Overview

overview

10

Static

static

10

2026-10-02...a-.exe

windows10-2004-x64

9

2026-10-02...a-.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/10/2026, 17:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.9MB
  • Sample261003-vybs8stbpe
  • SHA256 fd6617d99f20e624ce7fd58eb7833fb4875786a7c17af7a6bab005bfa67e9b50
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 4 IoCs
  • Detects executables packed with SmartAssembly 4 IoCs
  • Detects executables packed with Yano Obfuscator 4 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:372
    • \??\c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2d4,0x2cc,0x2d8,0x2d0,0x2dc,0x140325960,0x140325970,0x140325980
      2⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2312
    • \??\c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_372_KHXJMBDEDKSVJVAC" --sandboxed-process-id=2 --init-done-notifier=832 --sandbox-mojo-pipe-token=13867417092922787389 --mojo-platform-channel-handle=808 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:5008
    • \??\c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_372_KHXJMBDEDKSVJVAC" --sandboxed-process-id=3 --init-done-notifier=1404 --sandbox-mojo-pipe-token=2096742674144961372 --mojo-platform-channel-handle=1400
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4936
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:4736
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    PID:2536
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4860
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3164
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4028
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2456
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:4848
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2192
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1968
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2308
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4864
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4452
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2124
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:4804
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1860
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2484
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:3556
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1812
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4700
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4776
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5040
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1744
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:3064
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3700
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4856
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:2588

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 fa1c6257917c9e9fa539f870a8b561e1d079f4ce1e9ac1b236e068460825c2c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.7MB
            • SHA256 b1138e827c30cc942d7a668c73b46f1e05b99d4068650ac54b1eb9823301c100
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 2.0MB
            • SHA256 ae2f7923bcfcc1cd91d5dc8a324a6e998ba7a8cb54826345dd54ff0961128d5c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 27be7250eb36830267fa3bc4ea2c26d48e84f2f9691eecc9287a40746af3548e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 509e4579d177322d51c95b92cfd7cf2167c9dd6ebf8aa176f3da764b00472ea5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.4MB
            • SHA256 43d3057f2115d3e8ed95fd0326a3e0b212dee50ca1d80accbbf6bba0f3e45f1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.7MB
            • SHA256 8ab8752a268b9f15233c5d70f00ed0cf3a7625200a730f3c605db2ca31da2a81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 1d544f622a38ce77fb7ba3e1ffe41177c369c300130ba4fd0a2d13375731fef7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.8MB
            • SHA256 653a6faf0d3b14b8ece945a4f4196c19abf877acebae2dee3327b6dead0cbe7f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 ee7109c59e478e863e2875227321954a2ab33398b045d117fe2e674e15738e67
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 979c9db27972e34ac5afc606baa7a8d7a27fba40bf03d28eb4ca1b358d4b79b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 47dbdd90fc154bd59b566e8d3da7ee7fae0def67a7754893deddcf682a085624
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.7MB
            • SHA256 e590d69311c6c062853b7e4d7e11249503bbe9ad78bdee7b3629f2420119eb84
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.5MB
            • SHA256 59ba5e8dda0712ba7a5797e7c4bc4645f04c1abdfe47c2b1d553a00a6dc36e7e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 571ea1ed4461233fad42c0ec8e00921d9400cea0f05060173e64b449bdc58c60
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 2154287d858aa6ef6d58609d2e8837526aae71d6783281df8d7cfcc5705fd4e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 45dcb13f0bcb557de69e208ffca72dbfff499c7c556b3207c6567955e3db4a04
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            firefox.exe
            • Path C:\Program Files\Mozilla Firefox\firefox.exe
            • Size 1.2MB
            • SHA256 1f4bbe5159dec1025a2ad105c296b3b04dd7b9593f97e1c81cde40b2f69fa4cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            private_browsing.exe
            • Path C:\Program Files\Mozilla Firefox\private_browsing.exe
            • Size 1.5MB
            • SHA256 35051546546f9c047b8644aad71ec7eb33940bd9f63aae1d7d5edad0c1c04f08
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 a5127cdde94e56b4a53cc64fecc919c9b85f0801176478bf22d5994a6709dbc5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.6MB
            • SHA256 505a6ef04d4723705334d6358ba11c7222a1121c55fd7db28b34e94674c9429f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            software_reporter_tool-sandbox.log
            • Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
            • Size 1KB
            • SHA256 673bd936a8f8dbf0aebc4a4a27806272795ec5a7b55c2254795ff026db7604fc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            edls_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
            • Size 449KB
            • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em000_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em000_64.dll
            • Size 37KB
            • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em001_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
            • Size 378KB
            • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em002_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
            • Size 2.3MB
            • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em003_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
            • Size 1.3MB
            • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            em004_64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\em004_64.dll
            • Size 6.1MB
            • SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ec173766c665fbf6.bin
            • Path C:\Users\Admin\AppData\Roaming\ec173766c665fbf6.bin
            • Size 12KB
            • SHA256 dfa6a94de15c2c87996b9e5f922767db7e084fa82114d6ab592b5c6b33fcc1c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.4MB
            • SHA256 580b368b20f6e36cceae4eb0c9ff0db7e64da67b82ff8410955fd2664ee3f4f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 f8a6ac9fbfcd4131773e3fc9d17178825f3100fccc350af8b8255854ce499e34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.5MB
            • SHA256 d3bc8d07d680beb565f583c3b2b5e512259597580ba1032a0830c5675b7b0b10
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 29732536e8bc485efedbbc803c0443382e060a4d1ee5c793aacddc35ccc27af6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.4MB
            • SHA256 88224cc28a1f353ce8e9e54a70bce50a916d700f0f27597a8f3fbfb119a49e22
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.8MB
            • SHA256 2e6d8a37c3ffdb90e40f0a4f5891ffec77849d5df570bf93f49239976d2959f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.5MB
            • SHA256 d462281afe0a8d94b4df20a71de51ef6ab49f96ccbbd8c3cc252d2c9129a1350
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 250bbb9a7c30d2393516a670d5c15f5d640e3ec63416c496a082779cd0ff2cbf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 2ec6204dfea8bc33d6295e05883d1f55db968c3267967a3bb47302f521f7dcd1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 68aae9794e1eea4b563407860b6111bb52b5e7b35ad17a607ae0b2866a6d46a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.7MB
            • SHA256 e4572d5b2274953d553bb35e954fdd0ae29fa04b9cabaece15f200536470f57d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 324a56709399f90a20ab3bfd4ead7a7d89e10d5f1deebab3d1ff625a5911c03f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.5MB
            • SHA256 54a1ee01e23d1222dd492f241e2cb92942db2889adf76dd8e47837b1edc48f3a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.6MB
            • SHA256 cfc4ed94cab478f946a917053389c82e70bbfc48b0de36a617a8540899ddf388
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\System32\msiexec.exe
            • Size 1.5MB
            • SHA256 3fefdedfaf07f8cdd9324585391a424751d0591de5ce350991106da3e59b9bce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.4MB
            • SHA256 1688e6ce20e13e7002d51c640df30b302460bd10e361eb1f210c7a772270924c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 f1f4cdadee43609db05eca70f98fee941254532546d96c5913ec9375eb054894
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.6MB
            • SHA256 35626e7d4cd29bcccebf0d32cddf0bcaed6aa4615ba6582a3c6b2ba08095f2bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 024235b2d966d6ad9ee2662bb0f1e253f98f66e85ef48bff2507ec460179423f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 836d01e513473acffd5848b2922121508396aee456c2249524c1ad7216e1335e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.7MB
            • SHA256 00879c35b4d7ba2793013f1115214750665a943112dae57432a2974a60e3147b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
            • Size 40B
            • SHA256 98664334dd7be6dc7eec406c72e9dde658c3fbada283d4acb8d0316a18d38fb1
            • MD5 SHA1 SHA512
            Submit Download

            em005_64.dll
            • Path \??\c:\users\admin\appdata\local\temp\em005_64.dll
            • Size 576KB
            • SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/372-0-0x0000000001FC0000-0x0000000002020000-memory.dmp
            Download

            memory/372-10-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/372-6-0x0000000001FC0000-0x0000000002020000-memory.dmp
            Download

            memory/372-701-0x0000000001FC0000-0x0000000002020000-memory.dmp
            Download

            memory/372-179-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/372-702-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/1744-226-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/1744-286-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/1812-208-0x0000000140000000-0x00000001401C2000-memory.dmp
            Download

            memory/1860-188-0x0000000000780000-0x00000000007E0000-memory.dmp
            Download

            memory/1860-207-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1860-182-0x0000000000780000-0x00000000007E0000-memory.dmp
            Download

            memory/1968-216-0x0000000140000000-0x00000001401AF000-memory.dmp
            Download

            memory/1968-143-0x00000000007B0000-0x0000000000810000-memory.dmp
            Download

            memory/1968-137-0x00000000007B0000-0x0000000000810000-memory.dmp
            Download

            memory/1968-145-0x0000000140000000-0x00000001401AF000-memory.dmp
            Download

            memory/2124-218-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2124-175-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2192-85-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/2308-221-0x0000000140000000-0x000000014018B000-memory.dmp
            Download

            memory/2308-154-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/2308-156-0x0000000140000000-0x000000014018B000-memory.dmp
            Download

            memory/2308-148-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/2312-76-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2312-17-0x0000000002010000-0x0000000002070000-memory.dmp
            Download

            memory/2312-201-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/2312-11-0x0000000002010000-0x0000000002070000-memory.dmp
            Download

            memory/2456-52-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/2456-46-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/2456-87-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/2536-29-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/2536-23-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/2536-84-0x0000000140000000-0x0000000140189000-memory.dmp
            Download

            memory/2588-302-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-295-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-299-0x0000014569E50000-0x000001456BD27000-memory.dmp
            Download

            memory/2588-306-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-307-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-430-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-431-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-432-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-433-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-429-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-309-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-428-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-427-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-426-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-425-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-424-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-422-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-308-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-304-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-423-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-293-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-292-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-294-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-297-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-296-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-301-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-300-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-303-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/2588-305-0x0000014569840000-0x0000014569850000-memory.dmp
            Download

            memory/3064-287-0x0000000140000000-0x00000001401A6000-memory.dmp
            Download

            memory/3064-233-0x0000000140000000-0x00000001401A6000-memory.dmp
            Download

            memory/3164-69-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/3556-203-0x0000000140000000-0x00000001401E2000-memory.dmp
            Download

            memory/3556-193-0x0000000000940000-0x00000000009A0000-memory.dmp
            Download

            memory/3556-199-0x0000000000940000-0x00000000009A0000-memory.dmp
            Download

            memory/3700-420-0x000000000D400000-0x000000000D408000-memory.dmp
            Download

            memory/3700-234-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/3700-421-0x000000000D400000-0x000000000D408000-memory.dmp
            Download

            memory/3700-288-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/3700-282-0x000000000CEE0000-0x000000000CEE8000-memory.dmp
            Download

            memory/3700-267-0x0000000009F70000-0x0000000009F78000-memory.dmp
            Download

            memory/3700-235-0x0000000001880000-0x0000000001890000-memory.dmp
            Download

            memory/3700-251-0x0000000001B30000-0x0000000001B40000-memory.dmp
            Download

            memory/4028-36-0x0000000000C40000-0x0000000000CA0000-memory.dmp
            Download

            memory/4028-42-0x0000000000C40000-0x0000000000CA0000-memory.dmp
            Download

            memory/4028-86-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/4452-229-0x0000000140000000-0x0000000140175000-memory.dmp
            Download

            memory/4452-172-0x0000000140000000-0x0000000140175000-memory.dmp
            Download

            memory/4700-212-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4700-213-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4736-83-0x0000000140000000-0x000000014018A000-memory.dmp
            Download

            memory/4776-284-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4776-217-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4804-202-0x0000000140000000-0x0000000140176000-memory.dmp
            Download

            memory/4848-66-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/4848-68-0x0000000140000000-0x00000001401B5000-memory.dmp
            Download

            memory/4848-56-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/4848-62-0x0000000001A70000-0x0000000001AD0000-memory.dmp
            Download

            memory/4864-160-0x0000000000580000-0x00000000005E7000-memory.dmp
            Download

            memory/4864-165-0x0000000000580000-0x00000000005E7000-memory.dmp
            Download

            memory/4864-167-0x0000000000400000-0x0000000000577000-memory.dmp
            Download

            memory/4864-225-0x0000000000400000-0x0000000000577000-memory.dmp
            Download

            memory/4936-674-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4936-211-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4936-128-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/4936-131-0x000001DC47A90000-0x000001DC47AF0000-memory.dmp
            Download

            memory/4936-132-0x000001DC47A90000-0x000001DC47AF0000-memory.dmp
            Download

            memory/5008-78-0x00007FFF88290000-0x00007FFF88291000-memory.dmp
            Download

            memory/5008-79-0x00007FFF89AE0000-0x00007FFF89AE1000-memory.dmp
            Download

            memory/5008-80-0x000001F384330000-0x000001F384390000-memory.dmp
            Download

            memory/5008-675-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/5008-81-0x000001F384330000-0x000001F384390000-memory.dmp
            Download

            memory/5008-88-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/5008-206-0x0000000140000000-0x0000000140F04000-memory.dmp
            Download

            memory/5040-285-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/5040-222-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download