Overview

overview

7

Static

static

3

2026-05-11...om.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/05/2026, 17:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-11_00b9b5e8d34cc6b2abe6c0112d7344fc_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  • Size 8.9MB
  • Sample260511-v1zyvaa13p
  • SHA256 f46e06a4b7b5d8aace612fc1607884ef62fedf917e2968dfe47a7e84a68e30ed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionransomwarespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 33 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-11_00b9b5e8d34cc6b2abe6c0112d7344fc_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-11_00b9b5e8d34cc6b2abe6c0112d7344fc_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Users\Admin\AppData\Local\Temp\2026-05-11_00b9b5e8d34cc6b2abe6c0112d7344fc_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-11_00b9b5e8d34cc6b2abe6c0112d7344fc_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --crash-handler --database=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\149.0.7814.0\Crashpad --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x2a8,0x2ac,0x2b0,0x2a4,0x2b4,0x1407abd3c,0x1407abd48,0x1407abd58
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3076
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:5008
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4308
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4892
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:468
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1824
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3820
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3552
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2868
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:5072
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1808
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:1644
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4360
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:444
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:5096
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2992
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4240
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2508
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:5104
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3120
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:3756
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:392
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4224
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4760
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2932
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:1748

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 8706d5000eb59f656ba9adc5dcf08da21fcd54d4dbdbb2386f6b27edfb9247ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 eb2ef21292af18a1ab01fea2d440c1dcade3a01c63827f0f72520c36b80c840c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 787237c229f8d5971af1d8a823f6abd0b5b8d81523527d7319c5281425c4a7b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 269fb526a849096b7066830de73ddc6a80d31cf93b3ca6d7596fb0e282535351
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 2c73ebd1e6bb9bf47047ca01e725f6f15e5a48302c4e06e44946197b4befd1bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 6cdae5dfad0f32aea17b782d8767c4d8a5d3bed397b3e006af0ac7215b620fba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 96ac27074e46bcee263e325f1fa7e2a5b90f422d89d91d5b5fe9b351c2680adf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 97b55df2e64dcc0e7e375399d3679c4e426ae4eb547b317441a4cdbaaf071c8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 9a88f399079dc42c13f71ca634114bc3d12977eac55941146f034683e3659f43
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 e06463d8c703e44fa7378cb09864a371c53c6cd36e4d04fe1357f9eee80c8030
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 912b71d5df3336c7381b3df881ed76a35c246f4adb402489ee16d926c2c3f8a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 f02d52fe341b935ebf5fe92d770a500898eda349c38939196b78caa845321419
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 6a8d21e29c91c574c63256b7a55aa5f76cbc05e251bb48a2ddf0bbf48abeaf44
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.3MB
            • SHA256 f525c9ff27ba1bb40badb8015fa8fc0272b7150e7bf85e4e69e6e39401ec02c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
            • Size 6.6MB
            • SHA256 9aa53e24d242cf850e43efd7fa33467c69a3936a6faaf4a6a064118233d58037
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
            • Size 6.6MB
            • SHA256 1960dadea5e5428b61d66f5351a14fee0b6d61042152f988b7c5f033e46feb28
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 2.3MB
            • SHA256 5517199ed45b0e6f009e7e63c59d2cb25d2806759c41084f037426d8b8462a14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevated_tracing_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
            • Size 4.0MB
            • SHA256 41571cce14e79883a44667c165adbaa8296bffd2a62a9a6197415db1c60fc3fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 11627b4fafee5b75395d7a1af8727847d3efabbae214691ae75deccc95e23785
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
            • Size 2.2MB
            • SHA256 6c7dfcbcda301a24c725bc72958a630f8b0f59ddd2079024d69574ee9c2743df
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            os_update_handler.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
            • Size 2.4MB
            • SHA256 e2504f3df9a971e3d4c93546e608ad902c79c05ccb55b30635ba5ada85daa5e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 2.0MB
            • SHA256 68a8885124fa3ee05c46113d0dc9df0e86f782bdc07668bef906f2bf86b983c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.2MB
            • SHA256 fdeecb63152af70c6d736f8e8e5be31f69e3f4e54f7ab0f5ede9d7fb03346542
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.2MB
            • SHA256 89daa8291e76a467aa09187bfabfe6c72f0d714ffa194982a4076919ca7cac16
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.2MB
            • SHA256 be0eddd817076ce36596bd76d55323360bbc66086c211abb8b8c8ada2a3f3342
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.2MB
            • SHA256 02f7914112e311a531641a61444859fe2b4d9f319ea176353db1d66c08dcf21c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.2MB
            • SHA256 42e9a1879e32f98eef1c038d12a49bd1a9f815ebee0f1aee8ad3c1375e1d7bb5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.2MB
            • SHA256 6d8b8912850eb2d1a322af5c0e0bc824e53097059ac67ea2d20ab1c10c83c7ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.2MB
            • SHA256 5aac917fb15329f907cd0466241ebf4eb9c05af2e095a5a3858480f962380c66
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.4MB
            • SHA256 eb37a37decf802a3130792e17d11edf743b15c24b99a06401b3d55e166423f40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.2MB
            • SHA256 855ed23d333b7e911e192ef7eca89a59f811b123fd7f9e4483d15a6d9b8fb326
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.2MB
            • SHA256 36ebdeb8cd6afbb44fdeb77d22202e49c158a172b227d86728a9ae0577da66e1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.3MB
            • SHA256 c31dd686e0d4eea5a811ac8e86be561fe972ec87ef0ce86ffafa8b0d20f6f6be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 6e46bc8044a5adbc90f99a8a8129343942dde9befe962678aa7023b6656e44f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 28c74723f885472c8714434934ed96223ed803470a33c061eeaf832ad689aa3a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.log
            • Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log
            • Size 2KB
            • SHA256 14ce667905d9b1dcb969649995d355c1bb207e31104bf5b8870377f7b863b24c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater_history.jsonl
            • Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl
            • Size 1KB
            • SHA256 2528b98bbd5719908f2621a269d50808e3fab9989e52ed42d557ee4cb9e62913
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            c28f3bcce7d1e4d4.bin
            • Path C:\Users\Admin\AppData\Roaming\c28f3bcce7d1e4d4.bin
            • Size 12KB
            • SHA256 a0f77c4977b965c48ec73e406883acd1389751f3fa79d98de35f75a11c1111d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 6a977cd8bed9da84c2b26f7fb2badd68099b43a5e61417fefeb17b93cd0c136a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 050b0e2bbbb7774caaba9e89a00ab0fc9e8ce9e44a6a77078a5d2a5f18a9a1ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.3MB
            • SHA256 79eb8d4710c55051f4a56bd8ae6f4d225a5ada401eaadd9f1e21df69b6c714f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 0b39d7a5732bec4cf407f82e9035e63d080ceccf5b9153b1846feca8e95809d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 c9259e0ba6abbecf6a39154b9a76967caecd48717c915b0cee6698b8f99bd811
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 20a66043a882be68c59fcf3c4c1e3c253bf2ed3338ff200c620e7e8cb5129203
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.3MB
            • SHA256 7976e4b8a895aab7e26297a24230e56dd2c490c3f384330a085c3d4afac94bab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 19b7f28d716eb87014bb02a19dde0ee9056d1d385ccfa676564ae73b4d4a4716
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 8d7881bb9a2a3bdbe1800aae9655b74d306807bde2c99d89397fcf8b0f577e0c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 8da6657772c0cefba69c90b0fff40d9a6f42e97d1ca99ef6e1cfff22d81e35b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 5eea42b6e8b551d2b2db8f30e63ef374cf28169828706d5a529e1e3e9ac98985
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 2be99c6172afcad0ac2560287ed16124d5b064920091be57877243df3bcdc2fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.3MB
            • SHA256 b3eab02384bd23e9b217a868c3f947e99dfa50a26fa6df03757f2627a5df70fe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 eba124874ca41be668df272ac17a2165e59f964736b38f251f89b57ba86e2c35
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 3708091ab6f065d97d70ff51fa2046565bb316593f75a14b8d8fa670401333ee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 f1e2e25a6029cb0f99ad4cb8c6783944116107774494b0886c1b656c50688afc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.4MB
            • SHA256 11f1a8778e18632434de5a3b700d45c4b1d228d6301225daf8d9c5402de4d726
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 65d2c7bf766f2d43b3ff16588086f1f21ed40e75ade09e81cfb0c461d8c59ba6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 02a2435e9029cf1acdb26f6f41ee15c7621d6fbfbdc3f9f9722445f2b3ff5b88
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.5MB
            • SHA256 22c57435472c3bdfec8bc58ccb0d2c7053eba4ff8617c04a066b466b8cf9137e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.2MB
            • SHA256 aa59c7596037d159777a9b1fd55cfc5fc74036f67e4da8e28a0bec3546298183
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/392-226-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/392-372-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/392-220-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/444-434-0x00000000005D0000-0x0000000000630000-memory.dmp
            Download

            memory/444-436-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/444-366-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/444-151-0x00000000005D0000-0x0000000000630000-memory.dmp
            Download

            memory/444-145-0x00000000005D0000-0x0000000000630000-memory.dmp
            Download

            memory/468-95-0x0000000000EF0000-0x0000000000F50000-memory.dmp
            Download

            memory/468-97-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/468-58-0x0000000000EF0000-0x0000000000F50000-memory.dmp
            Download

            memory/468-52-0x0000000000EF0000-0x0000000000F50000-memory.dmp
            Download

            memory/1644-364-0x0000000000400000-0x00000000005D6000-memory.dmp
            Download

            memory/1748-476-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-480-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-479-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-471-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-472-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-473-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-470-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-469-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-468-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-481-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-482-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-478-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-477-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-475-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1748-474-0x0000024917430000-0x0000024917440000-memory.dmp
            Download

            memory/1808-120-0x0000000000B20000-0x0000000000B80000-memory.dmp
            Download

            memory/1808-126-0x0000000000B20000-0x0000000000B80000-memory.dmp
            Download

            memory/1808-363-0x0000000140000000-0x00000001401EA000-memory.dmp
            Download

            memory/1824-360-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/1824-62-0x0000000000820000-0x0000000000880000-memory.dmp
            Download

            memory/1824-68-0x0000000000820000-0x0000000000880000-memory.dmp
            Download

            memory/2868-359-0x0000000140000000-0x00000001401F8000-memory.dmp
            Download

            memory/2868-105-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/2992-172-0x0000000000770000-0x00000000007D0000-memory.dmp
            Download

            memory/2992-368-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/2992-166-0x0000000000770000-0x00000000007D0000-memory.dmp
            Download

            memory/3076-17-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/3076-31-0x0000000140000000-0x000000014091D000-memory.dmp
            Download

            memory/3076-467-0x0000000140000000-0x000000014091D000-memory.dmp
            Download

            memory/3120-197-0x0000000000BA0000-0x0000000000C00000-memory.dmp
            Download

            memory/3120-206-0x0000000000BA0000-0x0000000000C00000-memory.dmp
            Download

            memory/3120-208-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/3120-203-0x0000000000BA0000-0x0000000000C00000-memory.dmp
            Download

            memory/3552-82-0x0000000001A80000-0x0000000001AE0000-memory.dmp
            Download

            memory/3552-92-0x0000000001A80000-0x0000000001AE0000-memory.dmp
            Download

            memory/3552-88-0x0000000001A80000-0x0000000001AE0000-memory.dmp
            Download

            memory/3552-94-0x0000000140000000-0x0000000140214000-memory.dmp
            Download

            memory/3756-371-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3756-216-0x0000000000CA0000-0x0000000000D00000-memory.dmp
            Download

            memory/3756-210-0x0000000000CA0000-0x0000000000D00000-memory.dmp
            Download

            memory/3820-361-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/3820-72-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/3820-78-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/4032-10-0x0000000140000000-0x000000014091D000-memory.dmp
            Download

            memory/4032-6-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/4032-39-0x0000000140000000-0x000000014091D000-memory.dmp
            Download

            memory/4032-0-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/4224-236-0x0000000000C50000-0x0000000000CB0000-memory.dmp
            Download

            memory/4224-230-0x0000000000C50000-0x0000000000CB0000-memory.dmp
            Download

            memory/4224-379-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4240-369-0x0000000140000000-0x0000000140241000-memory.dmp
            Download

            memory/4240-183-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/4308-48-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/4308-388-0x0000000140000000-0x00000001401E8000-memory.dmp
            Download

            memory/4308-42-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/4360-141-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/4360-365-0x0000000140000000-0x00000001401D4000-memory.dmp
            Download

            memory/4360-135-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/4724-283-0x0000000001DB0000-0x0000000001DC0000-memory.dmp
            Download

            memory/4724-305-0x000000000A1F0000-0x000000000A1F8000-memory.dmp
            Download

            memory/4724-384-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4724-257-0x00000000007F0000-0x0000000000850000-memory.dmp
            Download

            memory/4724-251-0x00000000007F0000-0x0000000000850000-memory.dmp
            Download

            memory/4724-465-0x000000000CCC0000-0x000000000CCC8000-memory.dmp
            Download

            memory/4724-267-0x0000000001B00000-0x0000000001B10000-memory.dmp
            Download

            memory/4724-501-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4760-381-0x0000000140000000-0x0000000140205000-memory.dmp
            Download

            memory/4760-500-0x0000000140000000-0x0000000140205000-memory.dmp
            Download

            memory/4760-246-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/5008-38-0x0000000140000000-0x00000001401E9000-memory.dmp
            Download

            memory/5008-28-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/5008-22-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/5072-116-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/5072-362-0x0000000140000000-0x000000014020E000-memory.dmp
            Download

            memory/5096-156-0x0000000000630000-0x0000000000690000-memory.dmp
            Download

            memory/5096-162-0x0000000000630000-0x0000000000690000-memory.dmp
            Download

            memory/5096-367-0x0000000140000000-0x00000001401D5000-memory.dmp
            Download

            memory/5104-370-0x0000000140000000-0x0000000140221000-memory.dmp
            Download

            memory/5104-193-0x0000000000800000-0x0000000000860000-memory.dmp
            Download

            memory/5104-187-0x0000000000800000-0x0000000000860000-memory.dmp
            Download