Overview

overview

10

Static

static

10

2026-09-29...a-.exe

windows10-2004-x64

9

2026-09-29...a-.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 15:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.9MB
  • Sample260930-slbatsxfpb
  • SHA256 97a8990dabed41c59fa7bf67f31d173fe5c20a1ce10a6ac843f21550a0778679
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 4 IoCs
  • Detects executables packed with SmartAssembly 4 IoCs
  • Detects executables packed with Yano Obfuscator 4 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4840
    • \??\c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2bc,0x2c0,0x2c4,0x2a0,0x2c8,0x140325960,0x140325970,0x140325980
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4112
    • \??\c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4840_UQNWPIWJABQFQMUT" --sandboxed-process-id=2 --init-done-notifier=1264 --sandbox-mojo-pipe-token=14272832063294168300 --mojo-platform-channel-handle=1240 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:628
    • \??\c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-09-29_f05791a84c2fbae2cee08ea64fcf6450_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4840_UQNWPIWJABQFQMUT" --sandboxed-process-id=3 --init-done-notifier=884 --sandbox-mojo-pipe-token=17820060879759501839 --mojo-platform-channel-handle=872
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:64
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:4696
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4748
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2852
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:228
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3836
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4996
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4572
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4008
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3184
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2740
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2908
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:5080
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4512
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:2424
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4056
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:820
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4568
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:3644
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3952
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4252
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1220
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4740
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:4640
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:732
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1380
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:2964

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 0b4dca7388fc9f0c77bbe7ed7b39df857978e7f15db6695d61247685e20744e1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 e691414260d7d6c8c70c3547186af2d6921ac72ef0ee0c9102b7df9efe05924b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 70bda71718d2bcf1f52b00986c85ad4c16e5f760583f82cb916814b1e3aecf44
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 6527c18ae9901dd5deda487c95cf967680184723d8c437d4e78c31a591168d82
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 50a52762fb8c8a6908d428b864bd431cde840c1c68b804d1e96df3a4e2527d4c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 71f119e5710ac3c5cef078ecd7efca50d734a02724439da378178254e26d93de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 51c261a2f9c3f20e9d315b3e15de65226eb492259231be1c26bee4cf401759cc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 c6829b89364a58d427c5bc11ea5c2094ee053723cdbb17a0ea58e5a89d40a8a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 0fbd52893310417a36e929bd668be95a830eda0a694ae6e7e976bc31885359bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 c4a3dde68828e054d56bc227426c71e8a38a19f94ef09ba60541f54bd5e21680
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 d81565e1fdb28518f416bb580704a2bafb482fe32711a91ea9c0dcb87ddf64dc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 2c5df322ebe80720af82f0f41dfa49fd4f64dc71e971b1b2b7dce81318da8c69
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 dc276311a9540bc235df73ff1c423156196f70fa3773b0d596f77536bfe9e2f0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.3MB
            • SHA256 dbe344627b1ef90b9ed3709b0ed2309b16d70234c3c5383dffdeaebfa50867b1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 6.6MB
            • SHA256 18879cc7b1aa7b59dc210d7f86561222c8d0c570c2d9e24bed4c9ffdf7600549
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 6255a9457ca4c381ee183989f2c8851e2b30022f062e030196a251255504c814
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 8d9dd7bae49abade837cac9f4a3fac59f909f3222f111e4d3c44acb5cc5b59a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 8fb535efe2d7334191a86829c77a6e478185eec266880d5733fd3e66f6a21504
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 f0ef5d128dc68553e33ef1085121279988b4f34760515d5849877a1969fdb824
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 c98915b028fc820b72518ccebc7aa6c9549d09c7d56efdaaf515906e0a027c17
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            software_reporter_tool-sandbox.log
            • Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
            • Size 3KB
            • SHA256 a1f08611fde33e04e68ce83d3e5831089366095d0374665236a14765f1e0ebe5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            edls_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
            • Size 449KB
            • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em000_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em000_64.dll
            • Size 37KB
            • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em001_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
            • Size 378KB
            • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em002_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
            • Size 2.3MB
            • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em003_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
            • Size 1.3MB
            • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em004_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em004_64.dll
            • Size 6.1MB
            • SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em005_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em005_64.dll
            • Size 576KB
            • SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 440817bbe023ef6a0d3e9aeb559368f24d13cf86ba256ca93bcfbd49f21c7b49
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 a4edbbfa5ba3ee5f56e0a897594319f23ecfe955631ec4ec5f88e0bec9ea5211
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.3MB
            • SHA256 515d98103faea8a7dc9803b8f17367f9605193b037a67113ab44a08a5b641c0d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 7458b91fd9082f686109172901c4ac76ad49cead8813281a54591d45902244f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 fca5ca992d43c2fe204418dfd436223797627563ed8f53b0505f4d26187dacac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 90b1847be0ad1f23c4ba407a30b6b5a109731928c32f3808df8a3d97d2d3b03b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.3MB
            • SHA256 6d311f5c773f9b03b6bd20383e49d8e456e6ec3a9393a4b7a24456dcb431146b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 396495cd3f66f18daeb13c6c02b7d65f61601ed69e164916b3e44f01a8fb1023
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 71e82f18c36d86fca9b9792e0053c50f3b83751dedb9619254fa6512abe19af7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 257a8a1a26d56b256de453d19e1016a029558b66359c22a9fd72bf6e90edb8e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 43539d948b9fc5f778b63d43ee56dfdc61658e26ce380e3173f76885de0e50d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 e3d39338e1d471cf84e0b9028ef5b3f9f60d5067efe55ce16c1ad578850a7bce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.3MB
            • SHA256 88e75a495686132a875b17f27b43dddd1558dce8d9138558273c8c1db56e7401
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 282f6f0dbab0e0ae4baa041d9b9ff2f3741807a78f2c9a21683778de7d57d771
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\System32\msiexec.exe
            • Size 1.2MB
            • SHA256 747704e2765aaba0ead9a573e866bbfd98cea144b8cde9b172ac00c419941876
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 7d43ce654c17898f4340c0e6a69338693fbcf35853c4bdd00ee072f057467769
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 be465728958211be0dbdd90b80a6928bbc309713a6bc6f56fcd2b4a9a0b29293
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.4MB
            • SHA256 d22edb2a6625bed64a0240e9a1a8f7572cf5155620510da90214bc9679fb8e55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 d4054d24ec03d4a56b47fc65e0caad782c89f9bd8b8138baf5071181f1088bda
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 a73d1228961dd7c088f38764e16da24659126b79c46a4fcbfe089d34678a32d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.5MB
            • SHA256 6887b7e15d891ee0ccfd21e8c1fb33e975e42fdffc9101b5d6fa1acf9401a179
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
            • Size 40B
            • SHA256 b06b82269f7c8b298fc3fa565faceb01cac03369dea5ecf7b34597d0c4c77853
            • MD5 SHA1 SHA512
            Submit Download

            memory/64-409-0x00000249000F0000-0x0000024900150000-memory.dmp
            Download

            memory/64-424-0x0000024900000000-0x0000024900030000-memory.dmp
            Download

            memory/64-410-0x00000249000F0000-0x0000024900150000-memory.dmp
            Download

            memory/228-68-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/228-47-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/628-421-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/628-357-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/628-359-0x00007FFF07BD0000-0x00007FFF07BD1000-memory.dmp
            Download

            memory/628-358-0x00007FFF07850000-0x00007FFF07851000-memory.dmp
            Download

            memory/628-361-0x00000221FB480000-0x00000221FB4E0000-memory.dmp
            Download

            memory/628-360-0x00000221FB480000-0x00000221FB4E0000-memory.dmp
            Download

            memory/628-420-0x00000221FB450000-0x00000221FB480000-memory.dmp
            Download

            memory/628-687-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/732-191-0x0000000009E60000-0x0000000009E68000-memory.dmp
            Download

            memory/732-159-0x0000000001770000-0x0000000001780000-memory.dmp
            Download

            memory/732-175-0x0000000001A20000-0x0000000001A30000-memory.dmp
            Download

            memory/732-419-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/732-277-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/732-393-0x000000000B380000-0x000000000B388000-memory.dmp
            Download

            memory/732-396-0x000000000B370000-0x000000000B378000-memory.dmp
            Download

            memory/732-394-0x000000000B370000-0x000000000B371000-memory.dmp
            Download

            memory/820-133-0x0000000000D90000-0x0000000000DF0000-memory.dmp
            Download

            memory/820-257-0x0000000140000000-0x0000000140241000-memory.dmp
            Download

            memory/820-127-0x0000000000D90000-0x0000000000DF0000-memory.dmp
            Download

            memory/1220-264-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2424-252-0x0000000140000000-0x00000001401D5000-memory.dmp
            Download

            memory/2740-93-0x00000000004F0000-0x0000000000550000-memory.dmp
            Download

            memory/2740-248-0x0000000140000000-0x00000001401EA000-memory.dmp
            Download

            memory/2740-87-0x00000000004F0000-0x0000000000550000-memory.dmp
            Download

            memory/2908-105-0x00000000007C0000-0x0000000000827000-memory.dmp
            Download

            memory/2908-249-0x0000000000400000-0x00000000005D6000-memory.dmp
            Download

            memory/2908-100-0x00000000007C0000-0x0000000000827000-memory.dmp
            Download

            memory/2964-433-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-442-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-445-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-446-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-447-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-448-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-449-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-450-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-443-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-451-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-452-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-435-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-444-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-439-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-453-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-436-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-437-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-438-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-427-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-428-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-429-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-430-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-432-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-431-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-434-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-441-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/2964-440-0x000001DDC08C0000-0x000001DDC08D0000-memory.dmp
            Download

            memory/3184-83-0x00000000004E0000-0x0000000000540000-memory.dmp
            Download

            memory/3184-77-0x00000000004E0000-0x0000000000540000-memory.dmp
            Download

            memory/3184-247-0x0000000140000000-0x000000014020E000-memory.dmp
            Download

            memory/3644-258-0x0000000140000000-0x0000000140221000-memory.dmp
            Download

            memory/3836-42-0x0000000000810000-0x0000000000870000-memory.dmp
            Download

            memory/3836-246-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/3836-418-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/3836-36-0x0000000000810000-0x0000000000870000-memory.dmp
            Download

            memory/3952-140-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4008-282-0x0000000140000000-0x00000001401F8000-memory.dmp
            Download

            memory/4056-122-0x0000000000760000-0x00000000007C0000-memory.dmp
            Download

            memory/4056-116-0x0000000000760000-0x00000000007C0000-memory.dmp
            Download

            memory/4056-253-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4112-16-0x0000000000820000-0x0000000000880000-memory.dmp
            Download

            memory/4112-44-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4112-10-0x0000000000820000-0x0000000000880000-memory.dmp
            Download

            memory/4112-417-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4252-263-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4512-363-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4512-251-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4572-70-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/4572-72-0x0000000140000000-0x0000000140214000-memory.dmp
            Download

            memory/4572-65-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/4572-59-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/4640-268-0x0000000140000000-0x0000000140205000-memory.dmp
            Download

            memory/4696-281-0x0000000140000000-0x00000001401E9000-memory.dmp
            Download

            memory/4740-265-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4748-29-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/4748-46-0x0000000140000000-0x00000001401E8000-memory.dmp
            Download

            memory/4748-23-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/4840-3-0x0000000001FE0000-0x0000000002040000-memory.dmp
            Download

            memory/4840-18-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4840-416-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4840-6-0x0000000001FE0000-0x0000000002040000-memory.dmp
            Download

            memory/4840-690-0x0000000001FE0000-0x0000000002040000-memory.dmp
            Download

            memory/4840-691-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4996-49-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/4996-55-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/4996-325-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/5080-250-0x0000000140000000-0x00000001401D4000-memory.dmp
            Download