Overview

overview

10

Static

static

10

2026-05-10...a-.exe

windows10-2004-x64

9

2026-05-10...a-.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/05/2026, 22:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.9MB
  • Sample260510-2f384abs7j
  • SHA256 cda5fd8dc7899468299d29a2afa16e1cf91bb5050df879494ad7faf331118df2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 4 IoCs
  • Detects executables packed with SmartAssembly 4 IoCs
  • Detects executables packed with Yano Obfuscator 4 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 42 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2680
    • \??\c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2ec,0x2e8,0x2f4,0x2f0,0x2f8,0x140325960,0x140325970,0x140325980
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:968
    • \??\c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2680_GXMDBYHWLVSACFNN" --sandboxed-process-id=2 --init-done-notifier=852 --sandbox-mojo-pipe-token=1866649252856721903 --mojo-platform-channel-handle=828 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2288
    • \??\c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-05-10_c11b1d8d4404efce67f71fba2ed0b109_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2680_GXMDBYHWLVSACFNN" --sandboxed-process-id=3 --init-done-notifier=1084 --sandbox-mojo-pipe-token=4357982525054128182 --mojo-platform-channel-handle=1080
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2376
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3196
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4064
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2388
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3260
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2068
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3408
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3268
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1448
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1444
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:920
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:2084
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4172
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:4024
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3396
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      PID:2176
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4388
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:2024
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:3236
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4000
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2692
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3892
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2016
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4112
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:3104
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 944 2852 2856 928 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
          2⤵
          • Modifies data under HKEY_USERS
          PID:1944
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 944 2880 2876 928 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
          2⤵
          • Modifies data under HKEY_USERS
          PID:1676

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 792d5e9177c2d7cf1f603d7483d9d781e1657cfcbbd61623279eb5c386f94de5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.3MB
            • SHA256 9000d4087178ce6a05a2ed7d8cfa708214328d735ddc40520a349ea69fecba86
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.6MB
            • SHA256 373ad70aae0bb4045a62ea9faaf4b9af33ddf9ac6009f999c3627702cec7348c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 1aba65e63f3553a0e2516f12e6d5c99b708905c9a0c693d54cb594d9ed8428fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 de13f133ed33dd06a77576071f23ebdb0e0a631fdd2f7067f3e50eee2f949ed6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.1MB
            • SHA256 b9e43ff9b3bbdfbb459d2bd2b5df50ea30af0fbb6fee6ba3fae097e418e69647
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.3MB
            • SHA256 a5e077584ad3442b3f14f06de0bb7d7e019f56846352555146759a03f941b856
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 6390ba38b4f145fd8e026456891c01d5be73b0c51cfc38227ecff9f7899b93de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.4MB
            • SHA256 4c3d3006b7a59a4f8cfe3689054125668fc44ec284ec6592c6cd453f7a5e756c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 90ccc1468b0a99af457c88d717194683d763aaefaa32374a5e1749dba7431e6b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 b397a2a95ddc3346af327d23e9d7434d64d26835ff6870f806f7f3560c0e808c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 ff3d7ec14e72b0a63543bb8639f4b9b1694da3a1c4948a42168ef6c756cdf20e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.3MB
            • SHA256 93f3a763e06679c5a46aaaf1d7ae6751d61ccc7d5a77958dbce7e9df79c18fde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.2MB
            • SHA256 fd495ae75a30a6f3f95943b3500b98e56c210921f4b37b877bda0fb89f5c5410
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 c2dea02fa52af9b1002a223d28b1f8b5a75a2fadb24a1c47601e93a7e0580556
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 6b140f723172624e9ca3e690f3ac70e916d3d1f4ab8d816e8d4bf29223fdfd88
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 9938b5ae5a8093a5b98fb92b6b6acb7d2872bae205dd8d6d3402f3a1c73050cb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.2MB
            • SHA256 d31153479fb484ce8938855998cb2f87889f8d3b0238e3e45d6c1a2f159f0d78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            software_reporter_tool-sandbox.log
            • Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
            • Size 1KB
            • SHA256 82409c0daa7b4bb6a7cd896217504542f5ac260e2a0baf964c670b2e4b1411e3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            edls_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
            • Size 449KB
            • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em000_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em000_64.dll
            • Size 37KB
            • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em001_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
            • Size 378KB
            • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em002_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
            • Size 2.3MB
            • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em003_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
            • Size 1.3MB
            • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em004_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em004_64.dll
            • Size 6.1MB
            • SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em005_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em005_64.dll
            • Size 576KB
            • SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7b8238d189fac755.bin
            • Path C:\Users\Admin\AppData\Roaming\7b8238d189fac755.bin
            • Size 12KB
            • SHA256 de81fda522a340050f844fc82024113055c3cd14a5344b13caf35231f5027143
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.1MB
            • SHA256 271d82ea5295a6ceeacf901f92e9b6821453437fee7162540a5f23686648ec6c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 0d2b2324478b7a7a47b359a34513704daf1b612a1ca7097f3d469a3d3db4d2c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.2MB
            • SHA256 c448e83ff34563dbb757b72f3b83b37ced03b2e98ef5debed898bb6e9105a409
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 ac84d5d93d4075b0c9de50932916e3b177f6f7cf620b931301616fd24945978d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.1MB
            • SHA256 ffcfa5f1d0de08aabf7d357987e00868d302e70d25a497cd1d60fffcc6237ce8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.4MB
            • SHA256 add3f9366ebb9bcf87c738790dd5f0eefafe4003ef99d2ebb4d028089a66bc85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.3MB
            • SHA256 f7a84828ffb4fbbab1766a60c93742890a2ef503b55e9fd97341cfb57a542374
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 0435edf68473cb7865ddeb22a37c28bbbf2f5cee67a48cc79d17b67916cffaf3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.7MB
            • SHA256 40c76df0968778785da9d5a3ddb9900885acf27eec36694966fd7252391d529e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.3MB
            • SHA256 dc0a22e76c8d51c991d0d9e58bdb903d00242ce00f716d744cddbf0cfd7c4a55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.4MB
            • SHA256 f504d52a298f60ae06b455d920fd0a2ab90a326058ab9797acc3b7cbc1890538
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 d64defb9ba525895675c8308697f6018c8887e882c33710069654480154aff3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.2MB
            • SHA256 85ab1b80a0624564585743fb723834a82de010f3253c3c2221b5b4bac7abf21b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.2MB
            • SHA256 db95175a1d2baa0ebfa2f15c8a2516d2cd88329ed2f73ee134f52cc1ce53b137
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\System32\msiexec.exe
            • Size 1.2MB
            • SHA256 70af574161a23530f9074fab9c91367a3362b5924cfbed246622f661e9d3c89f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.1MB
            • SHA256 1dd6a118fc5e0d6ea021dcd6c2a5bd254cf3b4171029d888fbc2a38cf60ec0b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 1d1a1addc4afe5f169a49dc6301f9dc66e7129acb9d67b31ea1b16790616b026
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.3MB
            • SHA256 ef8a13268eec67ef3ecfc2bec4657e2eb57aaa77187d45b13eacfbec72ac2689
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 8af40cc26b605b8a05dd214ec4cd7d39874e0cf9f67cabc432c750195fe2d642
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 d651f5e145d78838a7dcb953bf1ff8e2c6852eb0fde72940184e14e437e800ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.5MB
            • SHA256 d82282ebff26c68f1484c7dda4b3b166d0f7d5f4f7a9c35b5a54f99c2e2e8998
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StructuredQuerySchema.bin
            • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
            • Size 414KB
            • SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
            • Size 40B
            • SHA256 027af744ae49ee5fed15b380db591755c0e566fe4d85eb9d7fa540c67cb3c56a
            • MD5 SHA1 SHA512
            Submit Download

            memory/920-179-0x0000000000C20000-0x0000000000C80000-memory.dmp
            Download

            memory/920-185-0x0000000000C20000-0x0000000000C80000-memory.dmp
            Download

            memory/920-302-0x0000000140000000-0x0000000140150000-memory.dmp
            Download

            memory/920-187-0x0000000140000000-0x0000000140150000-memory.dmp
            Download

            memory/968-42-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/968-9-0x0000000000570000-0x00000000005D0000-memory.dmp
            Download

            memory/968-17-0x0000000000570000-0x00000000005D0000-memory.dmp
            Download

            memory/968-190-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/1444-169-0x0000000000880000-0x00000000008E0000-memory.dmp
            Download

            memory/1444-175-0x0000000140000000-0x0000000140155000-memory.dmp
            Download

            memory/1444-282-0x0000000140000000-0x0000000140155000-memory.dmp
            Download

            memory/1444-174-0x0000000000880000-0x00000000008E0000-memory.dmp
            Download

            memory/1448-163-0x0000000140000000-0x0000000140140000-memory.dmp
            Download

            memory/1448-157-0x0000000000860000-0x00000000008C0000-memory.dmp
            Download

            memory/1448-151-0x0000000000860000-0x00000000008C0000-memory.dmp
            Download

            memory/2016-428-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2016-312-0x0000000000880000-0x00000000008E0000-memory.dmp
            Download

            memory/2016-314-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2024-253-0x0000000140000000-0x0000000140188000-memory.dmp
            Download

            memory/2024-244-0x0000000000850000-0x00000000008B0000-memory.dmp
            Download

            memory/2024-387-0x0000000140000000-0x0000000140188000-memory.dmp
            Download

            memory/2024-250-0x0000000000850000-0x00000000008B0000-memory.dmp
            Download

            memory/2068-162-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/2068-120-0x0000000000840000-0x00000000008A0000-memory.dmp
            Download

            memory/2084-191-0x0000000000400000-0x000000000051D000-memory.dmp
            Download

            memory/2176-383-0x0000000140000000-0x0000000140149000-memory.dmp
            Download

            memory/2176-231-0x0000000000550000-0x00000000005B0000-memory.dmp
            Download

            memory/2176-427-0x00000000013D0000-0x00000000014A6000-memory.dmp
            Download

            memory/2176-240-0x0000000140000000-0x0000000140149000-memory.dmp
            Download

            memory/2176-236-0x0000000000550000-0x00000000005B0000-memory.dmp
            Download

            memory/2288-382-0x000001DF44380000-0x000001DF443DD000-memory.dmp
            Download

            memory/2288-48-0x000001DF447A0000-0x000001DF44800000-memory.dmp
            Download

            memory/2288-45-0x00007FFD6FD30000-0x00007FFD6FD31000-memory.dmp
            Download

            memory/2288-239-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2288-826-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2288-46-0x00007FFD6EC60000-0x00007FFD6EC61000-memory.dmp
            Download

            memory/2288-47-0x000001DF447A0000-0x000001DF44800000-memory.dmp
            Download

            memory/2288-61-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2376-109-0x0000019180FC0000-0x0000019181020000-memory.dmp
            Download

            memory/2376-252-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2376-386-0x0000019180DD0000-0x0000019180E2D000-memory.dmp
            Download

            memory/2376-108-0x0000019180FC0000-0x0000019181020000-memory.dmp
            Download

            memory/2376-105-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2376-801-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2680-27-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2680-844-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2680-843-0x0000000000840000-0x00000000008A0000-memory.dmp
            Download

            memory/2680-6-0x0000000000840000-0x00000000008A0000-memory.dmp
            Download

            memory/2680-202-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2680-0-0x0000000000840000-0x00000000008A0000-memory.dmp
            Download

            memory/2692-394-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2692-289-0x0000000000D20000-0x0000000000D80000-memory.dmp
            Download

            memory/2692-291-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2692-283-0x0000000000D20000-0x0000000000D80000-memory.dmp
            Download

            memory/2692-506-0x0000000000680000-0x0000000000756000-memory.dmp
            Download

            memory/2884-371-0x000000000A5A0000-0x000000000A5A8000-memory.dmp
            Download

            memory/2884-355-0x0000000001F60000-0x0000000001F70000-memory.dmp
            Download

            memory/2884-338-0x0000000140000000-0x0000000140172000-memory.dmp
            Download

            memory/2884-511-0x0000000140000000-0x0000000140172000-memory.dmp
            Download

            memory/2884-335-0x0000000000910000-0x0000000000970000-memory.dmp
            Download

            memory/2884-339-0x0000000001CB0000-0x0000000001CC0000-memory.dmp
            Download

            memory/2884-329-0x0000000000910000-0x0000000000970000-memory.dmp
            Download

            memory/3196-43-0x0000000140000000-0x0000000140130000-memory.dmp
            Download

            memory/3196-19-0x0000000000750000-0x00000000007B0000-memory.dmp
            Download

            memory/3196-25-0x0000000000750000-0x00000000007B0000-memory.dmp
            Download

            memory/3236-264-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3236-256-0x00000000008A0000-0x0000000000900000-memory.dmp
            Download

            memory/3236-262-0x00000000008A0000-0x0000000000900000-memory.dmp
            Download

            memory/3236-388-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3260-59-0x0000000000EF0000-0x0000000000F50000-memory.dmp
            Download

            memory/3260-66-0x0000000140000000-0x0000000140136000-memory.dmp
            Download

            memory/3260-65-0x0000000000740000-0x0000000000816000-memory.dmp
            Download

            memory/3260-63-0x0000000000EF0000-0x0000000000F50000-memory.dmp
            Download

            memory/3260-62-0x0000000140000000-0x0000000140136000-memory.dmp
            Download

            memory/3260-53-0x0000000000EF0000-0x0000000000F50000-memory.dmp
            Download

            memory/3268-148-0x0000000140000000-0x000000014015B000-memory.dmp
            Download

            memory/3268-137-0x0000000001710000-0x0000000001770000-memory.dmp
            Download

            memory/3268-146-0x0000000001710000-0x0000000001770000-memory.dmp
            Download

            memory/3268-143-0x0000000001710000-0x0000000001770000-memory.dmp
            Download

            memory/3396-224-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/3396-226-0x0000000140000000-0x000000014011E000-memory.dmp
            Download

            memory/3396-218-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/3396-378-0x0000000140000000-0x000000014011E000-memory.dmp
            Download

            memory/3408-133-0x00000000008F0000-0x0000000000950000-memory.dmp
            Download

            memory/3408-127-0x00000000008F0000-0x0000000000950000-memory.dmp
            Download

            memory/3408-164-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/3892-300-0x0000000000750000-0x00000000007B0000-memory.dmp
            Download

            memory/3892-508-0x0000000001490000-0x0000000001566000-memory.dmp
            Download

            memory/3892-403-0x0000000140000000-0x00000001401F6000-memory.dmp
            Download

            memory/3892-303-0x0000000140000000-0x00000001401F6000-memory.dmp
            Download

            memory/4000-275-0x0000000140000000-0x00000001401AD000-memory.dmp
            Download

            memory/4000-267-0x0000000000C80000-0x0000000000CE0000-memory.dmp
            Download

            memory/4000-273-0x0000000000C80000-0x0000000000CE0000-memory.dmp
            Download

            memory/4000-276-0x0000000000C80000-0x0000000000CE0000-memory.dmp
            Download

            memory/4000-279-0x0000000140000000-0x00000001401AD000-memory.dmp
            Download

            memory/4000-278-0x0000000000650000-0x0000000000726000-memory.dmp
            Download

            memory/4024-206-0x0000000000740000-0x00000000007A0000-memory.dmp
            Download

            memory/4024-212-0x0000000000740000-0x00000000007A0000-memory.dmp
            Download

            memory/4024-337-0x0000000140000000-0x00000001401C1000-memory.dmp
            Download

            memory/4024-400-0x0000000140000000-0x00000001401C1000-memory.dmp
            Download

            memory/4024-214-0x0000000140000000-0x00000001401C1000-memory.dmp
            Download

            memory/4024-399-0x00000000016E0000-0x00000000017B6000-memory.dmp
            Download

            memory/4024-397-0x0000000000740000-0x00000000007A0000-memory.dmp
            Download

            memory/4064-34-0x0000000000400000-0x0000000000460000-memory.dmp
            Download

            memory/4064-51-0x0000000140000000-0x0000000140130000-memory.dmp
            Download

            memory/4064-40-0x0000000000400000-0x0000000000460000-memory.dmp
            Download

            memory/4112-325-0x0000000140000000-0x0000000140148000-memory.dmp
            Download

            memory/4112-323-0x0000000000780000-0x00000000007E0000-memory.dmp
            Download

            memory/4112-317-0x0000000000780000-0x00000000007E0000-memory.dmp
            Download

            memory/4112-474-0x0000000140000000-0x0000000140148000-memory.dmp
            Download

            memory/4172-200-0x00000000007B0000-0x0000000000810000-memory.dmp
            Download

            memory/4172-203-0x0000000140000000-0x000000014011C000-memory.dmp
            Download

            memory/4172-194-0x00000000007B0000-0x0000000000810000-memory.dmp
            Download