Overview

overview

10

Static

static

10

2026-05-10...a-.exe

windows10-2004-x64

9

2026-05-10...a-.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/05/2026, 22:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.9MB
  • Sample260510-2f384abs7j
  • SHA256 cda5fd8dc7899468299d29a2afa16e1cf91bb5050df879494ad7faf331118df2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 4 IoCs
  • Detects executables packed with SmartAssembly 4 IoCs
  • Detects executables packed with Yano Obfuscator 4 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 38 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3744
    • \??\c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2ec,0x140325960,0x140325970,0x140325980
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2200
    • \??\c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_3744_AUDXBNIAQUMZLRRO" --sandboxed-process-id=2 --init-done-notifier=848 --sandbox-mojo-pipe-token=7995605721184428160 --mojo-platform-channel-handle=824 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:1736
    • \??\c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_3744_AUDXBNIAQUMZLRRO" --sandboxed-process-id=3 --init-done-notifier=1156 --sandbox-mojo-pipe-token=709914365051302651 --mojo-platform-channel-handle=1152
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4708
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:1444
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:2636
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4164
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:544
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2252
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4916
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2296
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4868
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1008
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4624
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:5100
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3764
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3656
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4728
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1332
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2236
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:3748
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:796
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3288
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:544
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3192
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4892
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:3276
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1652
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4900
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:2840

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 a59da63df365a84e5bfd961482d428cf130c3af9814250efb88dd98ada1816d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.3MB
            • SHA256 bacbae884cff14783990fae3862bb3e54074182331eb8919e83bb0069c0ae91c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.6MB
            • SHA256 874c53fe85f244bccd851d7bca26287b6ac6c3af565927f2dc0c4fe99ee70e51
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 3b3d0752494523eebdbe1004576235a2f1aefd2331d4e9bad279a8f1cab82e1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 5b4275d437d5ca6b3beeb9e6c92eac327dc74973aad646a1ea33e227a9182fc3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.1MB
            • SHA256 97e692dd6263c18ba2c4313ecab21244fb5daee01319f1210bded96a7c688a46
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.3MB
            • SHA256 c8908a95bfb5731620d85cf355f7c0d809ef8df4efaa07dd23e8d867d443e9f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 efe0179394d89b731b08d1a731487137d35d5112017e3db50a527dd1571d66d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.4MB
            • SHA256 7337e5b3f8a69c41542cb9ed27da93d2f8126ad21487aee314cc6518680be2f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 3a46af101ed7c1a0757f99c37c017ae3ca296a95c0711582e1cd63b8fed52068
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 7dcf2ccfbfabc0b88417c30de0fd59dd5388b5932f03a6a6aef58d296bf2c563
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 5e253d430759a7208031284729974fa5f47cd74632024fc0ead0d9975c1c68f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.3MB
            • SHA256 eb3581afecc68b0c72cd849386614d108752648bee9decabc01b32dd10ef699c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.2MB
            • SHA256 7a458c4c57245608fb03d87617bd86e9313a1d63c422e31972a3f9dbebc33226
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 b9499df9e7136339e2ab0ea888f54a76c1e78995a6e557513d911d3936bdd613
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 f645f60c03c10fb39ef4d5dead356a7a5322ea43c593d24285340664811facc8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 1fa5b7eaf85e64c7a556aaf3690b5ae6b79fd819e546bb037dc3ef7ec591bd72
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.2MB
            • SHA256 827c2cb9cf1421cfc41dab078e7aa05650a134d8a8d46d844ab25b05302e52b5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            software_reporter_tool-sandbox.log
            • Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
            • Size 3KB
            • SHA256 8d90c8fad357f266cb14395e20bfec1661a21edbbd7cad84064d6be0312de2de
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            edls_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
            • Size 449KB
            • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em001_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
            • Size 378KB
            • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em002_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
            • Size 2.3MB
            • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em003_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
            • Size 1.3MB
            • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em004_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em004_64.dll
            • Size 6.1MB
            • SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            4355c6e566859a32.bin
            • Path C:\Users\Admin\AppData\Roaming\4355c6e566859a32.bin
            • Size 12KB
            • SHA256 cd4aacd7c51d1107d30d79eb58c8a874ec379bd800e4b825f43d6aab9f173832
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.1MB
            • SHA256 276e4be63d732a2495b395885b9d05974b46c84d53043638dafae49ba4174b13
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 86f75eb5c0380198090df1217dac4230a87f1e4223e1a45ecdd9e7c830deb28d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.2MB
            • SHA256 0e27b9dd356303a3c4bdd13bd4d99d01e459a587bcd23690181d378d7b3ff710
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 d488327c639f325a07d42e19f2f95fe4384f4f45c43457eca2070550294680ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.1MB
            • SHA256 73fe6fb8d08bae7139519ce08e5a4992755d82fd434aa6049110999a053fbca4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.4MB
            • SHA256 108b23b8252f8a55b87097451d5d46c111ed461ce0b62e2f7272412adb832567
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.2MB
            • SHA256 83b6d9dc83280c09ef809f2a4723ca7ae7ef086e78710393a9df2c10b2ee8d35
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 76cf7fa8d9d3ccbfa543d8aa55b238e69640aa4adba37471481101f0d679c43c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 4a0423989f87e4e00cc646a6d3a4e3565409b3512f2588f1db25fbcb9c7b557b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 544efb53e86ca065e089d98d18bfc78017a30e1b14deaf8a964ef5763a38e00a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.4MB
            • SHA256 35fdd40460eced5ee16f4a60c540d9179e4a2d3222963804fb096b4b9c4d16b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 9959cdf7357b088b424e1fa3ebc6bda7698dd59d28a541382711784c21cb3da4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.2MB
            • SHA256 1415fde9c83e4f01e5fcb2241e42dafe9d9cd289c7a3b300fb60b1559490b7ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.2MB
            • SHA256 a35c085bb502ba2df6319db9164e7c00d96fc7e0e05e85a58a1dead99ea4606d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\System32\msiexec.exe
            • Size 1.1MB
            • SHA256 e85e7a82af016f8b6c7ef7b5b2075a7ffb3cca07177f4ec49c04bf78f1081afc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.1MB
            • SHA256 c50df1e3f9bbb2549abc9df0a7e4b478707e6e62cfd2d990c40e258d972fd466
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 3ba4353e58cec36f0c81029dde71ebc15901e1f9e16b5826319b3a7d93d25d84
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.3MB
            • SHA256 b0d47bf43d1376cf45237e9fee8a7fc90df06bb2113dfd82b836b823ac9cef4c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 65c8f14b30cc374eeeabeda5f6374d318ad43b58348acc3561b7ae6177b33348
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 96f407ad3fea49d92cf3babaae1b4e28405c098ed6aabca1030bbea47d5ee0ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.4MB
            • SHA256 f27048b574e6c00c6bcca7753ed4311b86a0aa91e1df988d055e258716e82b71
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
            • Size 40B
            • SHA256 b419765f3bb675a92f67d7e3c55fc012e206feca4505102538396f522b5255a0
            • MD5 SHA1 SHA512
            Submit Download

            em000_64.dll
            • Path \??\c:\users\admin\appdata\local\temp\em000_64.dll
            • Size 37KB
            • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em005_64.dll
            • Path \??\c:\users\admin\appdata\local\temp\em005_64.dll
            • Size 576KB
            • SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/544-103-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/544-401-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/544-283-0x0000000000AE0000-0x0000000000B40000-memory.dmp
            Download

            memory/544-291-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/544-102-0x0000000001690000-0x000000000173D000-memory.dmp
            Download

            memory/544-289-0x0000000000AE0000-0x0000000000B40000-memory.dmp
            Download

            memory/544-100-0x0000000000A20000-0x0000000000A80000-memory.dmp
            Download

            memory/544-91-0x0000000000A20000-0x0000000000A80000-memory.dmp
            Download

            memory/544-97-0x0000000000A20000-0x0000000000A80000-memory.dmp
            Download

            memory/796-390-0x0000000140000000-0x0000000140168000-memory.dmp
            Download

            memory/796-262-0x0000000140000000-0x0000000140168000-memory.dmp
            Download

            memory/796-259-0x00000000007D0000-0x0000000000830000-memory.dmp
            Download

            memory/796-253-0x00000000007D0000-0x0000000000830000-memory.dmp
            Download

            memory/1008-168-0x0000000000410000-0x0000000000470000-memory.dmp
            Download

            memory/1008-265-0x0000000140000000-0x0000000140155000-memory.dmp
            Download

            memory/1008-174-0x0000000000410000-0x0000000000470000-memory.dmp
            Download

            memory/1008-167-0x0000000140000000-0x0000000140155000-memory.dmp
            Download

            memory/1332-381-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1332-237-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1332-234-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/1444-43-0x0000000140000000-0x0000000140130000-memory.dmp
            Download

            memory/1444-20-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/1444-26-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/1652-339-0x0000000000830000-0x0000000000890000-memory.dmp
            Download

            memory/1652-341-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1652-333-0x0000000000830000-0x0000000000890000-memory.dmp
            Download

            memory/1652-358-0x0000000001C80000-0x0000000001C90000-memory.dmp
            Download

            memory/1652-342-0x0000000001B00000-0x0000000001B10000-memory.dmp
            Download

            memory/1652-375-0x000000000A1F0000-0x000000000A1F8000-memory.dmp
            Download

            memory/1652-383-0x000000000CCD0000-0x000000000CCD8000-memory.dmp
            Download

            memory/1652-516-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1736-46-0x00007FFE8DC10000-0x00007FFE8DC11000-memory.dmp
            Download

            memory/1736-236-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/1736-45-0x00007FFE8CC80000-0x00007FFE8CC81000-memory.dmp
            Download

            memory/1736-48-0x000002847B6E0000-0x000002847B740000-memory.dmp
            Download

            memory/1736-47-0x000002847B6E0000-0x000002847B740000-memory.dmp
            Download

            memory/1736-294-0x000002847BD40000-0x000002847BDED000-memory.dmp
            Download

            memory/1736-768-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/1736-132-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2200-281-0x0000000002600000-0x00000000026AD000-memory.dmp
            Download

            memory/2200-42-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2200-10-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/2200-16-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/2200-224-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2252-120-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/2252-133-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/2252-114-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/2296-137-0x0000000001A30000-0x0000000001A90000-memory.dmp
            Download

            memory/2296-146-0x0000000001A30000-0x0000000001A90000-memory.dmp
            Download

            memory/2296-148-0x0000000140000000-0x000000014015B000-memory.dmp
            Download

            memory/2296-143-0x0000000001A30000-0x0000000001A90000-memory.dmp
            Download

            memory/2636-40-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/2636-34-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/2636-57-0x0000000140000000-0x000000014012F000-memory.dmp
            Download

            memory/3192-418-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3192-302-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/3192-304-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3276-489-0x0000000140000000-0x000000014014C000-memory.dmp
            Download

            memory/3276-329-0x0000000140000000-0x000000014014C000-memory.dmp
            Download

            memory/3276-321-0x00000000004E0000-0x0000000000540000-memory.dmp
            Download

            memory/3276-327-0x00000000004E0000-0x0000000000540000-memory.dmp
            Download

            memory/3288-272-0x0000000000780000-0x00000000007E0000-memory.dmp
            Download

            memory/3288-275-0x0000000000780000-0x00000000007E0000-memory.dmp
            Download

            memory/3288-277-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/3288-274-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/3288-266-0x0000000000780000-0x00000000007E0000-memory.dmp
            Download

            memory/3656-393-0x00000000010E0000-0x000000000118D000-memory.dmp
            Download

            memory/3656-203-0x00000000004D0000-0x0000000000530000-memory.dmp
            Download

            memory/3656-394-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3656-391-0x00000000004D0000-0x0000000000530000-memory.dmp
            Download

            memory/3656-211-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3656-209-0x00000000004D0000-0x0000000000530000-memory.dmp
            Download

            memory/3656-320-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3744-7-0x0000000001FA0000-0x0000000002000000-memory.dmp
            Download

            memory/3744-0-0x0000000001FA0000-0x0000000002000000-memory.dmp
            Download

            memory/3744-775-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/3744-774-0x0000000001FA0000-0x0000000002000000-memory.dmp
            Download

            memory/3744-223-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/3744-18-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/3744-280-0x0000000002910000-0x00000000029BD000-memory.dmp
            Download

            memory/3748-242-0x0000000000C80000-0x0000000000CE0000-memory.dmp
            Download

            memory/3748-248-0x0000000140000000-0x0000000140188000-memory.dmp
            Download

            memory/3748-249-0x0000000000C80000-0x0000000000CE0000-memory.dmp
            Download

            memory/3748-389-0x0000000140000000-0x0000000140188000-memory.dmp
            Download

            memory/3764-192-0x0000000140000000-0x000000014011B000-memory.dmp
            Download

            memory/3764-199-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/3764-308-0x0000000140000000-0x000000014011B000-memory.dmp
            Download

            memory/3764-193-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/4624-179-0x0000000000BF0000-0x0000000000C50000-memory.dmp
            Download

            memory/4624-185-0x0000000000BF0000-0x0000000000C50000-memory.dmp
            Download

            memory/4624-282-0x0000000140000000-0x0000000140131000-memory.dmp
            Download

            memory/4624-178-0x0000000140000000-0x0000000140131000-memory.dmp
            Download

            memory/4708-106-0x000002157F4D0000-0x000002157F530000-memory.dmp
            Download

            memory/4708-767-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4708-238-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4708-105-0x000002157F4D0000-0x000002157F530000-memory.dmp
            Download

            memory/4708-307-0x000002157F910000-0x000002157F9BD000-memory.dmp
            Download

            memory/4708-149-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4728-221-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/4728-215-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/4728-225-0x0000000140000000-0x000000014011C000-memory.dmp
            Download

            memory/4868-261-0x0000000140000000-0x000000014013F000-memory.dmp
            Download

            memory/4868-152-0x0000000140000000-0x000000014013F000-memory.dmp
            Download

            memory/4868-153-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/4868-159-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/4892-449-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4892-315-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4892-316-0x00000000006D0000-0x0000000000730000-memory.dmp
            Download

            memory/4892-309-0x00000000006D0000-0x0000000000730000-memory.dmp
            Download

            memory/4916-130-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/4916-124-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/4916-134-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/5100-189-0x0000000000400000-0x000000000051D000-memory.dmp
            Download

            memory/5100-295-0x0000000000400000-0x000000000051D000-memory.dmp
            Download