Overview

overview

7

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

7

2026-08-10...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 23:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
  • Size 3.7MB
  • Sample260810-3jdchsbb95
  • SHA256 4e5d621922379b984c526b37829a75edec6660fe095c2bf4f5706c4bebaae335
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionransomwarespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 21 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:380
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4784
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:2816
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4104
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1968
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3780
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2564
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:548
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1952
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2620
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:220
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4632
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1612
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4688
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4292
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:5028
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4816
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1796
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:1016
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1216
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4064
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        PID:3368
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1180
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
          PID:3068
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2200
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:460
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
            2⤵
            • Modifies data under HKEY_USERS
            PID:4792

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 d8c3b9d0509e090c87cf43f6c35872837d0d52ad3da5b9d7d3250145cad46f55
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.6MB
              • SHA256 9527285308d531488bba962bd6d912aea0caebbbe5d9d620d91e9e13a7c6038b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.9MB
              • SHA256 1d53a282c17cdd4ffefc5fa0d0ad5a25da5608124d23adf093dee7fb0ff3d70f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 945429079cc621fb1344e0e53c2546dc217be87c41d7a109e7916c29501ab8d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 5831f0ac5f3b9836fec3045e71cb9bdb5bf58967a16986b19f354538e233f3fb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.3MB
              • SHA256 b7edb13b2adf9eaa7c620ff6a472575be5b50095423dfdf8edd8b5f535089743
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.6MB
              • SHA256 3dafb62488a986f5a6f6001092d10a7c50a8cee9a5a0e46536076f2ac540453e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 825db6336385ad96473c3baea70a2a4db63c2864cc7bf7e6e8c07bece9ed6ba7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.7MB
              • SHA256 976a08cf59ed2c1abda75bfe1a0117431f28e532140667c22f44e669da56138b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 6dabd5083f93c824cdc2fdf0a687b37375b241c6d6ab4024c211fb05e9096713
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 3cb6450aa5c293ef5b0ad4eabafc4fd1deed80719dfb68ef4ab81d1bc8c8a7f8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 7997092d204b1a7ca949dfef1b1ce043ae1735e7dc73c81e08c6d5debb662422
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.6MB
              • SHA256 c830acaa4df5580f78807a81be8af055c000ca8f0116b7f8dc6e833182982818
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.4MB
              • SHA256 77b4b6f8a3e36cf869820972b7c60e5dcacdfc852e91b40dce12b0cfb50106ef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 4ab46b1b684362e2dbc1026441d28ef7b902c327a4cce2aee4dcc72f581c2b1d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 d609267355127770319a382df760d5a5122a55d7f8b8a6d0085cd0e698c0ebce
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 82062bda8b547548384bbf459706b11adcf513392deae7c8401f596c40702244
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 2431fee483d17ec4085cb9ec5a2297800ca0bba946814e7420211f36581d6859
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 41b790f5ff9dcd50a54680fcaa85fc2214bf2eb1e57c2aa23b1d99c05ee873ed
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 65e2149eb53baff508121203016442431a65a217e4dcb60feba4b7aadaa3a711
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 567b8c1c83ae1985d4227f28199c143952f5a7c7bbb97732f10abf0387e22470
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 9847364f1862c21f68432111a2ff8688c8053882c66f8cd6b220d68daac5d4ce
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.3MB
              • SHA256 e0d7233dcf31d0e4d6c3a2dfaa707905b48c7351fb0eefed131f775f789b46e2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.3MB
              • SHA256 cd98cb6af7ea88c1ecbb42771ec5bf100dc8a230f33d858493aff1e63b502c00
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.3MB
              • SHA256 7a1363fea5e6441c06631963092e133b957bde1af0d0e5fb2ea33257df872ffd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.3MB
              • SHA256 3f0444fa4ed180505becdf57479fff8e00a0cf36804d83d322042e165837f641
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.3MB
              • SHA256 3505e713aa1f25ba429cbeebcf16b1d28f78b03cf3ebecc6b17fae2a37b2311a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.3MB
              • SHA256 0bde1693baa3301474310dc05fd48585effccd998630dcd839e7b5aa61ad1b10
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.3MB
              • SHA256 914e0a288e4b4054b7fef3cf39e0a0852cd2c3d0c773f481f28e367042affdf5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.6MB
              • SHA256 67b7189f1666c2c535c795732d16cd8c95bd4fc1d09c7d3db98c6d5e04923a9b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 1.3MB
              • SHA256 d632ef5017c88d4d705f63e79d23f352993cdec4ed9d2902b54152861dc68b14
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 1.3MB
              • SHA256 6f8a12c3568d554eb5f847bbabbf3f463896800301f01730a327f00c5f58f9ed
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 1.5MB
              • SHA256 c7442b831aab1f40b09f255e2e15caabb6fcce9a6a65d3cd756a8caad421a50b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 1.3MB
              • SHA256 27a9e01c8c8b87e40f22b1caf004025f15716e13094ad517e9323069dfecda97
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 1.3MB
              • SHA256 e299515b3491719f836eac2d46a6f55c901c74927d52675236ffebaf83139d73
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 1.5MB
              • SHA256 b2b4f9c642e549630fb1219dcf1cf6bba2dc0cd8753c62b80b58488a277983ab
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 1.6MB
              • SHA256 6c87b8a41515fedfe88adc765cd2bef119e0527d2fb79dc34a9ebd807ecbd8d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 b458f3f04c40efe42df02624cc92f7fca5266c7d01495a57921835cfff5fc3dc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.4MB
              • SHA256 2df4288d8c91d74e85e9c2e7ae83b334e7c6dd568e0debeb9900981d0b6f5809
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              57C8EDB95DF3F0AD4EE2DC2B8CFD4157
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
              • Size 342B
              • SHA256 70b42c97b0f9fefc41f582c5abcf909ad0a0577f7f5806a09b393b13087e46fe
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.3MB
              • SHA256 7f2291aa8ea629fc43c9f04c04f23d11bd4da82ed58dcc3c869bc285c2037e64
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 6c12208ae829ce9b510570da46aa189a9845c3222786aec88d6f514d10f46ec1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 1.4MB
              • SHA256 ff1fa2936076c32f26c8b039bb36b7e1afb4debeb46006e06cc6074ebee01eb1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 44e7cb5b67570e6f67978df9d8419e3ac4ac655f8daec3d1cfb0f902d6b3426a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 1.3MB
              • SHA256 9ec2840376dec723fb6d870df8c8ef960152b926d96308e8278fde9db66d5a25
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.7MB
              • SHA256 78b3a1739b5f60e236634c4d1251f3c16e90c48449ecef6add7205d50e60cd8f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.4MB
              • SHA256 ea5eaaaa054f9ee01c049eebe782e0bed2b3467671fa4703d685e55abbc01494
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 73155b74b59ccce679a1ab12bdf0b7ce5b940079f9987f50fa57a50e0cef5c8c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 5d3cfe71200db134a2d79c8926fd7a9910c69d10de099b1a3df1bed4fe17c214
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 bd8d68777d2592169cbdd70c5bcac9c55d1208d72169483a8d0007edc9e443c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 1.6MB
              • SHA256 fda0261f1220af29c7dd2686af4365a2b8dda3dd7faba57904f5d3f8e28d04af
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 1cb0724f7de74128ff5da0700eb2966842ba3ab21edd5adb468a72a52fd1046b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 1.4MB
              • SHA256 bcb200926765c35d1fc71395e620d11b9032f11910336995829e59c291792efd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 1.5MB
              • SHA256 7b5aae73de48b8d80b8047257391ac1e887852c81f98ca2026eee8fd156c2ad9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 1.3MB
              • SHA256 3543f3d1cf22ccc0560d27d26ab6489aea1b6832604b10832eb5fd8b38b71c9d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 0601b7b9961b613231a6d71fe883e92fd898312a5e511121515c9250d8454113
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 1b41b1a6d31e282b1d185826b9ae028cdc9014a8ac87fe34efda32bc62b94cad
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 e2ad3a793783c5fa3d729b8b3478af8ef46b5dd4c25ea5f8289d2717408c7290
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 1.6MB
              • SHA256 e868b54f63f34caa4b5f13dc8aa18425e16ac733ab5dfb6566c001da439b2017
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 1.4MB
              • SHA256 c40676d86e3a95f86272e5a23e86d1e943b1405a830f4f7841728c5032f497b5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/220-394-0x0000000140000000-0x000000014016E000-memory.dmp
              Download

              memory/220-105-0x0000000000B40000-0x0000000000BA0000-memory.dmp
              Download

              memory/220-111-0x0000000000B40000-0x0000000000BA0000-memory.dmp
              Download

              memory/380-446-0x0000000140000000-0x00000001403C6000-memory.dmp
              Download

              memory/380-0-0x0000000001FD0000-0x0000000002030000-memory.dmp
              Download

              memory/380-9-0x0000000001FD0000-0x0000000002030000-memory.dmp
              Download

              memory/380-8-0x0000000140000000-0x00000001403C6000-memory.dmp
              Download

              memory/548-80-0x0000000140000000-0x0000000140199000-memory.dmp
              Download

              memory/548-74-0x0000000001A40000-0x0000000001AA0000-memory.dmp
              Download

              memory/548-68-0x0000000001A40000-0x0000000001AA0000-memory.dmp
              Download

              memory/548-78-0x0000000001A40000-0x0000000001AA0000-memory.dmp
              Download

              memory/1180-215-0x0000000000BC0000-0x0000000000C20000-memory.dmp
              Download

              memory/1180-404-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/1216-188-0x0000000000B70000-0x0000000000BD0000-memory.dmp
              Download

              memory/1216-182-0x0000000000B70000-0x0000000000BD0000-memory.dmp
              Download

              memory/1216-191-0x0000000000B70000-0x0000000000BD0000-memory.dmp
              Download

              memory/1216-193-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/1612-126-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/1612-120-0x0000000000620000-0x0000000000680000-memory.dmp
              Download

              memory/1612-396-0x0000000140000000-0x0000000140158000-memory.dmp
              Download

              memory/1796-401-0x0000000140000000-0x00000001401A5000-memory.dmp
              Download

              memory/1796-178-0x0000000000700000-0x0000000000760000-memory.dmp
              Download

              memory/1952-389-0x0000000140000000-0x000000014017C000-memory.dmp
              Download

              memory/1952-84-0x0000000000D30000-0x0000000000D90000-memory.dmp
              Download

              memory/1952-90-0x0000000000D30000-0x0000000000D90000-memory.dmp
              Download

              memory/1968-470-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/1968-384-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/1968-38-0x0000000000D50000-0x0000000000DB0000-memory.dmp
              Download

              memory/1968-81-0x0000000000D50000-0x0000000000DB0000-memory.dmp
              Download

              memory/1968-44-0x0000000000D50000-0x0000000000DB0000-memory.dmp
              Download

              memory/2200-447-0x000000000D0C0000-0x000000000D0C8000-memory.dmp
              Download

              memory/2200-406-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/2200-302-0x0000000001B00000-0x0000000001B10000-memory.dmp
              Download

              memory/2200-426-0x000000000A1F0000-0x000000000A1F8000-memory.dmp
              Download

              memory/2200-318-0x0000000001DB0000-0x0000000001DC0000-memory.dmp
              Download

              memory/2200-472-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/2200-228-0x00000000007B0000-0x0000000000810000-memory.dmp
              Download

              memory/2200-234-0x00000000007B0000-0x0000000000810000-memory.dmp
              Download

              memory/2564-58-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/2564-388-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/2564-64-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/2620-101-0x00000000007C0000-0x0000000000820000-memory.dmp
              Download

              memory/2620-393-0x0000000140000000-0x0000000140193000-memory.dmp
              Download

              memory/2620-95-0x00000000007C0000-0x0000000000820000-memory.dmp
              Download

              memory/2816-469-0x0000000140000000-0x000000014016C000-memory.dmp
              Download

              memory/2816-33-0x0000000140000000-0x000000014016C000-memory.dmp
              Download

              memory/2816-34-0x00000000006C0000-0x0000000000720000-memory.dmp
              Download

              memory/3068-225-0x00000000004C0000-0x0000000000520000-memory.dmp
              Download

              memory/3068-405-0x0000000140000000-0x0000000140189000-memory.dmp
              Download

              memory/3068-219-0x00000000004C0000-0x0000000000520000-memory.dmp
              Download

              memory/3368-403-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3368-471-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3368-205-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/3780-54-0x0000000000C40000-0x0000000000CA0000-memory.dmp
              Download

              memory/3780-48-0x0000000000C40000-0x0000000000CA0000-memory.dmp
              Download

              memory/3780-407-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/4064-402-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/4064-195-0x0000000000BC0000-0x0000000000C20000-memory.dmp
              Download

              memory/4064-201-0x0000000000BC0000-0x0000000000C20000-memory.dmp
              Download

              memory/4292-398-0x0000000140000000-0x0000000140159000-memory.dmp
              Download

              memory/4292-147-0x0000000000700000-0x0000000000760000-memory.dmp
              Download

              memory/4292-141-0x0000000000700000-0x0000000000760000-memory.dmp
              Download

              memory/4632-395-0x0000000000400000-0x000000000055A000-memory.dmp
              Download

              memory/4688-136-0x00000000006C0000-0x0000000000720000-memory.dmp
              Download

              memory/4688-397-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4688-451-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4688-449-0x00000000006C0000-0x0000000000720000-memory.dmp
              Download

              memory/4784-13-0x00000000006C0000-0x0000000000720000-memory.dmp
              Download

              memory/4784-21-0x0000000140000000-0x000000014016D000-memory.dmp
              Download

              memory/4784-22-0x00000000006C0000-0x0000000000720000-memory.dmp
              Download

              memory/4784-452-0x0000000140000000-0x000000014016D000-memory.dmp
              Download

              memory/4792-465-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-457-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-453-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-454-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-473-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-474-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-475-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-476-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-459-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-460-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-461-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-462-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-455-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-456-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-463-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-464-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-466-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-467-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-468-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4792-458-0x00000171FBCB0000-0x00000171FBCC0000-memory.dmp
              Download

              memory/4816-400-0x0000000140000000-0x00000001401C6000-memory.dmp
              Download

              memory/4816-168-0x0000000000D50000-0x0000000000DB0000-memory.dmp
              Download

              memory/5028-157-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/5028-151-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/5028-399-0x0000000140000000-0x0000000140169000-memory.dmp
              Download