Overview

overview

10

Static

static

10

2026-09-29...a-.exe

windows10-2004-x64

9

2026-09-29...a-.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 15:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.9MB
  • Sample260930-slbatsxfpb
  • SHA256 97a8990dabed41c59fa7bf67f31d173fe5c20a1ce10a6ac843f21550a0778679
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 1 IoCs
  • Detects executables packed with SmartAssembly 1 IoCs
  • Detects executables packed with Yano Obfuscator 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 50 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1240
    • \??\c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x300,0x2f8,0x304,0x2fc,0x308,0x140325960,0x140325970,0x140325980
      2⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3264
    • \??\c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_1240_GYSSWMMGDFQGTZIU" --sandboxed-process-id=2 --init-done-notifier=876 --sandbox-mojo-pipe-token=12081131854301437513 --mojo-platform-channel-handle=852 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2000
    • \??\c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_1240_GYSSWMMGDFQGTZIU" --sandboxed-process-id=3 --init-done-notifier=1476 --sandbox-mojo-pipe-token=7863575170723582983 --mojo-platform-channel-handle=1472
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4976
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    PID:2748
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2880
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:792
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2008
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:6036
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2940
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:5744
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:5840
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:6128
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5356
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5720
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:2840
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:2208
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 956 2848 2844 940 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:2148
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 956 2936 2932 940 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:5396
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
            PID:3624

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 acb907282e23d8d4b643c7d9eca8c2e13ebd3f9634aa39bc551f2f6a61285228
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.4MB
              • SHA256 310034b0723af2145a8f88c8380a5c16d5f172809416691ae77feef51311d2db
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.7MB
              • SHA256 72034af6dbd00346043dbc4dbb9bb837b435ece07293952fa53eee85981016ea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 f2ce914957c9717e98a6be03292b9d3b31de1cd4399551068a270afec308fca0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 c3416da698c740e1788a4112f95659fa842bc0ab6b62d3cae3d52d746654cc98
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.2MB
              • SHA256 228f30f769ec06095200c56e2d7c736b1fc6e6b7801fa6e931887e76cbb80ae1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.4MB
              • SHA256 c1d6ded4297af4d806206fc1a6b7c1255110d5f735f094ceb0fbbaa7e2e52dff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 164dec6aaf8c3741c68f349e14cca0a296781821b2969f48fa6f72e03924ddc0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.5MB
              • SHA256 14e555ad104cee4f730cecfdff568317b4480a4bd51a1155f69047e2220045df
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 e4e391f872c40e6b8e9bd278fa1d8a97e7d2ebd86d14f2d7d11fd762d077d2ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 ebe0372c931d01444c24f80c687a31d6e9807f4ea890bc18e276b60d089061ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 069f4de9e2344d0567ffd433f398a4abfc091dfc7940466db5142f3a929d573a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.4MB
              • SHA256 064ef1df4de06fee45fcd4220028d1716986d4ad01b3a7005c60bcf1b43af734
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.3MB
              • SHA256 c1d24a5fc2fa383474182352caf9952ecff8470d4ca6decdfe40ede48ee3d681
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 f0275199c279ef3931248e3187817c035b29531d593e3639bf5b40f049e8c11c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 9be28309e1665b6349151d6d35e852c53a9ecd0f9fc9f87243d747ee07630793
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 795c55af6fd1c88d98159508b5f84c938c2fbaa26f32f9aa2761d36e0918c068
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 cb3f6f6d969695246da0a6011eecf0bacd8cbb57ec9a6269beb58b4d8fba5e10
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 7a35bac28103537c879d842772edff2570719282627936d5810b518039bcc3fd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 c3bf9d0bc22c53f8072afa23800ca7e4a26ed0a2de3204093a2cbd33d41ed5b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 299230b59f5317bb85c6ac81d37878d0a33dba7d2c3ac3aa1362fea9fe1ca522
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 f92a0a7b51a920750d49d8f06d57137a27afe5bcd2185ed80891ad4fffa941de
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.2MB
              • SHA256 1bcf3acb48183a0d0100bb198927e0b80882a5ca7b24a640349e7d76d7191a2c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.2MB
              • SHA256 cb12f356848c3d05b80320db366a96bd8919339ed9e0ed2c43f5d23da873ccc9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.2MB
              • SHA256 adf47dcdbbcba4c1076e7c161aa65dc4be507a700f913e395e25542ded3faba0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.2MB
              • SHA256 e623132bf67d56e755122de49c7585a5a3535946daef1fe8dae831aa293bbf45
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.2MB
              • SHA256 6c29de4673cd8639a8b9b22bff1418f2c04bf6ba7446ea473ddf552649a0d10c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MsSense.exe
              • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
              • Size 1.6MB
              • SHA256 243b805c15d1c8f587cc491dc16552c802f709c23665ffa5b9c0f5c29651e667
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NisSrv.exe
              • Path C:\Program Files\Windows Defender\NisSrv.exe
              • Size 3.5MB
              • SHA256 921c2bba09bfc20cb20050832f3d5da3bc96665dcbdb380b36247e24d7729689
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.4MB
              • SHA256 bf0c9baf7b7feb954137b2d2499fbace97f4b8e40709a1eb6c7514b9c72c2872
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.3MB
              • SHA256 f78afbe3b2e98ae15819857f574934ec5c6be8b6b7f16b9d013b2b1f80cf9e32
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              software_reporter_tool-sandbox.log
              • Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
              • Size 2KB
              • SHA256 243405a2790bd619ce228a91baf9d98ebd07382c16084140aa196c60a7c054f7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              edls_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
              • Size 449KB
              • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em000_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em000_64.dll
              • Size 37KB
              • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em001_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
              • Size 378KB
              • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em002_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
              • Size 2.3MB
              • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em003_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
              • Size 1.3MB
              • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em004_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em004_64.dll
              • Size 6.1MB
              • SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.2MB
              • SHA256 793fe32b44e00a0c041017ca61fdee971bcbc2ec09d607f039e08e60b002d73f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.4MB
              • SHA256 607d7517390086b1fa393ad55bd661211aee6f74107ed200a15d63f113289c58
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.7MB
              • SHA256 a08b6e9167ec784ef2f1440a0651592fd4ec0bd09ed50ce5a5e4f315fcb7ffc9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReFsDedupSvc.exe
              • Path C:\Windows\System32\ReFsDedupSvc.exe
              • Size 2.6MB
              • SHA256 20c0cdf00e001684d5cffd2a9e76f22c3949c9ce039e57476dbb9ee3c3543b4c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 a3413e623820e2e5d4fc3c5743ba995fd7ee487c2b8db981b2f0f5b1019aaac0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.7MB
              • SHA256 2f60d394b8620cc26e9bb4dc7f4dd651e81414e11b5f6a708519663c10b36f69
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 1753a37eca05eafe302b74ddb12b331d610fceae077179a5a5871e86e7bd7090
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.4MB
              • SHA256 67ef2e33156ecae9d1e753f204e96cf0ed85d24c7578c10d9ef6abdc93c1fdcc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
              • Size 1.6MB
              • SHA256 40a342d57c6735cfa27635e714dd5e2eacd5fc8a734ad1a510ee930b657419b4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              settings.dat
              • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
              • Size 40B
              • SHA256 8a0112a9c9308849faed5cbfb53bdb5bc4b570fa0df6426f1a15884e4034d734
              • MD5 SHA1 SHA512
              Submit Download

              em005_64.dll
              • Path \??\c:\users\admin\appdata\local\temp\em005_64.dll
              • Size 576KB
              • SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/792-108-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/792-102-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/792-112-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/792-114-0x0000000140000000-0x0000000140214000-memory.dmp
              Download

              memory/1240-147-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/1240-9-0x0000000002090000-0x00000000020F0000-memory.dmp
              Download

              memory/1240-8-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/1240-0-0x0000000002090000-0x00000000020F0000-memory.dmp
              Download

              memory/2000-26-0x00007FFEAF8C0000-0x00007FFEAF8C1000-memory.dmp
              Download

              memory/2000-25-0x00007FFEAE970000-0x00007FFEAE971000-memory.dmp
              Download

              memory/2000-30-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/2000-28-0x0000020B5D350000-0x0000020B5D3B0000-memory.dmp
              Download

              memory/2000-187-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/2000-27-0x0000020B5D350000-0x0000020B5D3B0000-memory.dmp
              Download

              memory/2008-137-0x0000000140000000-0x000000014020E000-memory.dmp
              Download

              memory/2008-116-0x0000000000860000-0x00000000008C0000-memory.dmp
              Download

              memory/2008-122-0x0000000000860000-0x00000000008C0000-memory.dmp
              Download

              memory/2748-190-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/2748-33-0x0000000000D20000-0x0000000000D80000-memory.dmp
              Download

              memory/2748-32-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/2748-39-0x0000000000D20000-0x0000000000D80000-memory.dmp
              Download

              memory/2880-78-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/2880-206-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/2880-46-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/2880-72-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/2940-232-0x0000000000400000-0x00000000005D6000-memory.dmp
              Download

              memory/2940-140-0x00000000009E0000-0x0000000000A47000-memory.dmp
              Download

              memory/2940-145-0x00000000009E0000-0x0000000000A47000-memory.dmp
              Download

              memory/2940-148-0x0000000000400000-0x00000000005D6000-memory.dmp
              Download

              memory/3264-21-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/3264-12-0x00000000007B0000-0x0000000000810000-memory.dmp
              Download

              memory/3264-18-0x00000000007B0000-0x0000000000810000-memory.dmp
              Download

              memory/3264-159-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/4976-215-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/4976-93-0x0000020532C40000-0x0000020532CA0000-memory.dmp
              Download

              memory/4976-95-0x0000020532C40000-0x0000020532CA0000-memory.dmp
              Download

              memory/4976-135-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/5356-197-0x00000000007C0000-0x0000000000820000-memory.dmp
              Download

              memory/5356-199-0x00000000007C0000-0x0000000000820000-memory.dmp
              Download

              memory/5356-201-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/5356-191-0x00000000007C0000-0x0000000000820000-memory.dmp
              Download

              memory/5720-207-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/5720-213-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/5720-216-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/5720-325-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/5744-160-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/5744-151-0x0000000000560000-0x00000000005C0000-memory.dmp
              Download

              memory/5744-238-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/5744-381-0x0000000000560000-0x00000000005C0000-memory.dmp
              Download

              memory/5744-157-0x0000000000560000-0x00000000005C0000-memory.dmp
              Download

              memory/5744-382-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/5840-279-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/5840-242-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/5840-276-0x00000000007E0000-0x0000000000840000-memory.dmp
              Download

              memory/5840-164-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/5840-165-0x00000000007E0000-0x0000000000840000-memory.dmp
              Download

              memory/5840-171-0x00000000007E0000-0x0000000000840000-memory.dmp
              Download

              memory/6036-136-0x0000000140000000-0x000000014020A000-memory.dmp
              Download

              memory/6036-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp
              Download

              memory/6036-133-0x0000000000CA0000-0x0000000000D00000-memory.dmp
              Download

              memory/6128-188-0x0000000140000000-0x000000014027D000-memory.dmp
              Download

              memory/6128-184-0x0000000000D10000-0x0000000000D70000-memory.dmp
              Download

              memory/6128-178-0x0000000000D10000-0x0000000000D70000-memory.dmp
              Download