Overview

overview

10

Static

static

10

2026-07-28...a-.exe

windows10-2004-x64

9

2026-07-28...a-.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/07/2026, 01:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.9MB
  • Sample260729-caqndade55
  • SHA256 4e4c5cb814c40eb6ca7b4c4abb78cd7b27bee5757c9915f7e8e56064c96a981f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 4 IoCs
  • Detects executables packed with SmartAssembly 4 IoCs
  • Detects executables packed with Yano Obfuscator 4 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4120
    • \??\c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2d8,0x2c4,0x2dc,0x2d4,0x2e0,0x140325960,0x140325970,0x140325980
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3176
    • \??\c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4120_AZXPZYRGLJXSQQQN" --sandboxed-process-id=2 --init-done-notifier=828 --sandbox-mojo-pipe-token=11591620780531823841 --mojo-platform-channel-handle=804 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2480
    • \??\c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-07-28_08b3f6060224dda44ae669cc19e112a5_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4120_AZXPZYRGLJXSQQQN" --sandboxed-process-id=3 --init-done-notifier=1412 --sandbox-mojo-pipe-token=3314316227519684947 --mojo-platform-channel-handle=1408
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4456
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:4928
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:2728
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1188
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2496
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4736
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2088
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:2368
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2472
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4972
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3828
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1116
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2440
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1792
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:552
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3012
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:3284
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:3772
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        PID:2188
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:436
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1900
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4108
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1464
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2880
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:780
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1332
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:4016

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 ac1f737bece802b1b95eb9fe4ef3a44705f13aaa8b81e4d88c70b860da84e031
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.7MB
            • SHA256 82925194974ea07564e1111874852cb2e78b778ef40dd3047ccc537d219390b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 2.0MB
            • SHA256 c153b07bae7753b2943a5b0644a5d66505d026f3cc3786f6d9ad90d79138e422
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 367aaaf51559b111c839b4edec5046334658cb844dd7f94fa8a065e41cddb6f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 aafc4a92bd0f24a13c5fd13df11f86dd8af1c18d0730baae3083bbb27bd16524
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.4MB
            • SHA256 3790d611cca3cb4daf7060a8e3317d3d7dfa71fe0627da91dd0215ba047cb980
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.7MB
            • SHA256 ad26e9863df595619246a2637458da5578247841fbb280893bea7e7089dda703
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 b46044aa391a640d809d6dc7e7c98257337a0b9e779fb2ec3ab7b5bee001d10d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.8MB
            • SHA256 64f3202544f9f5fbc07b33b58d9c1f948c4355723123324988b06dff5e7f7ee4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 cb279fbebb1b2e42bad36358093f0fabf5b65e94e77bde054359bb3eb41eecf8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 07245750ccba901c937f6ef05870ceedde9f410b87f18d3b2f0127fd4169aa41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 03467be1eb3367a1567b320975b5cef3b7dbfd285dc5cbf1f93bb3c2c63d6898
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.7MB
            • SHA256 47acc76f323ba926b240bb973e63ed30bcfd806ada5faa9df2b4b821aecbdbf6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.5MB
            • SHA256 77328a3498ff8cef8996da67fb51cb661d08d8ca27deeb484b150ff746e5ceaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 6.6MB
            • SHA256 00c1cff9f4edd7b2c82a8cc51f28a202bfd964d4a609fdbeacecf7aa515f3d90
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 af778a61dac5c1245ea622f465fea69edfb9d3454f0c40bf823a56266b8685d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 53a42d09b63bb8d9c896fcef93b2696aabeec2aa8038fa6af675ef83afef0371
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 05b579cd0768220ad03416908956e1eda0e3d0a58147dccbe8de2fbf65b76193
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 48987528c157dadf127dafae702a3df47c86dc8c9294ec54fe97d0db86ccff0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.6MB
            • SHA256 4a15d599751057ded0c9e680737038d78950b73c6f7ea01318b126937e209137
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            software_reporter_tool-sandbox.log
            • Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
            • Size 1KB
            • SHA256 c72d4f2209388a5625966cd38cff0bfcc580cbcc5d6f9483a5b77849934b1c34
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            edls_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
            • Size 449KB
            • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em000_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em000_64.dll
            • Size 37KB
            • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em001_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
            • Size 378KB
            • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em002_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
            • Size 2.3MB
            • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em003_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
            • Size 1.3MB
            • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em004_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em004_64.dll
            • Size 6.1MB
            • SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em005_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em005_64.dll
            • Size 576KB
            • SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.4MB
            • SHA256 ee7acc2ffc53f5b5973c95b770a009d45817bc288abd05b9112b1c287b3f51f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 75350b9af2c255a2d714fd564c764be791d2465a4aed3ba74220826a7fa4be92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.5MB
            • SHA256 2a30d95ecaed8c6713a222dcb3f6f0ec0e9fdcc332b33d89e7c42befb06f3709
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 2e605a9dfbcce11d304fe0078ce6bfea4fe54ccb594d61ac0391cb00af53cbe8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.4MB
            • SHA256 98d8a5ce447d2ddc526ffc51d938ee9c445d58594959ddcb0a09cf86d54ee281
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.8MB
            • SHA256 0599ea56ba01ca05dbaedec137bb71bcfc83696e63e70cfdda96a98c4b7da302
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.5MB
            • SHA256 4110c95ddd1980aeda6950cdaa1c6e46f604d545b834cb0c3c5012df8c58aa4a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 c5acf3a3ecf7c5dd6252dc7149416f70967eac7aef267a305cad7dfa14aef06d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 b0468402af478b2af9402f6508864ced878ee134c5eb4a9bc238df77b4f87a74
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 407b0637059663ed64f4b553a3859e677e187087373ce429e5c2c558dc210594
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.7MB
            • SHA256 7c8c0f9dc1a4b0fd65f657d0f8f5f6365b25545278bbbbe6f0b4d986f8a6c674
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 02157cdd45078a9a220fd3cc801c22ab526c6fc5faf2aa4af979c80c8d9afb41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.5MB
            • SHA256 9422b2bd2b3b3a48f025c7f9d4cc59583500e606b7a9e4e37aaaa4287be536d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.6MB
            • SHA256 5b1deab6fc556d6be1535a649844a5ae1fa75bf7f7efd3fa795376a6853af00b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\System32\msiexec.exe
            • Size 1.5MB
            • SHA256 b43fe917d6d98fd341c29852feeb3c08cd799d1684e137af100deca681267c4d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.4MB
            • SHA256 f8f20970b943be6b379a964d93886a51b25e4f6eaaa2fe363c7db18b9533f61b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 a3a78292dfbde39590f47b079aa841db6fac5d5214445bcd7f0ee07fe5d64392
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.6MB
            • SHA256 6295ba191f90da3eed9a2ca3119f7651fd0a43cd7950590833db57896e3c9581
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 f2a35f515d87f98b0f2a6a2e37fa641c903f0d419980a6192ae440743b8da823
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 6696642b9fa91025e443aa8e6d65372130d874592148ec8a681a7e62c93d9a2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.7MB
            • SHA256 a13b0c48e608a08a9080511ae0ba561826abc8e6cbc52a4e671b9f32c2a2359c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
            • Size 40B
            • SHA256 7387f540fb9c529c6a134f09ae402c6db36dbfda692fc73eb0fd0a564ec8b1f8
            • MD5 SHA1 SHA512
            Submit Download

            memory/436-214-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/436-215-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/552-182-0x0000000140000000-0x0000000140176000-memory.dmp
            Download

            memory/552-229-0x0000000140000000-0x0000000140176000-memory.dmp
            Download

            memory/780-293-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/780-277-0x000000000C950000-0x000000000C958000-memory.dmp
            Download

            memory/780-268-0x0000000009E60000-0x0000000009E68000-memory.dmp
            Download

            memory/780-252-0x0000000001A20000-0x0000000001A30000-memory.dmp
            Download

            memory/780-236-0x0000000001770000-0x0000000001780000-memory.dmp
            Download

            memory/780-235-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1116-167-0x0000000000860000-0x00000000008C7000-memory.dmp
            Download

            memory/1116-162-0x0000000000860000-0x00000000008C7000-memory.dmp
            Download

            memory/1116-210-0x0000000000400000-0x0000000000577000-memory.dmp
            Download

            memory/1116-169-0x0000000000400000-0x0000000000577000-memory.dmp
            Download

            memory/1464-226-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/1464-287-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/1792-222-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1792-276-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1792-177-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1900-219-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/1900-285-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2088-85-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/2088-119-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/2088-91-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/2188-284-0x0000000140000000-0x00000001401C2000-memory.dmp
            Download

            memory/2188-211-0x0000000140000000-0x00000001401C2000-memory.dmp
            Download

            memory/2368-101-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/2368-95-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/2368-104-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/2368-106-0x0000000140000000-0x00000001401B5000-memory.dmp
            Download

            memory/2440-172-0x0000000140000000-0x0000000140175000-memory.dmp
            Download

            memory/2440-218-0x0000000140000000-0x0000000140175000-memory.dmp
            Download

            memory/2472-133-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/2480-39-0x0000027BCE930000-0x0000027BCE990000-memory.dmp
            Download

            memory/2480-38-0x0000027BCE930000-0x0000027BCE990000-memory.dmp
            Download

            memory/2480-591-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2480-179-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2480-37-0x00007FFA20EE0000-0x00007FFA20EE1000-memory.dmp
            Download

            memory/2480-117-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2480-36-0x00007FFA20EA0000-0x00007FFA20EA1000-memory.dmp
            Download

            memory/2496-45-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2728-31-0x0000000000580000-0x00000000005E0000-memory.dmp
            Download

            memory/2728-25-0x0000000000580000-0x00000000005E0000-memory.dmp
            Download

            memory/2728-47-0x0000000140000000-0x0000000140189000-memory.dmp
            Download

            memory/2880-288-0x0000000140000000-0x00000001401A6000-memory.dmp
            Download

            memory/2880-230-0x0000000140000000-0x00000001401A6000-memory.dmp
            Download

            memory/3012-194-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3012-185-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/3012-234-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3012-191-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/3176-176-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/3176-16-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/3176-10-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/3176-33-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/3772-275-0x0000000140000000-0x00000001401E2000-memory.dmp
            Download

            memory/3772-205-0x0000000000D90000-0x0000000000DF0000-memory.dmp
            Download

            memory/3772-198-0x0000000140000000-0x00000001401E2000-memory.dmp
            Download

            memory/3772-199-0x0000000000D90000-0x0000000000DF0000-memory.dmp
            Download

            memory/3828-151-0x0000000000B60000-0x0000000000BC0000-memory.dmp
            Download

            memory/3828-157-0x0000000000B60000-0x0000000000BC0000-memory.dmp
            Download

            memory/3828-159-0x0000000140000000-0x000000014018B000-memory.dmp
            Download

            memory/3828-207-0x0000000140000000-0x000000014018B000-memory.dmp
            Download

            memory/4016-444-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-464-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-436-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-441-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-442-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-445-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-447-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-448-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-449-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-446-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-433-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-443-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-440-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-457-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-456-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-455-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-454-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-453-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-452-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-459-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-460-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-461-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-467-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-466-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-465-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-437-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-463-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-462-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-438-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-439-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4016-434-0x0000021ADCA40000-0x0000021ADCA50000-memory.dmp
            Download

            memory/4108-286-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4108-223-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4120-0-0x00000000007D0000-0x0000000000830000-memory.dmp
            Download

            memory/4120-6-0x00000000007D0000-0x0000000000830000-memory.dmp
            Download

            memory/4120-175-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4120-618-0x00000000007D0000-0x0000000000830000-memory.dmp
            Download

            memory/4120-619-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4120-18-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4456-193-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4456-124-0x0000026E6B2D0000-0x0000026E6B330000-memory.dmp
            Download

            memory/4456-593-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4456-137-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4456-125-0x0000026E6B2D0000-0x0000026E6B330000-memory.dmp
            Download

            memory/4736-72-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/4736-132-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/4736-78-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/4928-48-0x0000000140000000-0x000000014018A000-memory.dmp
            Download

            memory/4972-146-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/4972-140-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/4972-148-0x0000000140000000-0x00000001401AF000-memory.dmp
            Download