Overview

overview

8

Static

static

3

2026-05-11...ar.exe

windows10-2004-x64

8

2026-05-11...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/05/2026, 02:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  • Size 2.8MB
  • Sample260511-cgf3hsds5m
  • SHA256 117719b1aae2bb4f5a93c390bed6b9568df0aa7401b035740365d1b1ae299ffa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2712
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2160
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4180
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4132
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5000
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1188
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2456
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3280
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3240
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4204
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2156
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:2672
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4164
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:5112
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2760
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4556
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4840
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2248
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4696
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5076
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1268
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1672
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:868
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1796
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4536
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:5068
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:3492

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Defense Evasion

            Modify Registry

            2
            T1112

            Subvert Trust Controls

            1
            T1553

            Install Root Certificate

            1
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            4
            T1012

            System Information Discovery

            4
            T1082

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 6f95f50eadc4cfe8ddb99446a56921a2afd21bd935db93b5ec28f79a3ccadae1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 42a5c96dbcad1bcf1bdbe8f52a85df6517e164d33cc7b077cbc47e8df46ac049
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 a2c6f9e10b4feb03955d9b8c71f84b8ee4cd3e771ce74481900a11d0265f5465
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 8c987246869f295feb035a09a6b950de5029248eef9ed06fc136b28a8abd1731
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 ce38c6b97a25f4082a9ad39dac463bac86eb506f6ede3f81e2374fe19d9ac8c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 50c3e51dfd3ef44ca47f1cb4c18eb1777863cf9637465844747d3cd18c8738ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 f208c2b6477f37588290d72d24251b79f305fe65747c35133c8a8a80694a6465
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 fe4495a3bfa68300f437992115d3266f74daa8f2e8a19b33153b0aa92dbbe74b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 b084e947f3e3b052435ffbe7f856e2bfd0cc523305876eb47f67011e485e912d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 073e329ed60678dfd5d8ffa0dc0088fdf76165226aed90e8250446eaf2164ddd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 a708499b0373cc79d0477e979d4a74dbe7083d27ce33dde9086a4524067a89fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 cc507005f956ae335cd804e45759e0ad4486c2ba0a3e955d3dd39746eb18c029
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 6ddeb76861ded19eabe405cd9b1e9258be1d6de319f5a56c445a7c4f241298b6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.3MB
            • SHA256 eacf6c4d23c67f8acf9790f978894648c1121bf8f2f65b315b7786df0803d159
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 6.6MB
            • SHA256 9307d59d37ab8707228c7d8300e7c731a71e880b04e05b4db98d94dd7de644c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
            • Size 6.6MB
            • SHA256 d5a78eee4ff2e44d2be4e9f56e6f6a09599540e93ed4bc5412e5117aec47f415
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 4ff227546a9cc97f7c36d34c37219dbf1db8112989bbdec2124ec60cf04581b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 065ce219688fae4817fbd5ae09ae19e13625dcae3a4ac1c7c5555d865945acfb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 37a232fe31f26a221b055deff7dfb857c61a63d5b0f0dde9754711548d5f112d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
            • Size 2.2MB
            • SHA256 d92628cad0ff5adc156ed0d34cdabf8b1c1c2126959a6b41fd04043dad727be8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            os_update_handler.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
            • Size 2.4MB
            • SHA256 6fcef7e6dfa9b21532e6aeb70649fb84a7da4397d76a76d66e7e780b3925ba55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 2.0MB
            • SHA256 30ce407c29d5b576a755e7a569eb5ae2079c24a42f8188d873d1669813b10332
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.2MB
            • SHA256 3029db118d5ccd14ef1ffd849567feb35dde31c866dfc355c53c6fc28b4c54a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.2MB
            • SHA256 10a14e20ca2af574241edd584b2a64bd54ca4e584f9230caf0cd8430f4487af7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.2MB
            • SHA256 898ac08b99b02774258ffe095c94219697654b5c4a4563b98de5a0aef2dc59e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.2MB
            • SHA256 b40cf2747d2ced3e54ea09b0665c8632eee147f1f1c02a401c994e4e045f7d61
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.2MB
            • SHA256 e1e9b466d19d7357f5f9578071be9ceb8601fbfdaf91fdcd90db5723b34719d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.2MB
            • SHA256 80957f4914f3441c7fed9f4643464a6ac77a7f0fd8b0cc33c1d904aa05f29b5c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.2MB
            • SHA256 88b2f24243c5589d48588547181c56e1a59292fb70184f5d05315a7c69e6b6bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.4MB
            • SHA256 789fc48bb73e9288cd8d14fc07bbbc31ac14390c8f2284a9f3cceda970b1d085
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.2MB
            • SHA256 b423b86507faed39b2d59dd7f9bce06aec5a3df265f446e70bd8fa3918e8e4b2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.2MB
            • SHA256 fc1ac8d71ef2908c639f6432973da25274286d730907dc934a38112fe70b4af0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.3MB
            • SHA256 1d25153191350d024cc9c5321d973566b548b4506e7436226cc873de64f205a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.2MB
            • SHA256 ed6dbf5fbc38947e534a84618f05cacded26ad058627b2353a1578be543e09b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.2MB
            • SHA256 4d3465d9a56fb1c018175825cff510424c24ad50e49c312a2a62e44970b0e18f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.3MB
            • SHA256 e7da401f47566fcff1246ff58420f3ea5a4d8157aa28a8f47392f865bc664e81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 dfb0f229ea9e82749b5f1f89439b8f96fe2ea167fcb4d6d4ae6b1e67df0cc4f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 8d72d1e49d85966594a8843dee2bb129b2ea5b46ffe0306ceedb39bc1b1198a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 fdf69cae4a4f0ce87277a1c6c6ceb632f8c88cebc31df252bd35d8291cd5ef83
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 af02e2267de84122671fcaf318c64394a15d3aa57593fbb99abd298d436697dc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.3MB
            • SHA256 56607da268e26b51fb361e4c0cbd73a09c1e9b2b541f27a991e6b7686e44e9ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 7e44f49295ac3efe53e13e7b6825f24cb8218cc6d81d7f9ad4dad8686a4ad385
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 f3f0c9ffe9bf0e5d097dee0eb406fd1ec311725b14cb6a3292da3041b9a640dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 6261cb50fb2425c1a13faf3cc1b73e9b26f15073e4944674225144f29c06d6da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.3MB
            • SHA256 be68287d53b79473fcd445f053f7dbcbd6cef99fa50d139f04aec56e6424265c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 432dedee682cbec3c0f08ff6309b4508094db9e18370b45ccddf414c5063e8d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 ca921e21f3f0f7bba4b9febfa20d7aa731cfe27a316c9448405b56d3e6beed76
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 e4baebbafae6729b5f6a9f2709404626044aa1c94ff4cb01250589050ff280f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 59f60c23ca8855dc3cb493073b4979d060ae2c74c1ef14c443ca0c045f71eada
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 0c1e8b381cbbe642c7bd99aca8e7b531b67cccaac8a32e546438b2d5dbefcd97
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.3MB
            • SHA256 6907df819556a8b19cab15c5bf7872b3eb5cb50f7678d33e9fcf244346094b75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 98847750036aad31ac1821bae4a39940a7ce20ff5f936f54e12195997406b803
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 e7ee11d26cb3ab4dbce7d761c776a718dabd39defddae6e188502c7187644722
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 ab6f89ade90b11a3711d95800ca9c1214ba9b8ed4952aad2c1557b687604d4f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.4MB
            • SHA256 3513fdc1cee5e6696bedc3ad3a803a5d1660705858d3beeb3e79de46b1cd49c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 f2564374a571f2f6a2875893697637d18cadf22c54cc33de2d502a8970b71c66
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 b6842510707fa81b2e802ff16da3218ec0f6a011bf9aeab4a2bb79f1fd5fa5ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.5MB
            • SHA256 6f543b7f452cbfcc2928c3d2f7505e15e95020f3067a0487d99f4d6e8f048d9e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.2MB
            • SHA256 3931379612b535dee56c13a16ae600fb8d3fc169b3b6cd6c40fc6d7d5189875e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/868-277-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/868-217-0x0000000000BB0000-0x0000000000C10000-memory.dmp
            Download

            memory/868-223-0x0000000000BB0000-0x0000000000C10000-memory.dmp
            Download

            memory/1188-255-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/1188-49-0x0000000000CB0000-0x0000000000D10000-memory.dmp
            Download

            memory/1188-55-0x0000000000CB0000-0x0000000000D10000-memory.dmp
            Download

            memory/1188-527-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/1268-275-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/1268-197-0x0000000000AE0000-0x0000000000B40000-memory.dmp
            Download

            memory/1268-203-0x0000000000AE0000-0x0000000000B40000-memory.dmp
            Download

            memory/1672-207-0x0000000000740000-0x00000000007A0000-memory.dmp
            Download

            memory/1672-276-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/1672-213-0x0000000000740000-0x00000000007A0000-memory.dmp
            Download

            memory/1796-227-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/1796-233-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/1796-572-0x0000000140000000-0x0000000140205000-memory.dmp
            Download

            memory/1796-291-0x0000000140000000-0x0000000140205000-memory.dmp
            Download

            memory/2156-257-0x0000000140000000-0x00000001401EA000-memory.dmp
            Download

            memory/2156-113-0x0000000000B20000-0x0000000000B80000-memory.dmp
            Download

            memory/2156-107-0x0000000000B20000-0x0000000000B80000-memory.dmp
            Download

            memory/2160-19-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/2160-13-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/2160-22-0x0000000140000000-0x00000001401E9000-memory.dmp
            Download

            memory/2160-454-0x0000000140000000-0x00000001401E9000-memory.dmp
            Download

            memory/2456-321-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/2456-65-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/2456-59-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/2672-258-0x0000000000400000-0x00000000005D6000-memory.dmp
            Download

            memory/2712-9-0x0000000002140000-0x00000000021A0000-memory.dmp
            Download

            memory/2712-318-0x0000000140000000-0x0000000140309000-memory.dmp
            Download

            memory/2712-0-0x0000000002140000-0x00000000021A0000-memory.dmp
            Download

            memory/2712-8-0x0000000140000000-0x0000000140309000-memory.dmp
            Download

            memory/2760-143-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/2760-269-0x0000000140000000-0x00000001401D5000-memory.dmp
            Download

            memory/2760-149-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/3240-86-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/3240-92-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/3240-320-0x0000000140000000-0x00000001401F8000-memory.dmp
            Download

            memory/3280-81-0x0000000140000000-0x0000000140214000-memory.dmp
            Download

            memory/3280-75-0x00000000015E0000-0x0000000001640000-memory.dmp
            Download

            memory/3280-69-0x00000000015E0000-0x0000000001640000-memory.dmp
            Download

            memory/3280-79-0x00000000015E0000-0x0000000001640000-memory.dmp
            Download

            memory/3492-464-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-458-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-461-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-460-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-459-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-462-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-465-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-469-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-470-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-468-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-467-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-466-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-457-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-463-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/3492-456-0x0000015FAFE90000-0x0000015FAFEA0000-memory.dmp
            Download

            memory/4164-262-0x0000000140000000-0x00000001401D4000-memory.dmp
            Download

            memory/4164-122-0x0000000000700000-0x0000000000760000-memory.dmp
            Download

            memory/4164-128-0x0000000000700000-0x0000000000760000-memory.dmp
            Download

            memory/4180-26-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/4180-35-0x0000000140000000-0x00000001401E8000-memory.dmp
            Download

            memory/4180-36-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/4204-256-0x0000000140000000-0x000000014020E000-memory.dmp
            Download

            memory/4204-97-0x00000000007A0000-0x0000000000800000-memory.dmp
            Download

            memory/4204-103-0x00000000007A0000-0x0000000000800000-memory.dmp
            Download

            memory/4536-354-0x000000000A1F0000-0x000000000A1F8000-memory.dmp
            Download

            memory/4536-238-0x0000000000850000-0x00000000008B0000-memory.dmp
            Download

            memory/4536-449-0x000000000CCC0000-0x000000000CCC8000-memory.dmp
            Download

            memory/4536-338-0x0000000001DB0000-0x0000000001DC0000-memory.dmp
            Download

            memory/4536-322-0x0000000001B00000-0x0000000001B10000-memory.dmp
            Download

            memory/4536-316-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4536-573-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4536-244-0x0000000000850000-0x00000000008B0000-memory.dmp
            Download

            memory/4556-159-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/4556-272-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4696-274-0x0000000140000000-0x0000000140221000-memory.dmp
            Download

            memory/4696-174-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/4696-180-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/4840-273-0x0000000140000000-0x0000000140241000-memory.dmp
            Download

            memory/4840-170-0x0000000000D60000-0x0000000000DC0000-memory.dmp
            Download

            memory/4840-164-0x0000000000D60000-0x0000000000DC0000-memory.dmp
            Download

            memory/5000-84-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/5000-45-0x0000000000D70000-0x0000000000DD0000-memory.dmp
            Download

            memory/5000-38-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/5000-39-0x0000000000D70000-0x0000000000DD0000-memory.dmp
            Download

            memory/5000-82-0x0000000000D70000-0x0000000000DD0000-memory.dmp
            Download

            memory/5076-193-0x0000000000BC0000-0x0000000000C20000-memory.dmp
            Download

            memory/5076-190-0x0000000000BC0000-0x0000000000C20000-memory.dmp
            Download

            memory/5076-195-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/5076-184-0x0000000000BC0000-0x0000000000C20000-memory.dmp
            Download

            memory/5112-267-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/5112-132-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/5112-138-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/5112-451-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/5112-453-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download