Overview

overview

9

Static

static

3

2026-05-22...ar.exe

windows10-2004-x64

9

2026-05-22...ar.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 18:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe
  • Size 2.5MB
  • Sample260522-w92pgads7k
  • SHA256 15220b01e9aa45aeb5b1f92dd68f49cbe4ce194e12690cb4ce39c78eb5050952
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • Detects Reflective DLL injection artifacts 17 IoCs
  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
  • Executes dropped EXE 20 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2684
    • C:\Windows\system32\taskhostw.exe
      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
      1⤵
        PID:3104
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:3276
        • C:\Users\Admin\AppData\Local\Temp\2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe"
          2⤵
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1260
          • C:\Users\Admin\AppData\Local\Temp\m4r6z10h.exe
            "C:\Users\Admin\AppData\Local\Temp\m4r6z10h.exe"
            3⤵
            • Executes dropped EXE
            PID:2948
          • C:\Users\Admin\AppData\Local\Temp\v4z40v7q.exe
            "C:\Users\Admin\AppData\Local\Temp\v4z40v7q.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2960
          • C:\Users\Admin\AppData\Local\Temp\t6grbw44.exe
            "C:\Users\Admin\AppData\Local\Temp\t6grbw44.exe"
            3⤵
            • Executes dropped EXE
            PID:920
          • C:\Users\Admin\AppData\Local\Temp\rpic6vju.exe
            "C:\Users\Admin\AppData\Local\Temp\rpic6vju.exe"
            3⤵
            • Executes dropped EXE
            PID:1744
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:3780
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          1⤵
          • Suspicious use of UnmapMainImage
          PID:3836
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          1⤵
            PID:3344
          • C:\Windows\System32\alg.exe
            C:\Windows\System32\alg.exe
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:2456
          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5700
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
            1⤵
              PID:776
            • C:\Windows\system32\fxssvc.exe
              C:\Windows\system32\fxssvc.exe
              1⤵
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:1624
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
              • Executes dropped EXE
              PID:5508
            • C:\Users\Admin\AppData\Local\Temp\ms-updates-tmp\WinUpdateHelper.exe
              "C:\Users\Admin\AppData\Local\Temp\ms-updates-tmp\WinUpdateHelper.exe" /install
              1⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5316
            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
              1⤵
              • Executes dropped EXE
              PID:3028
            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
              1⤵
              • Executes dropped EXE
              PID:1564
            • C:\Windows\System32\msdtc.exe
              C:\Windows\System32\msdtc.exe
              1⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              PID:1600
            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
              1⤵
              • Executes dropped EXE
              PID:2592
            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
              1⤵
              • Executes dropped EXE
              PID:244
            • C:\Windows\SysWow64\perfhost.exe
              C:\Windows\SysWow64\perfhost.exe
              1⤵
              • Executes dropped EXE
              PID:4188
            • C:\Windows\system32\locator.exe
              C:\Windows\system32\locator.exe
              1⤵
              • Executes dropped EXE
              PID:868
            • C:\Windows\System32\SensorDataService.exe
              C:\Windows\System32\SensorDataService.exe
              1⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Checks SCSI registry key(s)
              PID:3820
            • C:\Windows\System32\snmptrap.exe
              C:\Windows\System32\snmptrap.exe
              1⤵
              • Executes dropped EXE
              PID:2932
            • C:\Windows\system32\spectrum.exe
              C:\Windows\system32\spectrum.exe
              1⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Checks SCSI registry key(s)
              PID:4532
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
              1⤵
              • Executes dropped EXE
              PID:1836
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
              1⤵
                PID:2344

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    elevation_service.exe
                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                    • Size 2.7MB
                    • SHA256 53cbaa95fcd8b0441e4cd0eebbce2f284ab8a5eb46c94da1a4654ca5c593db60
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    maintenanceservice.exe
                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                    • Size 1.4MB
                    • SHA256 93ae28b50cec537757b9108062ada370f4db81e2db4313e6614b9dfb63303971
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    7z.exe
                    • Path C:\Program Files\7-Zip\7z.exe
                    • Size 1.7MB
                    • SHA256 4b6569cbf9beeeebe56e0de718670458944e67067e81864f7a4cb51ecdccec1b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    7zFM.exe
                    • Path C:\Program Files\7-Zip\7zFM.exe
                    • Size 1.5MB
                    • SHA256 39db05c32bbdce86487e070bb8dc5fbf961586af45420669413fdcf07fd46796
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    7zG.exe
                    • Path C:\Program Files\7-Zip\7zG.exe
                    • Size 1.2MB
                    • SHA256 980aaa2d50c17676f3b3500575f31184db3bf852da3083a0208659a15d47a57c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Uninstall.exe
                    • Path C:\Program Files\7-Zip\Uninstall.exe
                    • Size 1.2MB
                    • SHA256 c1f9bbe2bf005cf9a9fed91d8a83d9b06a2986b1018fdf6b62d7910ccc7443ec
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AppVShNotify.exe
                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                    • Size 1.4MB
                    • SHA256 ee2c08d608b676b331342556245889176fa4870b746285bf1b3c123cdd2f314c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IntegratedOffice.exe
                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                    • Size 4.6MB
                    • SHA256 2d533376da9e6f552d42d9a7873f75e843387cc8e0ce63b0ca0d9364c453623e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MavInject32.exe
                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                    • Size 1.5MB
                    • SHA256 309a809ff18cf518c785295af88b428bc0e56359bc1adf22980858bf174b2b76
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OfficeC2RClient.exe
                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                    • Size 24.0MB
                    • SHA256 4126389c1ae9a843ae3c84063a1669c8ee5feaa99277b479148a51d2a40ffb31
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    appvcleaner.exe
                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                    • Size 2.7MB
                    • SHA256 e23c406b49e8b263899c8ceed2608fc4feaa84f312703e96c9902e85a0db4697
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LICLUA.EXE
                    • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                    • Size 1.1MB
                    • SHA256 1db70d101dc0eda368b4270e8cdf345c3456776d8d49e247bdf6f4608cd4a631
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OSE.EXE
                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                    • Size 1.4MB
                    • SHA256 0aaa31b2f8cadace214d7788b38246df63acdcf6ccee00d065b812a4f9c7cf3b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VSTOInstaller.exe
                    • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                    • Size 1.3MB
                    • SHA256 37029c1ac65958827608dbf2e3bc27da7704ac6e0dc34098613886786f6e979d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrmstp.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                    • Size 6.6MB
                    • SHA256 84aed3ce475603c537ba4f0182f59c9f3572f16354c6b7028f466cdcec2a393c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    setup.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                    • Size 6.6MB
                    • SHA256 332c619554ad0bfd089dc9b5ece752efc8d786e832145763efe44ff588fd6505
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrome_pwa_launcher.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                    • Size 2.3MB
                    • SHA256 148e287767cc647dade976bcf5b7a938606a9c3c2e3797f03049f0d9c73dc65b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    elevated_tracing_service.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                    • Size 4.0MB
                    • SHA256 41df3dfd9832de0994a4665605e9e156da4cc628099c9ddbddaeb216170641e5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    elevation_service.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                    • Size 2.8MB
                    • SHA256 5845bd22f03546d7e0d8a4d7ee5536e33e98dc08706dd4f77e5acc0a268824cf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    notification_helper.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                    • Size 2.2MB
                    • SHA256 411edeaef3a3c539b76257736c28b5775de7c9a31caa271f8b83271f50804dc2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    os_update_handler.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                    • Size 2.4MB
                    • SHA256 9006cb680137cbae8e35649cc55503ab75d4024978291f4c9ae2509153654fb3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    chrome_proxy.exe
                    • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                    • Size 2.0MB
                    • SHA256 b294d1d924f5ad30e1b78d6f68f44176067304804400216e54b1e255509b7cff
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    appletviewer.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                    • Size 1.2MB
                    • SHA256 c06a911c19a9ad9c5c1ec648c824fed2b19ac08808754304a4514b03fe828a60
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    extcheck.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                    • Size 1.2MB
                    • SHA256 3136a4532536e9296cb0b0609451f5049826c406db2877447fa2f51698ee7286
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idlj.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                    • Size 1.2MB
                    • SHA256 64f7299dc43ff3f3d9d52c6c53b15696cea65ac294a1bb71a4d8d246a17f050e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jabswitch.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                    • Size 1.2MB
                    • SHA256 3adc35b0b74ab5c0457eaf9c46f5976e9cac85915e1c5a6a01ef8c82d9a52a37
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jar.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                    • Size 1.2MB
                    • SHA256 002c563083603fb284183f36b5b255848051d45920bd29ac3405bc8467d1417b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jarsigner.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                    • Size 1.2MB
                    • SHA256 5718dbca2f877899eeeacb4014a2c406f5746e30fdf9494ecf007bcbd8dc16a3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    java-rmi.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                    • Size 1.2MB
                    • SHA256 1abe40448df5425d7edfc96f8eb2ba09eaaa0611ed25327a9dd1c72401e1bdf2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    java.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                    • Size 1.4MB
                    • SHA256 92fed86dc1bd4fa01e634fff4ff5b1bb03e4c3dd5003d06da58773ad524e5d70
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javac.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                    • Size 1.2MB
                    • SHA256 5746d0e839dff7ee513e5cf612dd6696c217927d3d32d0880afa7ed84f0b9f0c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javadoc.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                    • Size 1.2MB
                    • SHA256 ea620266966235a6025591d9e223dec32dcfbeb2ef6779e3c755391fba214411
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javafxpackager.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                    • Size 1.3MB
                    • SHA256 3e3630df48d2fa60593b61a5ef5b5a8a256b2f46ff75100f7156111c79a23b08
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javah.exe
                    • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                    • Size 1.2MB
                    • SHA256 d04c710b3bc402ba04ba261cc527b5d3e9055658f21cb16f72fbdbaa3a3ac547
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dotnet.exe
                    • Path C:\Program Files\dotnet\dotnet.exe
                    • Size 1.3MB
                    • SHA256 872bafb6d6d7ff34612ed3e101bf3c96c38890a0386a8f17ea91467576545da2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    m4r6z10h.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\m4r6z10h.exe
                    • Size 46KB
                    • SHA256 8cf4ae00be0fe987cc14ae74b0b64c188083b8bbe3b7397239cefd594492c6cd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WinUpdateHelper.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\ms-updates-tmp\WinUpdateHelper.exe
                    • Size 40KB
                    • SHA256 8851510c7680bd7528f7f37a3dc3b29e9d394a71759cde521d2ccfb17329cad6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    rpic6vju.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\rpic6vju.exe
                    • Size 350KB
                    • SHA256 d9947d975a4e7275d27a95b07441d96dc27dc124a8fb49ab9c04cccc1a09e708
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    t6grbw44.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\t6grbw44.exe
                    • Size 868KB
                    • SHA256 ac41ebf04242d24d7796742ac1c043ce2c5628c26f9c0d9c7d0c92486964935e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    v4z40v7q.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\v4z40v7q.exe
                    • Size 331KB
                    • SHA256 78ce4e14603d7f55d7224ee81de07dfc8de099b5929cee0dccad1103c5dad56f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    perfhost.exe
                    • Path C:\Windows\SysWOW64\perfhost.exe
                    • Size 1.2MB
                    • SHA256 416dcb3c79b020c320d20d4646bc188e5fcc046945e83b05990d16993a4c2800
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DiagnosticsHub.StandardCollector.Service.exe
                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                    • Size 1.3MB
                    • SHA256 4d2624402262579da19e2d5ae36b482c16ade0a3ce6f3fee8bd24148627a93d4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FXSSVC.exe
                    • Path C:\Windows\System32\FXSSVC.exe
                    • Size 1.2MB
                    • SHA256 0fb0bd6ad32e8f6f869f7c16481e7fa0d9ff8589e154e2bbd1b284fc9c2d8c25
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Locator.exe
                    • Path C:\Windows\System32\Locator.exe
                    • Size 1.2MB
                    • SHA256 e24d9721cd8446a0f9865f95f940fa1e0bff7ab287e97ab8067b07635a30c64d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    PerceptionSimulationService.exe
                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                    • Size 1.4MB
                    • SHA256 4650cad7eed45b2a97bc2505d0ca058bb68a5fad789abfb7a930852c0a264940
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SensorDataService.exe
                    • Path C:\Windows\System32\SensorDataService.exe
                    • Size 1.7MB
                    • SHA256 25139c71fd07e629f41841c64e249e045c7a298321bac2b99a80fc97ef5c153c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Spectrum.exe
                    • Path C:\Windows\System32\Spectrum.exe
                    • Size 1.3MB
                    • SHA256 2b82527b8379708447bbbd00f3d50fc5b3f0b765c1f2fa2f464629431f8c0f23
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    alg.exe
                    • Path C:\Windows\System32\alg.exe
                    • Size 1.3MB
                    • SHA256 2e92fc60f2ed9033da21f51d2f5416ec7c94a0a51f9e044d05b34396d85d7bc7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msdtc.exe
                    • Path C:\Windows\System32\msdtc.exe
                    • Size 1.3MB
                    • SHA256 7a65a11d1c930ff145ff7845fe585d77daebb187586baa49201c5dadc512c51c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    snmptrap.exe
                    • Path C:\Windows\System32\snmptrap.exe
                    • Size 1.2MB
                    • SHA256 b82cc8cf280588b0e1f4bcef53ba83de67f6306736afd4867c58d83e87ef4f6b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AppVClient.exe
                    • Path C:\Windows\system32\AppVClient.exe
                    • Size 1.3MB
                    • SHA256 8a3a6ddd98d72891e1511b7f67341673882c63535be3bc0512b4919dbd795520
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SgrmBroker.exe
                    • Path C:\Windows\system32\SgrmBroker.exe
                    • Size 1.6MB
                    • SHA256 d048e245bf33e2ffc25facefd6247d221379ce1a53321b62aa70fbee6a859f64
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    StructuredQuerySchema.bin
                    • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
                    • Size 414KB
                    • SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msiexec.exe
                    • Path C:\Windows\system32\msiexec.exe
                    • Size 1.3MB
                    • SHA256 b260d9e88d048fa5af7ec38fe705e9a7c1dfd0988cd996fe84c9e0f306ac66ea
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/244-185-0x0000000140000000-0x0000000140168000-memory.dmp
                    Download

                    memory/244-182-0x0000000000750000-0x00000000007B0000-memory.dmp
                    Download

                    memory/244-426-0x0000000140000000-0x0000000140168000-memory.dmp
                    Download

                    memory/244-176-0x0000000000750000-0x00000000007B0000-memory.dmp
                    Download

                    memory/868-428-0x0000000140000000-0x0000000140134000-memory.dmp
                    Download

                    memory/868-215-0x0000000140000000-0x0000000140134000-memory.dmp
                    Download

                    memory/868-213-0x0000000000770000-0x00000000007D0000-memory.dmp
                    Download

                    memory/1260-125-0x0000000140000000-0x0000000140283000-memory.dmp
                    Download

                    memory/1260-8-0x0000000140000000-0x0000000140283000-memory.dmp
                    Download

                    memory/1260-9-0x0000000000520000-0x0000000000580000-memory.dmp
                    Download

                    memory/1260-260-0x0000000000520000-0x0000000000580000-memory.dmp
                    Download

                    memory/1260-268-0x0000000140000000-0x0000000140283000-memory.dmp
                    Download

                    memory/1260-0-0x0000000000520000-0x0000000000580000-memory.dmp
                    Download

                    memory/1564-126-0x0000000140000000-0x0000000140174000-memory.dmp
                    Download

                    memory/1564-140-0x0000000000D40000-0x0000000000DA0000-memory.dmp
                    Download

                    memory/1564-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp
                    Download

                    memory/1564-121-0x0000000000D40000-0x0000000000DA0000-memory.dmp
                    Download

                    memory/1564-142-0x0000000140000000-0x0000000140174000-memory.dmp
                    Download

                    memory/1600-424-0x0000000140000000-0x0000000140158000-memory.dmp
                    Download

                    memory/1600-153-0x0000000140000000-0x0000000140158000-memory.dmp
                    Download

                    memory/1600-160-0x0000000000770000-0x00000000007D0000-memory.dmp
                    Download

                    memory/1624-76-0x0000000000DD0000-0x0000000000E30000-memory.dmp
                    Download

                    memory/1624-50-0x0000000140000000-0x0000000140136000-memory.dmp
                    Download

                    memory/1624-51-0x0000000000DD0000-0x0000000000E30000-memory.dmp
                    Download

                    memory/1624-57-0x0000000000DD0000-0x0000000000E30000-memory.dmp
                    Download

                    memory/1624-78-0x0000000140000000-0x0000000140136000-memory.dmp
                    Download

                    memory/1836-275-0x00007FF8D1560000-0x00007FF8D1769000-memory.dmp
                    Download

                    memory/2456-23-0x0000000000770000-0x00000000007D0000-memory.dmp
                    Download

                    memory/2456-22-0x0000000140000000-0x0000000140148000-memory.dmp
                    Download

                    memory/2456-14-0x0000000000770000-0x00000000007D0000-memory.dmp
                    Download

                    memory/2456-184-0x0000000140000000-0x0000000140148000-memory.dmp
                    Download

                    memory/2592-171-0x0000000000870000-0x00000000008D0000-memory.dmp
                    Download

                    memory/2592-174-0x0000000140000000-0x000000014016E000-memory.dmp
                    Download

                    memory/2592-165-0x0000000000870000-0x00000000008D0000-memory.dmp
                    Download

                    memory/2592-425-0x0000000140000000-0x000000014016E000-memory.dmp
                    Download

                    memory/2684-79-0x0000011E055D0000-0x0000011E055D3000-memory.dmp
                    Download

                    memory/2932-430-0x0000000140000000-0x0000000140136000-memory.dmp
                    Download

                    memory/2932-243-0x0000000140000000-0x0000000140136000-memory.dmp
                    Download

                    memory/2932-241-0x0000000000750000-0x00000000007B0000-memory.dmp
                    Download

                    memory/3028-107-0x0000000140000000-0x00000001402D4000-memory.dmp
                    Download

                    memory/3028-105-0x00000000008F0000-0x0000000000950000-memory.dmp
                    Download

                    memory/3028-296-0x0000000140000000-0x00000001402D4000-memory.dmp
                    Download

                    memory/3028-99-0x00000000008F0000-0x0000000000950000-memory.dmp
                    Download

                    memory/3276-149-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-137-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-144-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-82-0x0000000002A30000-0x0000000002A37000-memory.dmp
                    Download

                    memory/3276-139-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-134-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-133-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-130-0x0000000002E20000-0x0000000002E60000-memory.dmp
                    Download

                    memory/3276-145-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-146-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-147-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-148-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-135-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-150-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-136-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-138-0x0000000004390000-0x00000000043D5000-memory.dmp
                    Download

                    memory/3276-187-0x0000000002E60000-0x0000000002E61000-memory.dmp
                    Download

                    memory/3276-188-0x0000000002E70000-0x0000000002E71000-memory.dmp
                    Download

                    memory/3820-226-0x0000000140000000-0x00000001401C1000-memory.dmp
                    Download

                    memory/3820-433-0x0000000140000000-0x00000001401C1000-memory.dmp
                    Download

                    memory/3820-218-0x0000000000550000-0x00000000005B0000-memory.dmp
                    Download

                    memory/3820-429-0x0000000140000000-0x00000001401C1000-memory.dmp
                    Download

                    memory/3820-432-0x0000000000550000-0x00000000005B0000-memory.dmp
                    Download

                    memory/3820-224-0x0000000000550000-0x00000000005B0000-memory.dmp
                    Download

                    memory/4188-203-0x0000000000400000-0x0000000000535000-memory.dmp
                    Download

                    memory/4188-427-0x0000000000400000-0x0000000000535000-memory.dmp
                    Download

                    memory/4532-250-0x0000000000730000-0x0000000000790000-memory.dmp
                    Download

                    memory/4532-256-0x0000000000730000-0x0000000000790000-memory.dmp
                    Download

                    memory/4532-259-0x0000000140000000-0x0000000140149000-memory.dmp
                    Download

                    memory/4532-434-0x0000000140000000-0x0000000140149000-memory.dmp
                    Download

                    memory/5316-72-0x00007FF8D1560000-0x00007FF8D1769000-memory.dmp
                    Download

                    memory/5508-67-0x0000000000570000-0x00000000005D0000-memory.dmp
                    Download

                    memory/5508-258-0x0000000140000000-0x00000001402E9000-memory.dmp
                    Download

                    memory/5508-71-0x0000000140000000-0x00000001402E9000-memory.dmp
                    Download

                    memory/5508-61-0x0000000000570000-0x00000000005D0000-memory.dmp
                    Download

                    memory/5700-202-0x0000000140000000-0x0000000140148000-memory.dmp
                    Download

                    memory/5700-40-0x0000000140000000-0x0000000140148000-memory.dmp
                    Download

                    memory/5700-41-0x0000000000720000-0x0000000000780000-memory.dmp
                    Download

                    memory/5700-32-0x0000000000720000-0x0000000000780000-memory.dmp
                    Download