Overview

overview

10

Static

static

10

2026-09-29...a-.exe

windows10-2004-x64

9

2026-09-29...a-.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 17:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_a2cbd2451f377388f779ade819b1af98_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.9MB
  • Sample260930-wjcmnaee28
  • SHA256 d02dca37494143bc0be0c72adc528693d4dd039981f116a77bea90033fa03026
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 4 IoCs
  • Detects executables packed with SmartAssembly 4 IoCs
  • Detects executables packed with Yano Obfuscator 4 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 50 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_a2cbd2451f377388f779ade819b1af98_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_a2cbd2451f377388f779ade819b1af98_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5100
    • \??\c:\users\admin\appdata\local\temp\2026-09-29_a2cbd2451f377388f779ade819b1af98_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-09-29_a2cbd2451f377388f779ade819b1af98_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x304,0x308,0x30c,0x2fc,0x310,0x140325960,0x140325970,0x140325980
      2⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3312
    • \??\c:\users\admin\appdata\local\temp\2026-09-29_a2cbd2451f377388f779ade819b1af98_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-09-29_a2cbd2451f377388f779ade819b1af98_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5100_EESGAIZKEZNWGDIK" --sandboxed-process-id=2 --init-done-notifier=876 --sandbox-mojo-pipe-token=13810056510875306113 --mojo-platform-channel-handle=852 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4596
    • \??\c:\users\admin\appdata\local\temp\2026-09-29_a2cbd2451f377388f779ade819b1af98_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-09-29_a2cbd2451f377388f779ade819b1af98_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5100_EESGAIZKEZNWGDIK" --sandboxed-process-id=3 --init-done-notifier=1468 --sandbox-mojo-pipe-token=2842509546716853714 --mojo-platform-channel-handle=1464
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4480
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    PID:4604
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:5628
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2124
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:5072
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:5140
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4760
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:4260
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:3852
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:2408
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5976
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5848
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:2956
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:1908
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2724 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:4444
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
          • Modifies data under HKEY_USERS
          PID:252
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:5840
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:4388
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2724 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
            2⤵
              PID:2580

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                • Size 2.7MB
                • SHA256 71466ea5d6a60ce883078b26457020e62f1612da042c664ddd7ebcc9759ccab0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 1.4MB
                • SHA256 a63ce1014e476cd99f57c969b42b1504fd1b793fdf3b37a02a4f87f0fbbf464f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 1.7MB
                • SHA256 cdb8586466b2e3a9ac0a6a84a1625bbcfc4f38d88ac473895967e4771a39eb6c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 1.5MB
                • SHA256 29b49866ce6c899fc124be9a60a2977a66bbe5e58e9df58926b2adfc41ff0860
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 1.2MB
                • SHA256 3d86a7bec0d79c9a532db38bbdf7b3cad5ba5d7d4839011d538cfbf1aecbc1cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 1.2MB
                • SHA256 6098a9b57891191444514742f6fa773d11440b8fe73e32dbd1d9d756ebaef9b0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 1.4MB
                • SHA256 b83388e2aeee395d5d486fd00b55dec7dddeee97b9d959cfe088ee88219ebec8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 4.6MB
                • SHA256 84128bd9571286a3704a063b2b58bb97ce219cdf38ccb28bb047ec9f875d7121
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 1.5MB
                • SHA256 3fdf85eeef594e68fb6e78d0685fc4ad6d8cb9f3fa65d32330d8f82e9171e6ba
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 24.0MB
                • SHA256 72d5f2575c7aa42f589e371f457b7758bee7129d999adc9030422750c876d76c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 2.7MB
                • SHA256 5a628b237ae3ee06dc6d331047315d79d5c3fea4a8d467c3a0cfeaee21641516
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LICLUA.EXE
                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                • Size 1.1MB
                • SHA256 eceae1f2abb6212ce8465fd317418a9b5c43dbcf529ef7550abad4efb67bf543
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 1.4MB
                • SHA256 57cec54f8d22b64fdc6d2d6fa446e8770850e88bb1ca70194b6631f24e6b7b41
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 1.3MB
                • SHA256 7f2e95b28d9b1fed6ef6063781ae560aa60b97c630e18d9ff4e548562fc7a52b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 6.6MB
                • SHA256 0c21c26dbccc6d424421d3e1ec9d26268f42381d49f4065bdf16223c209f98d0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 6.6MB
                • SHA256 cd4b2053122650131df5fe901fb4d1f63e9fe85cdc1d209956468871dafc9d9c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 2.3MB
                • SHA256 79f118efcf3acb27e34de775b77a4913c35e3e950dc4e4cf1ff1b470931277be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 4.0MB
                • SHA256 fbfe3a7f5a169a59f8d83f6e655ad0b74e340eb4e0d527b60e39cab54b3572ab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 2.8MB
                • SHA256 91c61905646b95b1d7b50cbce835746326ab25fc147e3e52edc0849033569683
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 2.2MB
                • SHA256 590258ac70da9d7bf2b5e0cf0abd4dc9c720745db460c74c565eee5dcedea9b6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 2.4MB
                • SHA256 a004d08ef11d6cb16313865495c7d81878f0c31a3ca154c62e31c5865583ba53
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 2.0MB
                • SHA256 5268bb0343f23cd0a460604c20ea09b60dd176adce1f97bc469f923212bd0aa8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 1.2MB
                • SHA256 1fa04263a40e4a1156bb4ab80d447bae9867237f23755252113710a06a822da1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 1.2MB
                • SHA256 16b65c83059387289e3df11671cfcbef58ea08727ca41544753884df14cdde07
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 1.2MB
                • SHA256 76c39a91af15aa2cc2c714d6bb7d373cc267e3e0077ede148ed35c94db1b6182
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 1.2MB
                • SHA256 56ce40ebb6111cc834e883b1cf5b6ac784d0399abd2fb943fca4c210915511f9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 1.2MB
                • SHA256 778ef7d1c7c252ee6e369626e77566959eb32b249fbb1e023d3cd30455c8b210
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MsSense.exe
                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                • Size 1.6MB
                • SHA256 77f229d62cfb29603bb3399c3472a5bf17f85c59737ab6d2f81ed0ca57e277e5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                NisSrv.exe
                • Path C:\Program Files\Windows Defender\NisSrv.exe
                • Size 3.5MB
                • SHA256 1f7b46f94f32350597d01d2ec82eebcf5ae5089c1b361f32387dedd657dd1d14
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 1.4MB
                • SHA256 474d177eae106ed26fc7a79c9754bbf3d5bfa016e012f03fe07ad42225c2ff87
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 1.3MB
                • SHA256 eac2819dc783712f5bb6dd412c3a3506f6268a025fda7bf5e01da09e67194c95
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                • Size 1.1MB
                • SHA256 887e76d78d5903662e95d2560a87b71b6ab09eb136aa75241f8d397c6303e215
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db-wal
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                • Size 1.4MB
                • SHA256 ec5dfcf71c349877ecd053923a4d3935b15fbc794a5849c2ca3bb662f4452bdf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                software_reporter_tool-sandbox.log
                • Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
                • Size 1KB
                • SHA256 ec5820aa818697ed7502511d5d1109dff1fa3a2153f9bf621d1cb8008ad5ce47
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                edls_64.dll
                • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
                • Size 449KB
                • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                em000_64.dll
                • Path C:\Users\Admin\AppData\Local\Temp\em000_64.dll
                • Size 37KB
                • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                em001_64.dll
                • Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
                • Size 378KB
                • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                em002_64.dll
                • Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
                • Size 2.3MB
                • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                em003_64.dll
                • Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
                • Size 1.3MB
                • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                em004_64.dll
                • Path C:\Users\Admin\AppData\Local\Temp\em004_64.dll
                • Size 6.1MB
                • SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                em005_64.dll
                • Path C:\Users\Admin\AppData\Local\Temp\em005_64.dll
                • Size 576KB
                • SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 1.2MB
                • SHA256 7d7cad03bacff426feb5781cc33d3ec00fd2dcfd3b7a3f3b4cc806477898fd8c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AgentService.exe
                • Path C:\Windows\System32\AgentService.exe
                • Size 1.4MB
                • SHA256 ab93a230833bd73f92cb9622762d7f1692dfcf80ea479a0c3f216b3af0acbb92
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.7MB
                • SHA256 4bbd199367f976b563673fae153a02525e3bd05f862796312f361deedfdd2f66
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 1.4MB
                • SHA256 0118ce4b341dc000ab94442c5e24bf3a1ff10c88606dc45002b278705dda4fda
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReFsDedupSvc.exe
                • Path C:\Windows\System32\ReFsDedupSvc.exe
                • Size 2.6MB
                • SHA256 ee9e1031f59cbb275f21fc4807be31c1a072e6c6b2bb949ead88b602a484015e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.4MB
                • SHA256 30566798e6ff38d9a50d4a060e68ae2ffb079856037ff083f0e6e5fec0938ff5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.7MB
                • SHA256 cacffeffc9c4ebd92f88f944350e96f704b24fd32b5ece398f40fcd51f951055
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 04b521705a977f184653095c849ec7ff1591a0d9dc41ba35ebd89990f82ecfb3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                • Size 1.6MB
                • SHA256 cebeee66d9c959b22aa644a4de81370508e3120fefe3c17f86b1b5d200d3f493
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                settings.dat
                • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
                • Size 40B
                • SHA256 b0a7f263067965c12927ba8e5798b9e231d45bc2b36bacef4d0f889ced7cdc7c
                • MD5 SHA1 SHA512
                Submit Download

                memory/2124-103-0x0000000140000000-0x0000000140214000-memory.dmp
                Download

                memory/2124-107-0x0000000001AE0000-0x0000000001B40000-memory.dmp
                Download

                memory/2124-116-0x0000000140000000-0x0000000140214000-memory.dmp
                Download

                memory/2124-111-0x0000000001AE0000-0x0000000001B40000-memory.dmp
                Download

                memory/2124-96-0x0000000001AE0000-0x0000000001B40000-memory.dmp
                Download

                memory/2408-248-0x0000000140000000-0x000000014027D000-memory.dmp
                Download

                memory/2408-178-0x0000000000890000-0x00000000008F0000-memory.dmp
                Download

                memory/2408-184-0x0000000000890000-0x00000000008F0000-memory.dmp
                Download

                memory/2408-188-0x0000000140000000-0x000000014027D000-memory.dmp
                Download

                memory/3312-21-0x0000000000880000-0x00000000008E0000-memory.dmp
                Download

                memory/3312-11-0x0000000000880000-0x00000000008E0000-memory.dmp
                Download

                memory/3312-20-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/3312-149-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/3852-166-0x0000000000830000-0x0000000000890000-memory.dmp
                Download

                memory/3852-250-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/3852-246-0x0000000000830000-0x0000000000890000-memory.dmp
                Download

                memory/3852-241-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/3852-165-0x0000000140000000-0x00000001401BA000-memory.dmp
                Download

                memory/3852-172-0x0000000000830000-0x0000000000890000-memory.dmp
                Download

                memory/4260-240-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/4260-384-0x0000000000740000-0x00000000007A0000-memory.dmp
                Download

                memory/4260-154-0x0000000000740000-0x00000000007A0000-memory.dmp
                Download

                memory/4260-161-0x0000000000740000-0x00000000007A0000-memory.dmp
                Download

                memory/4260-153-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/4260-386-0x0000000140000000-0x00000001402C9000-memory.dmp
                Download

                memory/4480-102-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/4480-493-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/4480-95-0x000001BAD1BB0000-0x000001BAD1C10000-memory.dmp
                Download

                memory/4480-228-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/4480-104-0x000001BAD1BB0000-0x000001BAD1C10000-memory.dmp
                Download

                memory/4596-26-0x00007FFDE4490000-0x00007FFDE4491000-memory.dmp
                Download

                memory/4596-494-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/4596-28-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/4596-187-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/4596-29-0x00000185D2A80000-0x00000185D2AE0000-memory.dmp
                Download

                memory/4596-27-0x00000185D2A80000-0x00000185D2AE0000-memory.dmp
                Download

                memory/4596-25-0x00007FFDE3EC0000-0x00007FFDE3EC1000-memory.dmp
                Download

                memory/4604-33-0x0000000000D10000-0x0000000000D70000-memory.dmp
                Download

                memory/4604-191-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/4604-61-0x0000000000D10000-0x0000000000D70000-memory.dmp
                Download

                memory/4604-32-0x0000000140000000-0x00000001402E9000-memory.dmp
                Download

                memory/4760-239-0x0000000000400000-0x00000000005D6000-memory.dmp
                Download

                memory/4760-142-0x00000000008F0000-0x0000000000957000-memory.dmp
                Download

                memory/4760-147-0x00000000008F0000-0x0000000000957000-memory.dmp
                Download

                memory/4760-150-0x0000000000400000-0x00000000005D6000-memory.dmp
                Download

                memory/5072-124-0x0000000000860000-0x00000000008C0000-memory.dmp
                Download

                memory/5072-233-0x0000000140000000-0x000000014020E000-memory.dmp
                Download

                memory/5072-118-0x0000000000860000-0x00000000008C0000-memory.dmp
                Download

                memory/5072-127-0x0000000140000000-0x000000014020E000-memory.dmp
                Download

                memory/5100-126-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/5100-6-0x00000000007B0000-0x0000000000810000-memory.dmp
                Download

                memory/5100-0-0x00000000007B0000-0x0000000000810000-memory.dmp
                Download

                memory/5100-9-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/5100-497-0x0000000140000000-0x0000000140F04000-memory.dmp
                Download

                memory/5100-495-0x00000000007B0000-0x0000000000810000-memory.dmp
                Download

                memory/5140-131-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                Download

                memory/5140-235-0x0000000140000000-0x000000014020A000-memory.dmp
                Download

                memory/5140-137-0x0000000140000000-0x000000014020A000-memory.dmp
                Download

                memory/5140-138-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                Download

                memory/5628-79-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/5628-69-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/5628-70-0x00000000006E0000-0x0000000000740000-memory.dmp
                Download

                memory/5628-208-0x0000000140000000-0x00000001402D4000-memory.dmp
                Download

                memory/5848-278-0x0000000140000000-0x0000000140172000-memory.dmp
                Download

                memory/5848-209-0x0000000140000000-0x0000000140172000-memory.dmp
                Download

                memory/5848-210-0x0000000000620000-0x0000000000680000-memory.dmp
                Download

                memory/5848-216-0x0000000000620000-0x0000000000680000-memory.dmp
                Download

                memory/5976-201-0x0000000000750000-0x00000000007B0000-memory.dmp
                Download

                memory/5976-203-0x0000000140000000-0x0000000140168000-memory.dmp
                Download

                memory/5976-199-0x0000000000750000-0x00000000007B0000-memory.dmp
                Download

                memory/5976-193-0x0000000000750000-0x00000000007B0000-memory.dmp
                Download

                memory/5976-192-0x0000000140000000-0x0000000140168000-memory.dmp
                Download