Overview

overview

10

Static

static

10

2026-10-02...a-.exe

windows10-2004-x64

9

2026-10-02...a-.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 17:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.9MB
  • Sample261003-vybs8stbpe
  • SHA256 fd6617d99f20e624ce7fd58eb7833fb4875786a7c17af7a6bab005bfa67e9b50
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 4 IoCs
  • Detects executables packed with SmartAssembly 4 IoCs
  • Detects executables packed with Yano Obfuscator 4 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 50 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4900
    • \??\c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2c8,0x2f8,0x140325960,0x140325970,0x140325980
      2⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2252
    • \??\c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4900_DUQBIMHFFHSDYDIR" --sandboxed-process-id=2 --init-done-notifier=892 --sandbox-mojo-pipe-token=1244701952247661705 --mojo-platform-channel-handle=868 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:5904
    • \??\c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-10-02_0fe069e5cff1463ccfe844d6a364b94f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4900_DUQBIMHFFHSDYDIR" --sandboxed-process-id=3 --init-done-notifier=1472 --sandbox-mojo-pipe-token=4503458129073277348 --mojo-platform-channel-handle=1468
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3412
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    PID:5344
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4428
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:5812
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2844
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:5632
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3348
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:788
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:3156
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:2532
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5620
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:4712
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:1844
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2752 1896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:1084
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2912 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:5020
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:5316
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2912 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:3844
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2752 1896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:5484

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 25170395a7552f61089c5e3d3099b20d051acdab7c62e8064feb022be08ce6c2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.7MB
              • SHA256 9206d519b0d428ecaaf2edb906b0fc2f570f5ec5119896898f14b20fe9f627e0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 2.0MB
              • SHA256 2db5c0cbce030679cc8bf6fab9b4ff0dc7266d8efef225ec914d99b21a7d26fc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 b9e35ee6d4ddb2a520e974c3e0a7bcfcccb6a82fa5b014975d3b26f97c6f6804
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 723811f43b944993b6b3d2188c36e7683ea91c2c851842f6d88ab6af247ed44d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.4MB
              • SHA256 f2e437aad1c0ae2dab94b080b29942b8b64cd80e0f16390592b977c2a6375f70
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.7MB
              • SHA256 6376800c7c23d1d0173b1456ec5333348eb8bfc126a849b03b2d3e0160304c03
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 b9dd01d9057c5edeef6bdbc46ee059774a00c6117ad9436ba8b6f8876572a1bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.8MB
              • SHA256 c6dd4c796c53cc55defbda620a4c272075ed488ab45d6066572d8de4d655fe18
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 59d370448489589fd1f358fc4e25b0ddb8fe7ad1c89c676010c4eec35b30bb12
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 6cdeac10e08082a41a0379979aeaf75c65c6eaba59bb6bc7752dc061ab539110
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 04ed039e8e9f07339c1411d9e98d83b0eaffef899774d7f588a1ecb257adc4a7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.7MB
              • SHA256 e4beab877aa39497b1509885348b02ec3b7278d974d0a4d4033f31c0e8bdfeba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.5MB
              • SHA256 13e34afbedbf1fbbfcdedec6e8b3beb727beb29a44d1dff287644a716494aec6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 2b7bbcdf70a57b84f25e963b7ce88faa7b2355020730076327cc2f403e044f74
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 18e1da5bc19076886f7f22a4c251f918e9adbd236f33a83782a515858aff8325
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 f08b4ff6b26d308e48971cc32e36c677b90e85147085378385cdd79211058f4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 bfdcbd403319005788268a121908e4879e6d6d78f055511f6aaf820018a9fec5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 605298b28267dee6d49e4819e452ada2e21955a50107f606f2804a274ddde76b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 3720da1a0f76419b79fd9f6efcd7e825aab66f51a26fb7aae4d08115f6edb872
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 4627e28bc92ef51ed6d389b4b490b3270a4a42f0ad7f732717da25b41dd2499e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 b777211f24299b962a8adec7a4752f61111fe64b3d60bc38a786cac445d00019
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.4MB
              • SHA256 5be490a49e219c77b679022ecfc836ac33f17bf26b8ce409cbbd6d4e802716e1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.4MB
              • SHA256 d806a70bc8d18f0e52d0dc041c3d0829564c6403e44ed1abbdfcb59affcb122f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.4MB
              • SHA256 5011fd981058d7457cfe7487ec165efb14d2696993a34c91b728515c20cca283
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.5MB
              • SHA256 a49bf3b4cdba47bb7caa6d6eee90108829f61b69c07d89533878625fe89e2805
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.4MB
              • SHA256 2a93e6319f063f4f8dbe9e193178c97924a24314c10b186f26d51aac88c6a2f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MsSense.exe
              • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
              • Size 1.9MB
              • SHA256 42964d16ee9a3efa3e80f335fa13c5011093d4880977a640c8d88d3289d56e42
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NisSrv.exe
              • Path C:\Program Files\Windows Defender\NisSrv.exe
              • Size 3.5MB
              • SHA256 125c55fe16475d56da48e835fdbb6b6d344f07e510fc213f59e7b59efa7f3545
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.4MB
              • SHA256 95389f6b9c5bb128b9e8237b970eeee74c1eff999b89629e82baf59a31e5d7cc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.6MB
              • SHA256 cfeeef292818cd681b986a426da220dd78044df8d3a983bdd221dd13b645db10
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
              • Size 1.2MB
              • SHA256 23eb77651f4fefd992f1681256580042c63351a48e68686bae7f6db1de82da95
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db-wal
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
              • Size 4KB
              • SHA256 8ab015fa035c2538b1b03e148741c5dcd842ed7536b3fa32bf0dbde1f0028bf6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Windows.db-wal
              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
              • Size 1.5MB
              • SHA256 0bf767be679f52c0b634f0944b8c844d04420aa1986fc5992ff627981c08b92c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              software_reporter_tool-sandbox.log
              • Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
              • Size 1KB
              • SHA256 2e1a1a64f925510e7e9eecb74ba4155e1faaf4b11ec3593008a7a405a0c20ca4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              edls_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
              • Size 449KB
              • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em000_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em000_64.dll
              • Size 37KB
              • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em001_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
              • Size 378KB
              • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em002_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
              • Size 2.3MB
              • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em003_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
              • Size 1.3MB
              • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em004_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em004_64.dll
              • Size 6.1MB
              • SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              em005_64.dll
              • Path C:\Users\Admin\AppData\Local\Temp\em005_64.dll
              • Size 576KB
              • SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.4MB
              • SHA256 78dd16e5cbc3edc266c7cda6806bd6faf6dac5b9fd2dcad578ae6aa630865a7f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.4MB
              • SHA256 91ac8fd33ddda55731533da287c1afd0cbe2275c81584e79abeda720054405e0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 2.0MB
              • SHA256 1dbc4f57453022d0d339f422636d70c6fe53d8cc99a4921c23d75a6581be321b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.7MB
              • SHA256 8d08e857dfb00e1665366dcd38290b62c088f6b3889972ebb10b602105b4116c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReFsDedupSvc.exe
              • Path C:\Windows\System32\ReFsDedupSvc.exe
              • Size 2.6MB
              • SHA256 3ade30da18ffc39c1c8d97585a61c230c35426ac120b2ade3065c0ed7093dd02
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 6d4065d0a98ddd7d0861b63fdce9077acb9f66573726e7a1bd3cf6ca6abe0b1e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.7MB
              • SHA256 b98cb69132e85cbd2a88d6b4f491df21baa5c5f127bc42deb0f36766c1043ccd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 bde8717558db4bf7c9a9b7f68279ff823a6e3deee675bc3886b32088250d1005
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
              • Size 1.8MB
              • SHA256 1cc10ccf99de1c2c47c1b15818f6d91466d3b164357d5601b9da533a1bb5a4ea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              settings.dat
              • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
              • Size 40B
              • SHA256 783c0f68d4eafa473ba7a008f84622563e05cfb86195bfdc2c3f328aa248499f
              • MD5 SHA1 SHA512
              Submit Download

              memory/788-161-0x0000000000740000-0x00000000007A0000-memory.dmp
              Download

              memory/788-394-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/788-255-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/788-392-0x0000000000740000-0x00000000007A0000-memory.dmp
              Download

              memory/788-163-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/788-154-0x0000000000740000-0x00000000007A0000-memory.dmp
              Download

              memory/2252-18-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/2252-139-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/2252-12-0x0000000002190000-0x00000000021F0000-memory.dmp
              Download

              memory/2252-21-0x0000000002190000-0x00000000021F0000-memory.dmp
              Download

              memory/2532-191-0x0000000000D50000-0x0000000000DB0000-memory.dmp
              Download

              memory/2532-305-0x0000000140000000-0x000000014021E000-memory.dmp
              Download

              memory/2532-184-0x0000000140000000-0x000000014021E000-memory.dmp
              Download

              memory/2532-185-0x0000000000D50000-0x0000000000DB0000-memory.dmp
              Download

              memory/2844-120-0x0000000000970000-0x00000000009D0000-memory.dmp
              Download

              memory/2844-236-0x0000000140000000-0x00000001401AF000-memory.dmp
              Download

              memory/2844-119-0x0000000140000000-0x00000001401AF000-memory.dmp
              Download

              memory/2844-126-0x0000000000970000-0x00000000009D0000-memory.dmp
              Download

              memory/3080-352-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/3080-212-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/3080-213-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/3080-219-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/3156-177-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/3156-279-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/3156-174-0x00000000007A0000-0x0000000000800000-memory.dmp
              Download

              memory/3156-168-0x00000000007A0000-0x0000000000800000-memory.dmp
              Download

              memory/3156-315-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/3156-311-0x00000000007A0000-0x0000000000800000-memory.dmp
              Download

              memory/3348-143-0x0000000000400000-0x0000000000577000-memory.dmp
              Download

              memory/3348-238-0x0000000000400000-0x0000000000577000-memory.dmp
              Download

              memory/3348-149-0x0000000000970000-0x00000000009D7000-memory.dmp
              Download

              memory/3348-144-0x0000000000970000-0x00000000009D7000-memory.dmp
              Download

              memory/3412-167-0x00000186E61A0000-0x00000186E6339000-memory.dmp
              Download

              memory/3412-94-0x00000186E6660000-0x00000186E66C0000-memory.dmp
              Download

              memory/3412-98-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/3412-93-0x00000186E6660000-0x00000186E66C0000-memory.dmp
              Download

              memory/3412-195-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/3412-518-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/4428-46-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/4428-183-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/4428-89-0x00000000007E0000-0x0000000000840000-memory.dmp
              Download

              memory/4428-83-0x00000000007E0000-0x0000000000840000-memory.dmp
              Download

              memory/4900-116-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/4900-0-0x00000000008A0000-0x0000000000900000-memory.dmp
              Download

              memory/4900-520-0x00000000008A0000-0x0000000000900000-memory.dmp
              Download

              memory/4900-522-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/4900-6-0x00000000008A0000-0x0000000000900000-memory.dmp
              Download

              memory/4900-8-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/5344-27-0x0000000000D20000-0x0000000000D80000-memory.dmp
              Download

              memory/5344-23-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/5344-33-0x0000000000D20000-0x0000000000D80000-memory.dmp
              Download

              memory/5344-160-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/5620-196-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/5620-203-0x0000000000CA0000-0x0000000000D00000-memory.dmp
              Download

              memory/5620-197-0x0000000000CA0000-0x0000000000D00000-memory.dmp
              Download

              memory/5620-205-0x0000000000CA0000-0x0000000000D00000-memory.dmp
              Download

              memory/5620-207-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/5632-137-0x0000000000C30000-0x0000000000C90000-memory.dmp
              Download

              memory/5632-140-0x0000000140000000-0x00000001401AB000-memory.dmp
              Download

              memory/5632-131-0x0000000000C30000-0x0000000000C90000-memory.dmp
              Download

              memory/5632-237-0x0000000140000000-0x00000001401AB000-memory.dmp
              Download

              memory/5812-113-0x0000000001A70000-0x0000000001AD0000-memory.dmp
              Download

              memory/5812-110-0x0000000001A70000-0x0000000001AD0000-memory.dmp
              Download

              memory/5812-115-0x0000000140000000-0x00000001401B5000-memory.dmp
              Download

              memory/5812-104-0x0000000001A70000-0x0000000001AD0000-memory.dmp
              Download

              memory/5812-103-0x0000000140000000-0x00000001401B5000-memory.dmp
              Download

              memory/5904-39-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/5904-40-0x000001FD0C750000-0x000001FD0C7B0000-memory.dmp
              Download

              memory/5904-35-0x00007FFD41640000-0x00007FFD41641000-memory.dmp
              Download

              memory/5904-36-0x00007FFD40FC0000-0x00007FFD40FC1000-memory.dmp
              Download

              memory/5904-37-0x000001FD0C750000-0x000001FD0C7B0000-memory.dmp
              Download

              memory/5904-176-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/5904-519-0x0000000140000000-0x0000000140F04000-memory.dmp
              Download

              memory/5904-153-0x000001FD0C280000-0x000001FD0C419000-memory.dmp
              Download