHjy0gFIDRRAubt5M
TLSH
T115755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 acf06d13f892beb9ca5e94f6c8ce9749d2980055d1555f3c84c09806dacc8c88
MD5 9678dcd07e140ab2bebbb811b2673712
SHA1 3679ff24e3d0c39771941e042247037a1ba7604c
SHA512 6b3e55f51a44e925d216194aae02e9586b816d0293e42126da3af3ecacbc0a283748363a448c3b2ae8f081f8836bb5560b7ef52a1698494117cd049175529e99
SSDEEP 24576:5VbqPb88hv/l+YaVg9N9JMlDlfjRiVuVsWt5MJMs:5VO88hXl+tgFIDRRAubt5M
TLSH
T103559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 91eebba5f7e6e0654a2431c54e9ec233903b39c69c90e9f61fdeef68aa137312
MD5 4aba0bfc9d780b85e0e80a5354d939c0
SHA1 4bb6befb14949ce2c37f3f107e6405626b4b0a24
SHA512 9eb919c197703f923f68e01ad4dca3d31a459e6d325c7b8158025c31d9f733ef6dda9b0532812c1df13f61e71157a58db41a2d9e138653b99aa8f510dbfcb16e
SSDEEP 12288:u9vV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:u9dVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16D6523AA7645A5F6C65B82B1CA73538ACF225F5836C58547C2B019D1C9FC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 240062c2354572f17b85992eca94238ba3762ab9a0b5876827cb64ab68d0b3e5
MD5 4031e033520e2e73f8e7f4d2da07d254
SHA1 ae1e8fc65cfe6c9d3f226fa9957af297ca8935c2
SHA512 366779a8ee2c9f20ea5ecd3c31478c4658350bdd4f080bb71765e2807aec93fee5258d2263822a888ff5f88f5662121ed713833362bc2ec56307a81eaa921dad
SSDEEP 12288:feBNUbTVO86UqV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:fJIUSVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19685CF7BAE28FCE2C27E8DB89A918340D77278304B5293CBD174824EDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ca6b7413e572ff8bcedbe3a075144bdf67227dfc526a220c6797d6f2e7e73454
MD5 57574a5e88c6063d9248d85df3ee1468
SHA1 fa36c050dbce4bdb93efa6b6a9cd880d65c6a736
SHA512 c8549c41f88f69cfec0e960821aeaa2de28e7af660cf733443a4936303512422192b6d039dad765027ce6f189ab3e04b8b37cbf2419e4fd13487e203794d47d9
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:4QvGAdlCEL8c/DRNw5CyUf
TLSH
T131267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 84d524f57e1b233aa36b8c35c58113c9b984c7398a588f99286f8c8ab739a810
MD5 a4889341b7451c0af34b88e619b79726
SHA1 19e7e2fa20ccb85340983ce419f25a70a76b6b88
SHA512 ae81d2f68b8daa129f3a5977b71f7695eee510c7fa807374557029f15bf27ac5ca56ded0876ca006c0fa01e889f3650d16cdac481095b42833e811de8ef4c4de
SSDEEP 24576:ySewsAjwVg9N9JMlDlfjRiVuVsWt5MJMs:5ljggFIDRRAubt5M
TLSH
T1DE85E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 04c65ae67ab9482a9039acba69a9398727741cab55a7867c0e157597ceb7553c
MD5 8390f971439cc306b46dc1c009b9572d
SHA1 a9f11e90bf8914dc3b2d18ca10e2ca37a5ef14fe
SHA512 10e903a9ca1899fb934d32f774313a4cd5d5267d1ef68cb38009025f9c139b1ff1dfb5594b5387897f44b7992eccb3fce567b2bc7dd23fd8058f4671802532b4
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH1Uf:/UEtQevvqc2W1cpV2tI321Uf
TLSH
T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8333ad5f73f565bb6dd519180726fd7821a86afc2cdc5546a2bc3142ec197a48
MD5 3e33eb50148cfb29280ad4c2e12967b5
SHA1 da00ce3aa4538a97f4a97db8673d4aa773c6c023
SHA512 5a77ae90e9261b7f77cd645d97850e2a74a05f0f25d94b6245d24cd0e6be9976e7ab5bc9b3487708be05f5a6fba90df2a33c39ac229ac02983d592a6b8260826
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/zAgFIDRRAubt5M:9oqtVjnm+Uf
TLSH
T11DD58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5f5ce50f1d648c386d2b91032c5e014179b4081a0ad335914800938354333651
MD5 5184109a24c35f4d38cbf015aedf78f7
SHA1 002f8b74aaba1c89238d5a242eb5786796dacddd
SHA512 771d86e954c16ca3119240c9f17064607fb7ae3ef8dd6aa6a5084b6e8072ee92e6a0221f043520ecb4e55238211280a2a6800d725d1162aa78020db66a233e35
SSDEEP 24576:hAhGL3IFoiwtA5l7S53rVg9N9JMlDlfjRiVuVsWt5MJMs:hAMUFoiq5JgFIDRRAubt5M
TLSH
T1B635AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 2aa50d80a6b8fe0bf1181c65dac8fbf19bd7c49458ad6fb3698364899171d6ea
MD5 86e237b50a9c520f59de0fb0579bb2e8
SHA1 a278258c073d9f61c98236604556b35799b97374
SHA512 aff3c76e323d2d2cc93d4509f7c3de9f352d3e18ef245d1122ecb758dbdc611c7d169aec8c744c277c435d757b54a903fd0df7e9bc6811fc4ff9eb7b937cf548
SSDEEP 24576:6wuWOWUVg9N9JMlDlfjRiVuVsWt5MJMs:6wZOdgFIDRRAubt5M
TLSH
T16585F14A32A41CF9E9678238C653C136EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 c5a2ad407bfd01ced32b339b05fd7c6a6b7685ece39aaa67926e87dae51ba081
MD5 a508036eec92ab71443c9bbe6f6f7bb3
SHA1 5bff168e0253448dceb21c181d2b895799e7fb56
SHA512 2596b2fd6d2cb6c9cb9bd6407131e12e2dd9c6990cc9b465f378f5dbb31929ef2897e51e57087ebb17319af6b0a7020a903af8c52e495f12cc18c9c076753354
SSDEEP 12288:x0Z1Iy8V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:uZuZVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T12B7512AA33D460FAD1A78278C9F24345CB72785633B243CF427006A65FB66D25D3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1090d327279c72269d1ca1525a4396bea7c3f4a9b3d29419026e792b14fa1489
MD5 ebccf5eacedc153359520721d2b6f3ce
SHA1 99df84f98609b5d443de6c584e3960b61c722eed
SHA512 82221636e4e6c9769bd9e31dec1ee4d774e2cc7169153c0f25e5ba941af0239c4d350a1bcc3ffef401febbd108e26487f17803cf277a1700670f2eeddce868b3
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UJ:1QRQyi36YOcPbLvw2gAf+PN3bUf
TLSH
T15D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c86b46a20fc0b6f228f7d167bd9e398eacba8ab18a53e3040eb4939bfd028e10
MD5 e4e1f2953b5ec0b1e41e4640056141e3
SHA1 5b0ab8171c6eb063e252882989da8d3cfa24030e
SHA512 13615bd656c6350c9124d3d2735155d686bf5c123e6b5a139501ce2d7aff2025bd9c4349719aae549a39875318ab5d66e0626c21048638555f35b81bd5e0c5d4
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UJ:TQRQyi36YOcPbLvw2gAf+PN3bUf
TLSH
T13C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 52305643d73cc58416d80600e6ea79f7841860b5731e793b4a6aeca49df1977f
MD5 f805fe46b7b003fa85d7b02d4bb66aa4
SHA1 76f81c67698fe6268ff3f2cca838618c84e89760
SHA512 b716293dd6573fa5f7068e33b6b1ed1deb7879f153a3f068a5c41a9335e1dbb0b9fb95948c887893bbd95ab58538e4e70476573bcdd3c42f2245d64381899355
SSDEEP 49152:+68Qg55nhceWu7PNU3/QgFIDRRAubt5M:MthLRc/9Uf
TLSH
T1DDB54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0def4f0d3ebf6363de36abd44b1320ece1b134cbd5ffd10720df2bf93c742b50
MD5 e73c5d3e14cd4202f5eea0ff2852a64e
SHA1 827cb6b622e81f133156adf46b2d5d304d4ce11f
SHA512 ed833cb02c1a4567d5e990a52fab7e78b1c15385df01703e340d10258f88628426ad423162e93ba4df110a52e6c5f4fcdf567f564b64a9fa3ccc64b47a89d3a0
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99n:Ky5112gYy5azzVvt69nLKnhZQUf
TLSH
T1D2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c0125284063d9fd0648fe4349b29eca8e599576c450dce425dab48053ca5520a
MD5 60cecddaf97181bbde4686dad088dabf
SHA1 3ac6cfe30b17b238f78b6a0e3fd6dcc6037e9059
SHA512 60501896ac4fa034a93727413ed5dacbdf6a0641a2d9a31aa9c0f2a62ea383af6339ef6ed28ec8bb30b87ad92dd7c5dc396a1d2a5e6c2f3c1471b10d7129c64b
SSDEEP 49152:VB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glKgFIDRRAubt5M:bu6Jmdxd2dzUf
TLSH
T12ED5AE13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fa86b4426a8c1854caf0da4460a11ff66f68d2aed256d3020589c8256bcafdbf
MD5 a77d25ca2eb5f94647576f87cf30b503
SHA1 c84d451b05d17da592520767ed4000fa76c5eeae
SHA512 0ddd96cb57b5acdd7e06fa5b2b6f0b2d7c90a8489f4aa617376cd0de1118be9d07bb5c5f7fcbddac8488991f2b7be4f50958ab0700354706a81a4a1d71c24ca8
SSDEEP 49152:j1hpsNoJpF1A63U44CwH7R4xegFIDRRAubt5M:jmifPWR+Uf
TLSH
T129B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 da3d069b62f6d95d5a2c6dd67890df66838a19845aaf5dc4a787fad8c3adef35
MD5 54d82381166285ca5ed8821c237693bb
SHA1 2c3a15924c1c192d98bb2b165dd842d1384326a7
SHA512 67c544eaa6090f16e085c3d83eeaaba106ce540362a92c8ee0b112baa2175d9301f7831b43e16ad54518562948f1d558140d362dd927dfcb551b58eafa6d9702
SSDEEP 49152:sSuZQIY0Be2KcRVtOnks6NMHqjgFIDRRAubt5M:O5dKii61UUf
TLSH
T195C5BE13F2E940E8E0BED674C7669232EA72BC464B34A6DF064072551E77EE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1bcf8fb0c88b92b24e71dd27c09381fce0c1223f71ea1b5ab666177e38a89955
MD5 d0f79b2a2f4e41c26d305907c3327555
SHA1 8b4eeadfc8be04d85398ef86158cf6d19c44e61b
SHA512 af09c8a321d9abdf90428924564dbcd9b9a86620ecad11046859f6fc749726c306d87ca82768b0fd481d149e7a9c52071677616ff31a15d3aaaed5807906d09c
SSDEEP 49152:DhtSn8EApI0fig3giDn0AP5wagFIDRRAubt5M:iX2imphaUf
TLSH
T11495BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 4b8765607ed2a6b9a9b607fb8c6263b7bea596bf9a77e5b4934eb370e215b326
MD5 9bcc59effb1ea994bfa2cf1c61a58288
SHA1 54237b3f1d9a307f265e8ff6115f7f43a192a62a
SHA512 15f16e5e1c1bc4154f68af94f5e74e744e8b170509a2721ff8711332d2ad592f0ce2566fafd0bad2c4ae6f2055d86c845242d42305abb80c082d9d3a0209daec
SSDEEP 12288:B3V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:B1Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F76523AE758695F7C50BC2B1CA735389CF262B5E72D64147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b9e20ab84dd60331540f463778d05044e3966410930e34c70f7daf8bcff6ce90
MD5 4d111a531d142fa191e2fe555d70a5cd
SHA1 3463a5840f23b1792b01b520fd614bdd92d6d304
SHA512 f2dc8ebc45539f8401466f964ca397e846fff31e801d0052aefad3f15c0bfb4814e70f9cd21392d2c094ad7fa4bb6861c9a2550102f6cd36df5e70ede865b175
SSDEEP 12288:XQV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:XcVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1836523AA758655F7C10BC2B1CA735389CF226B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 4c5770c5bde4274f551d6856d84890b053b56d37def3d225bdc45c2374a9758f
MD5 aa9a8bb7c1b94bc95dc81eab823a101e
SHA1 5e3768a12301061e93b86c8c255926518d1de37e
SHA512 bd259074bae76536c0fbcc385f6453bf1f99802192422ab2d8e4084ecf4cc086d4ef42b81b502ba3a2b3f6cf40e785fb3ea0fb7837dc4fbdc6b7b05c5bfb4973
SSDEEP 12288:GSV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:GKVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1256523AE758695F7C50BC2B1CA735389CF261B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 3dccf405a576308fa2966ba3cb7a9b1685668587b50e21297a54f2eb168d616b
MD5 a3529529178f885282e28233ad80ed9b
SHA1 5e9fff31324523849059c0bb87a4620b0a9ef245
SHA512 39e878e2c0731122c654b7290fe5c7222634a7a7edaa29b18e0d793572fcd1c883b2e183f655caf5904fde8e14edb417f98cb52cde93cdb77ac81869d552868b
SSDEEP 12288:XVxV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:VVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16465236A369651F7C457C2B1C9735345CB727E5973A2828FD27009928EF42A1AC2EFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 6bec1a2bcdccff1bced0111388eafe47d37b169292f1b114294a3af963a7b8e8
MD5 2f091ecadb33246020231cd7219881e2
SHA1 6d47d13a826a74602b467a0c60e98a3190d73059
SHA512 5a7c067ce1836476f16ab2bb4087f21a0402a3a1007b5c4f27a7bd061c3c90a3388f982d587a5d6faf9aad2092dc9304d2ec3b0116de18bb9b86180031e3890d
SSDEEP 12288:7JV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:7zVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1656523AA758695F7C50BC2B1CA735389CF261B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 e0aebf75e56a2ccede03e99b26c06967289bd5e368f6c6b1818a772e20a94139
MD5 d3243468ce262e6a7fe3485b10a0d9c4
SHA1 e0fd5d46d85dd44154be994f57dfebe4cfae2f3c
SHA512 fa61bd4c15e097a8f59887b570bfd0f236c7f2d995cd0ad83b111ea424d64b884b3c29d9bafbeba6d7a055f81186d45860487db22079592a1cd7ed41c658b718
SSDEEP 24576:Rfwv2k9RX6wkyAI9Vg9N9JMlDlfjRiVuVsWt5MJMs:JMnYIXgFIDRRAubt5M
TLSH
T1BD95DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 96f9391bc475f0b6d0ac02586578bf573cfb0bc212bceff3eed48e21bd0b69d8
MD5 b7b638f9a8141abdf457da8408f78437
SHA1 afbcfa0882cccd7b2c1a6e852e494fedd35f7893
SHA512 16bb889b9ef91f405c7da889a8071c33d74e431b72a19e064e2088c053d1b791ab1e9a544496216d963403016c4a2820eb691a33a530d22ccd5afcf31f939b6b
SSDEEP 49152:HYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06gFIDRRAubt5M:iySzP7Uf
TLSH
T1E9066C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 172edb03902ef10e6820205bab0925eea144686f24a6fda912f3ddb21d97cd71
MD5 ad47861cf7a3b216f84cedb479b248c4
SHA1 7976ac976a4f956911eb6d3d11e5930483dc227a
SHA512 03ce8cd864a526a55f9e2d9e838824f0675e3a75a08fa9e27a790ddd85d7fdd2b3051fcb23741ec644e55b22dfe7bd06bad32257f60ed6b74356d773fba701b0
SSDEEP 24576:w47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYMVg9N9JMlDlfjRiVuVsWt5MJMs:w47JUQjTirIhCnDHUPfF/KgFIDRRAubE
TLSH
T1B665AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 04e8090b0139e9f28d76b181f3762c097afd7e6b12ca64e35d3567769165b3a6
MD5 4baa9a640fb52bfbe5662100653da774
SHA1 287cd2541da742d4d6c814fcb476e83cfe8728e9
SHA512 ac1208c6c4e2cc648d9ed3dfff637643c5a879ec863cc56c59b6e348ac5e33c9696590fb7e731a8fbb54ffc6078ce68d5178a02463ed2db27a98e1a6f5173dd8
SSDEEP 12288:TVsfTV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:4ZVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16E75F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

software_reporter_tool-sandbox.log

Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
Size 4KB
SHA256 c80d044222c8be5d2af88251d3c71b4c8c542d4ff8596ff3a879152ed35ec784
MD5 de4568dfb435b6a4a81c85d57bab3959
SHA1 e63d22eacf9c3be78d9aff8254f15cd3f973c22c
SHA512 e5fddd452cc69206f5d290394be9cd227e242c2fd317e5e7fd8adceac1ad78d93e004447939fdae5d4a1c2d02509701b7eea596a47fc621992d8eca3b67ce5cf
SSDEEP 96:xldurw5axgbs3uz3fLuyQw452Ixg2J3333sID9byyy8YBXjMmjMGlGxU:Pkws3w3fjpFsPJ3333sID9byyy8YBXjV
TLSH
T13E91CB11C2E65BF9E3EC11F5A7BC42C3810A367E664FEA13A9342604B57098D7EFE548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edls_64.dll

Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
Size 449KB
SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
MD5 79d7f318441c21d17739e43990697d1d
SHA1 9683265bf401d11313b768dfc4b3aeb10015d18c
SHA512 67c7a7d3bbadeff21951809d2f843311328771ed46bc1ca14edba486263f56f86922668dd89d11b05a16130380b7543f7c9556d79503c505807407763e9d3595
SSDEEP 6144:erhGPDtCaTOgr01SkzjvPm5VZWLEo9yT6BT52V5GVl0GLohOzNh3237+i:bCI01XXvu5VZWLEo9oO4Kl04oOi
TLSH
T10DA48D1A62A804B9E1B7D13CC5975906E7B27C060361DBEF03E09A766F277E05A3F361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

em000_64.dll

Path C:\Users\Admin\AppData\Local\Temp\em000_64.dll
Size 37KB
SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
MD5 f8b7cac6e9587baabf4045c34890c7ce
SHA1 61814262c6ee5ceaab2c0263c913cae52e203af7
SHA512 4f80021fa2a6e6bd3cdd8248d6139d105dca984a914184d5b1e251e97daa77e36c4e059ed3a617ad12dd998eb603accd34ef3951261ad997a081d8ac934b6211
SSDEEP 768:ex6o63Gv6BzDVziDZI89cNdpl3TLZOTzKgJCp:k631Bzhi8pTLZO3s
TLSH
T1C0036C8603880048F577D23CD9A65A17EBB8B46153B087DF22B492DC1F73FD6563A3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

em001_64.dll

Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
Size 378KB
SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
MD5 7adcb76ec34d774d1435b477e8625c47
SHA1 ec4ba0ad028c45489608c6822f3cabb683a07064
SHA512 c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4
SSDEEP 6144:VGqy4O8+MGgjVs1u6yMyOtQZOO5DHlfYpbN5yxF6gKGJSd:Aqy4O8cz1TyMyOtQTDHlfiN5y3J+
TLSH
T106845C57E3E810A8D06BD178CB679513E6B6780D13205ADB13A0DA7A2FA3FF1663D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

em002_64.dll

Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
Size 2.3MB
SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
MD5 b03b34bf2cd409714e8bb7e670b3315c
SHA1 ca59a059824a53fca8966c6ae00d4fd3b94265e2
SHA512 fb4218f55bfff09ae13392d0cce3518eaff1da9b9d42d59a21ee1bb9ba42b574923858a7c23ae4bfac61bd5f977ea3e520ad5f7a69454eb59bc34bcaa13cd737
SSDEEP 24576:vtLiS+RLoxv6yd+V+vVdNdOYRoOD0SKOymjxrOSszUeazAKCMpJ0IQqhrHOo6:vtLiS+m56yYKAxocAewCMJRhrHW
TLSH
T14BB58C35A6469AF2C61ED731D6AB1501D21D326083E8BB9F061412243B8377D1B7BBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

em003_64.dll

Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
Size 1.3MB
SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
MD5 7f3e3ab3e7f714da01ec0f495982e8d4
SHA1 a6cdec146f2eb192460d3d3061baf4a7ead6ee22
SHA512 493b6db2193cd91e95f0963b9ad898a2040c2abcf1b4a509e5a4d53980c95ec030b412e180c26a1bd504e4c839ef5b7e3b6f08878ec11cefa531157ef0f6368b
SSDEEP 24576:NCPwYocnI8u3rDoXE4KRJa3cvcQiwJlJTrJ81yli7fKZShZkY/6Og:NCPW8u3PY0RdvTJlJJ3Gav
TLSH
T1B4559F5AB3A811E8C22FE07CC65B8E1BEBB6345513255AEB16B08A752F137F1173D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

em004_64.dll

Path C:\Users\Admin\AppData\Local\Temp\em004_64.dll
Size 6.1MB
SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
MD5 ee46beaa6c9244880e8a510d080b4416
SHA1 a83c3946a2f53f064e91d8b60d5f6c697a560062
SHA512 4e69dddd1215b1675bac788996019ef3cb22418fbba75c0c7935dafb2b1742bad79cc9ea6814b5f8d1663657a7987499a155cdf57733d1afae42b0e25d475c25
SSDEEP 98304:bkEszWiC/f35DKJU15xP7GqxQWCSVzdj+ia:YEcq/fByuKlWH3CB
TLSH
T1D1568D03335BC697C46AA2FC89474356D7BABC440325B38735EA975E6F0BBA89277340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

em005_64.dll

Path C:\Users\Admin\AppData\Local\Temp\em005_64.dll
Size 576KB
SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
MD5 169a2ef320119891cf3189aa3fd23b0e
SHA1 de51c936101ef79bbc0f1d3c800cf832d221eef8
SHA512 7fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca
SSDEEP 6144:uNco9k7OQQo6vefi0Q2MqwdWny21dT824+3qbzLtGY+XCVXw4k3gRh/fMSvs:pou738veK0zMBd8yqdTs/LtdAEW5
TLSH
T198C4298BA7A5136CC17AD634A6678913F6FE74090334A7DB43D098722F53BE09E7A341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 902566f631dd5f99907ef283d098af1a1402ab50eff396fdfd7eff1b93654428
MD5 887d491d22ed3cf77525fb9ff58dac6b
SHA1 026fee7eccfdf26edf2ee2242b1e625a7ac4788b
SHA512 bc42138a17e89da84b000a8a1b71fc75fff323bd34a43012918203ba09ef0af0ba5d7604656ebd16c4d4a0a926dbc13f80c31ca4fe3156455079721054c87198
SSDEEP 12288:F+7rV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ghVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1D365237A768999E6D46B92B0C97393058B2B7B693BC180C7E17005D199F81D1AC3BBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 27c22359311110c4affa0e6f42dbf03066fc71b11e187e48d7738f89d4874cd1
MD5 da1f7182af090d4e1b804586286acfc6
SHA1 15267286b4035a5d4ef2d6d4298ac52ea3814b72
SHA512 344afc0183f9fb2c729fc4b89801f5fde9d5b61f110be60f57e8ea41c7057a672390f518044a0076daa097135a084ed6dc5bd61f797cc0d800db65106b50064b
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYXVg9N9JMlDlfjRiVuVsWt5MJMs:Cgb4mBIBhGFsgFIDRRAubt5M
TLSH
T126659E1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 edb52feec3232ae334e2f8542cfcfbb9202b00c1c8069a0d3c6441cbb3daf321
MD5 728c6b883008ce6b73fcc723bdeee201
SHA1 0eb765c7d9105567504f35f68c343fbe5b51616a
SHA512 9c2f49f03192a97ada725f46ea306b4fc78ddfc6300cea0f7e4e17ca1271a96707d25b4374a946d4c258b3fbc1615f05e37a1b99e9d22cdb6ed1e0d27c9598cf
SSDEEP 24576:wG88u8FpJqH19zria7/m8Vg9N9JMlDlfjRiVuVsWt5MJMs:j7ZFPqVka7/tgFIDRRAubt5M
TLSH
T14995F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7655229f813e269510590ff8a39e65957addfc7930c3234665514db1abf49c13
MD5 de985440ae60b6a661e27b219316f877
SHA1 82316f99d6b0026ae8589f125eee6aca8cedd729
SHA512 f13ebeb57f6d18bbb2e3a5ee45b513e2170d50490bfd61081ad459b6780ccc61a08fbd15cf2a786419aef2fc8a9341f3117e5bedb396ec8f32c00e88fdf59f11
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4gFIDRRAubt5M:aG05lO43b4Uf
TLSH
T1CBD5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 73a0fdbc05afa6d14f1bbd3cacd45ca8c999a4ee40026b621673f323a84a5051
MD5 c7415bc1cfa0d61ce22e1782077dd1d3
SHA1 e91df30a1bb68e63ecdeff88bf9ba2f2eccec77c
SHA512 1ad24486a2c6e004681c294446e58516a88a4109925e31fbde504c2b810f7e12c0c3f87f0ddeeb470d171b30111cbf3cb510bbb024cb721d16ca930bd2f284fe
SSDEEP 24576:4fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn+Vg9N9JMlDlfjRiVuVsWt5MJMs:Aa5POZ3BJt2pasx2+mQgFIDRRAubt5M
TLSH
T15E65BF5EA6FC01D5D5B9D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0989f2ac2376494ff9b050b16173ab36f7ed411cd05c287f98e38e875952609d
MD5 2316ea7818d8534c90ed5e76c67ec1bf
SHA1 fb91c3c5c710cd0003128670e6a1627654d318ff
SHA512 49d7133536060c4aa8693e71e6fecadb133b38cbd11b19751cdb4ba7c7d5705c5d44c70d0d3994f2f15297d2d3c7747113e2af81615a42a9054e2a0a7e32261c
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7Fk0Vg9N9JMlDlfjRiVuVsWt5MJMs:QNc/zEOVHFNgFIDRRAubt5M
TLSH
T1E2858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1b77be7363edde375510143985232732e82cea1f0c7a17b5be7536290c1b2b4a
MD5 b5090363047dd70a7bd67495e869f508
SHA1 6afacedb1fed59097b6ab8d14839b85d09e10cfb
SHA512 44d3c5883366f2097cab081b025fda49aa2daead54fdeb529d62334375fb93fa2625c373e42735fe54b7f21f140e0c299edf9be020d712db8c768293da5ec9fb
SSDEEP 24576:yTkNvNnaFeYhJNtmZBmiVg9N9JMlDlfjRiVuVsWt5MJMs:yTMwBtOmOgFIDRRAubt5M
TLSH
T11955AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 ea1a60b7316b59ca06ead67f4efdb28431af7d167816b09133cc62ed5199c236
MD5 c9411785a94f13015f5080829e3cbe21
SHA1 08e69c55a49ff468078a47dd93a9b09ccc5010ae
SHA512 80dcad750b264c1f0b1554c501356a60d8de79412216f1f5910f118beed3309f55df5a8cdb06f01244e079664becd58d9ac82304996376781212c2fdecef92da
SSDEEP 24576:tPUr+NQ4Vg9N9JMlDlfjRiVuVsWt5MJMs:tJQIgFIDRRAubt5M
TLSH
T1DB85F12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 eaf2e8c4e04603987fdb805d6636f7cdea9854ef651308e84308a363a727f23f
MD5 224dfa56e25551dda9bef798ee35432f
SHA1 c284e8fa8a4e9247d63a071bf4d09468d65098f8
SHA512 032cf04837434c7d86a1bf0c3b28dc96a1f523a817fbfb21c75d30617406c271d2eea0f356f151e22000118b765bca6ca66ed800063123d6eb56fd604e0aa91f
SSDEEP 24576:rD3FHshBIYQgAVVg9N9JMlDlfjRiVuVsWt5MJMs:rDVHeBIAAvgFIDRRAubt5M
TLSH
T1F595E17EE69804E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE47D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
Size 40B
SHA256 e87c26a0c04c4c067d72e9695f68b8ce1514c474776bedc467d4aafb38f9e755
MD5 0b2530b7c0286a065e46f1d12b653b6d
SHA1 e834db3c2cb664722ff0755a63504a60abf8744b
SHA512 83cf78dfa76275ebaaccd2a889aaa47c079a0befd1e60ded1ba13e581ee3ea368291cab7e0333afe456be00495c8d7c24003db09982131ce0d506e15df739a11
MD5 SHA1 SHA512

Submit Download

memory/108-137-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/108-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/108-27-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/108-21-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/788-154-0x000002963ACE0000-0x000002963AD40000-memory.dmp

Download

memory/788-155-0x000002963ACE0000-0x000002963AD40000-memory.dmp

Download

memory/788-158-0x0000000140000000-0x0000000140F04000-memory.dmp

Download

memory/788-487-0x0000000140000000-0x0000000140F04000-memory.dmp

Download

memory/788-271-0x0000000140000000-0x0000000140F04000-memory.dmp

Download

memory/1224-85-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1224-92-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1224-86-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1224-229-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1548-138-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1548-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-251-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-140-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-384-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2692-173-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2692-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2692-167-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2692-306-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2692-291-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2692-166-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2824-114-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2824-119-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2824-113-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2824-236-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2852-66-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/2852-57-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/2852-56-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2852-63-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/2852-68-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3104-19-0x0000000140000000-0x0000000140F04000-memory.dmp

Download

memory/3104-0-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3104-7-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3104-125-0x0000000140000000-0x0000000140F04000-memory.dmp

Download

memory/3104-489-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3104-491-0x0000000140000000-0x0000000140F04000-memory.dmp

Download

memory/3372-209-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3372-215-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3372-345-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3372-208-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3596-48-0x00007FF907F50000-0x00007FF907F51000-memory.dmp

Download

memory/3596-50-0x0000026F114E0000-0x0000026F11540000-memory.dmp

Download

memory/3596-488-0x0000000140000000-0x0000000140F04000-memory.dmp

Download

memory/3596-187-0x0000000140000000-0x0000000140F04000-memory.dmp

Download

memory/3596-47-0x00007FF9076E0000-0x00007FF9076E1000-memory.dmp

Download

memory/3596-49-0x0000000140000000-0x0000000140F04000-memory.dmp

Download

memory/3596-51-0x0000026F114E0000-0x0000026F11540000-memory.dmp

Download

memory/3636-101-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3636-103-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3636-232-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3636-109-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4256-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4256-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4256-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4256-165-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4260-201-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4260-203-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4260-192-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4260-199-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4604-188-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4604-185-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4604-179-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4604-311-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5760-17-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5760-31-0x0000000140000000-0x0000000140F04000-memory.dmp

Download

memory/5760-136-0x0000000140000000-0x0000000140F04000-memory.dmp

Download